During a Senate hearing, FBI Director Kash Patel confirmed that his agency has bought information that could be used to track individuals’ movement and location. “We do purchase commercially available information that’s consistent with the Constitution and the laws under the Electronic Communications Privacy Act, and it has led to some valuable intelligence for us,” he said.

Law enforcement is required to obtain a warrant in order to get location data from cell service providers following the Carpenter v United States ruling from 2018. But why bother with all that hassle when they can just buy the information from the open market?

“Doing that without a warrant is an outrageous end run around the Fourth Amendment, it’s particularly dangerous given the use of artificial intelligence to comb through massive amounts of private information,” Sen. Ron Wyden, (D-Ore.) said during the Intelligence Committee hearing. Wyden is one of several lawmakers pushing for an overhaul of when and how the government can obtain citizens’ personal information.

It’s an overhaul that’s badly needed. Patel already has a history of dubious use of government resources, such as ordering SWAT protections for his girlfriend and somehow horning in on men’s hockey victory celebrations at the recent winter Olympics, so one would hope he’s not also stretching the limits of the few privacy protections that do exist. Then outside the FBI, we have the Department of Homeland Security being sued for illegally tracking immigration raid protestors and the Pentagon’s labeling of Anthropic as a supply-chain risk after the AI company refused to let its products be used for mass surveillance of Americans.

Gaming is growing every day, and a big part of that can be attributed to Tencent Games, which has been behind games like BGMI. Now, MoreFun Studios, a subsidiary of Tencent, has launched the Closed Beta Test (CBT) for its mobile tactical shooter Arena Breakout in India. Players can now download the game’s beta version on Android and iOS and experience hardcore FPS gameplay ahead of its official launch.

What is Arena Breakout?

Arena Breakout is a hardcore tactical first-person shooter in which survival and strategy play a key role. Unlike traditional mobile shooters, the game focuses heavily on realistic combat, inventory management, and extraction-based gameplay.

Players enter the war-torn region of Kamona, a fictional battlefield devastated by civil war. The objective is simple but challenging: explore the combat zone, collect valuable loot, and reach the extraction point safely.

However, players must survive encounters with enemy combatants and other players along the way. Every item carried into battle can be lost if the mission fails, making each run a high-risk, high-reward experience. Arena Breakout has already gained significant global traction, with the developers claiming over 100 million downloads.

Extensive Weapon Customization

Another highlight of Arena Breakout is its Ultimate Gunsmithing System, which allows players to build and customize weapons in great detail. The system includes:

• 700+ weapon accessories
• 10 modification slots
• Extensive gun customization options

Players can modify weapons to suit different playstyles, whether that means building stealth-focused loadouts or heavily armored combat setups.

How To Access the Closed Beta?

If you can’t wait to get your hands on Arena Breakout, the closed beta test is live in India. You can download it on your phone by clicking the link here. Just remember that since it’s a closed beta, there may be random glitches or bugs. So, keep an eye out for those.

The chatbot also is intentionally flexible, with the new integrations in mind. “It can take on slight tweaks to the look and feel, to make it feel like a natural part of other environments,” Danker says.

Shopping Shift

The new Walmart experience is part of a broader pivot for OpenAI to focus on having checkouts take place within embedded apps, the Information reported earlier this month, without providing a rationale for the change. Danker spoke about the shift at the Morgan Stanley investor conference this month but didn’t cite the data behind it.

OpenAI spokesperson Taya Christianson says the company wants to focus on improvements to help users research products, while giving merchants more control over checkout. “We appreciate our partners for learning with us,” she added.

Walmart has excluded some products from Instant Checkout because it knew “the single-item checkout experience is detrimental” in some cases, Danker says. For instance, when someone buys a TV, they likely need to buy accessories like HDMI cables. On its website, Walmart can nudge shoppers to buy a bundle to avoid a frustrating installation experience, Danker says. Through Sparky, Walmart will be able to replicate that in chatbots.

Retailers were eager to collaborate on Instant Checkout because the alternative at the time to serve ChatGPT users was by linking out to their websites. Walmart believes the Sparky experience will feel even “more seamless,” because users will be able to continue chatting and refining their order without needing to reenter their payment and delivery information already saved with Walmart.

Sparky has been criticized by people purporting to work for Walmart on Reddit, and testimonials for the chatbot are difficult to find on social media. But half of Walmart app users have engaged with it, according to the company. While people typically use the app to search for staples such as milk and bananas, they ask Sparky about exotic items or for solutions to more complicated problems. Walmart US CEO David Guggina recently said Sparky users spend about 35 percent more per order than other shoppers.

Danker acknowledges that Sparky is slow and generates weak responses often enough that some consumers might dismiss it as unreliable. Danker says the priority this year is training Sparky to be more proactive, getting it to learn more about individual shoppers, and making it helpful across more of Walmart’s many departments, such as the pharmacy.

While Walmart is pushing Sparky elsewhere, it hasn’t—and doesn’t plan—to block other AI agents from shopping on its website. Amazon, on the other hand, recently won a temporary court order barring Perplexity’s automated technology from masquerading as a human to make purchases. Danker says Walmart wants to support whatever tools customers are using as long as it’s a good experience. As in, there shouldn’t be erroneous orders, shocking bills, or an excessive need for customer service.

“We don’t want to be prescriptive of the exact journey that every customer is going to take,” he says. “We don’t want to block things on a speculative or hypothetical concern.”

When it comes to how many consumers will trust AI with their shopping, Danker is prepared to speculate. “This idea that it will all become automated might be a little bit far-fetched,” he says. “People do get excited about shopping for clothes, for their home, for their children.” Walmart wants to leave users in control, just now with Sparky by their side in more places.

This is an edition of Will Knight’s AI Lab newsletter. Read previous newsletters here.

An AI agent went rogue at Meta, exposing sensitive company and user data to employees who did not have permission to access it.

Per an incident report, which was viewed and reported on by The Information, a Meta employee posted on an internal forum asking for help with a technical question — which is a standard action. However, another engineer asked an AI agent to help analyze the question, and the agent ended up posting a response without asking the engineer for permission to share it. Meta confirmed the incident to The Information.

As it turns out, the AI agent did not give good advice. The employee who asked the question ended up taking actions based on the agent’s guidance, which inadvertently made massive amounts of company and user-related data available to engineers, who were not authorized to access it, for two hours.

Meta deemed the incident a “Sev 1,” which is the second-highest level of severity in the company’s internal system for measuring security issues.

Rogue AI agents have already posed a problem at Meta. Summer Yue, a safety and alignment director at Meta Superintelligence, posted on X last month describing how her OpenClaw agent ended up deleting her entire inbox, even though she told it to confirm with her before taking any action.

Still, Meta seems bullish on the potential for agentic AI. Just last week, Meta bought Moltbook, a Reddit-like social media site for OpenClaw agents to communicate with one another.

Corsair manages to pack a lot of punch into its K100 Air Wireless keyboard, priced at $130 today only (was $330). Pull the full-size board out of its packing, you can’t help but note how light it is, weighing in at less than two pounds. The brushed aluminum on top provides a robust feel despite the fact that the board is only 11mm thin at the borders and 17mm where the keys are located, while its low profile allows users to type all day without ever using the wrist rest because their hands naturally fall into place.

The switches are Cherry, which provide a nice mechanical feel that is typically only found on bulkier boards. Each press is shallow, at 1.8mm deep, with 0.8mm of actuation and a clear tactile bump that indicates that every key is registered, and even though you don’t have to push very far, you still receive plenty of pleasing feedback, making it ideal for rapid-fire typing sessions and the like.

Sale

Corsair K100 AIR Wireless RGB Mechanical Gaming Keyboard – Ultra-Thin, Sub-1ms Slipstream, Low-Latency…

• Stunning, Refined, and Ultra-Thin: The K100 AIR is an unbelievably thin wireless gaming keyboard just 11mm at its slimmest point, seamlessly blending…
• Fast Wireless and Wired Connection Options: Three ways to connect to up to five different devices – Via sub-1ms SLIPSTREAM WIRELESS on PC or Mac…
• Masterful Wireless Multi-Tasking: Quickly switch between wireless connections on your PC, Mac, and more at the press of a key, with secure AES 128-bit…

Wireless connectivity, on the other hand, is close to perfect. Slipstream technology at 2.4GHz frequency reduces lag to less than one millisecond and can poll up to 2,000 times per second. If you choose wired, you can get an even faster response, up to 8,000 hz, and Bluetooth allows you to connect up to three devices at once, making switching between laptop, phone, and console a breeze.

Battery life is another area where the K100 Air Wireless excels. Users frequently expect slim designs to have limited battery life, but in this case, the RGB lighting lasts 50 hours on its own, and you can go up to 200 hours of ordinary use before needing to recharge. If you run low on battery, adaptive brightness will automatically activate to save power in low-light situations.

In terms of customization, the software that comes with the board is extremely robust, since you can store up to 50 distinct profiles directly on the board itself, allowing you to carry your settings with you wherever you go without any further effort. You can even perform some pretty weird per-key lighting; 20 layers, anyone? There are distinct buttons for media playback and volume, as well as a smooth volume control wheel. With macro command support, you can program extra keys to do any function you wish.

When compared to other wireless options on the market, the K100 Air Wireless truly shines out; Logitech and Razer models, for example, cannot compete in terms of battery life or polling speed. It doesn’t hurt that this one has larger inbuilt storage and supports multiple devices. The build quality is likewise excellent, as the board’s low thickness does not compromise ruggedness.

Identity protection company Aura has confirmed that an unauthorized party gained access to nearly 900,000 customer records containing names and email addresses.

The company states that the incident was caused by a voice phishing attack targeting an employee, which exposed the sensitive data of 20,000 current and 15,000 former customers.

In a communication this week, Aura states that the data originated from a marketing tool used by a company acquired by Aura in 2021, which exposed limited information.

Aura is a consumer digital safety firm that sells identity theft protection, credit and fraud monitoring, and online security tools for phishing protection, positioning itself as an all-in-one service for online protection.

Earlier this week, the threat group ShinyHunters claimed the attack on their data extortion site, stating that they stole 12GB of files containing personally identifiable information (PII) on customers, as well as corporate data.

The threat actor leaked the stolen files, saying that the company “failed to reach an agreement with them despite all the chances and offers” they made.

According to Aura, the compromised customer information includes full names, email addresses, home addresses, and phone numbers. The company emphasizes that Social Security Numbers (SSNs), account passwords, and financial information were not compromised.

The Have I Been Pwned (HIBP) service analyzed the leaked data and added it to its database, noting that customer service comments and IP addresses were also exposed. HIBP also stated that 90% of the email addresses exposed in this incident were already present in its database from past security incidents.

BleepingComputer has asked Aura about the discrepancy between HIBP reporting a little over 901,000 affected accounts, and the company said that their figure was accurate.

This is explained by the fact that the data collected through the marketing tool was inherited when acquiring the company in 2021. However, the database contained only 35,000 Aura customers. The company declined to comment further on ShinyHunters’ claims or the alleged Okta SSO compromise.

Currently, Aura is conducting an in-depth internal review in partnership with external cybersecurity experts and has confirmed to BleepingComputer that they have also informed law enforcement authorities.

Aura told us that it will soon send personalized notifications to all affected individuals.

Malware is getting smarter. The Red Report 2026 reveals how new threats use math to detect sandboxes and hide in plain sight.

Download our analysis of 1.1 million malicious samples to uncover the top 10 techniques and see if your security stack is blinded.

Advertisement

Download The Report

The problem is that agencies often lack the staff and resources to do thorough reviews, which means the whole system is leaning on the claims of the cloud companies and the assessments of the third-party firms they pay to evaluate them. Under the current vision, critics say, FedRAMP has lost the plot.

“FedRAMP’s job is to watch the American people’s back when it comes to sharing their data with cloud companies,” said Mill, the former GSA official, who also co-authored the 2024 White House memo. “When there’s a security issue, the public doesn’t expect FedRAMP to say they’re just a paper-pusher.”

Meanwhile, at the Justice Department, officials are finding out what FedRAMP meant by the “unknown unknowns” in GCC High. Last year, for example, they discovered that Microsoft relied on China-based engineers to service their sensitive cloud systems despite the department’s prohibition against non-US citizens assisting with IT maintenance.

Officials learned about this arrangement—which was also used in GCC High—not from FedRAMP or from Microsoft but from a ProPublica investigation into the practice, according to the Justice employee who spoke with us.

A Microsoft spokesperson acknowledged that the written security plan for GCC High that the company submitted to the Justice Department did not mention foreign engineers, though he said Microsoft did communicate that information to Justice officials before 2020. Nevertheless, Microsoft has since ended its use of China-based engineers in government systems.

Former and current government officials worry about what other risks may be lurking in GCC High and beyond.

The GSA told ProPublica that, in general, “if there is credible evidence that a cloud service provider has made materially false representations, that matter is then appropriately referred to investigative authorities.”

Ironically, the ultimate arbiter of whether cloud providers or their third-party assessors are living up to their claims is the Justice Department itself. The recent indictment of the former Accenture employee suggests it is willing to use this power. In a court document, the Justice Department alleges that the ex-employee made “false and misleading representations” about the cloud platform’s security to help the company “obtain and maintain lucrative federal contracts.” She is also accused of trying to “influence and obstruct” Accenture’s third-party assessors by hiding the product’s deficiencies and telling others to conceal the “true state of the system” during demonstrations, the department said. She has pleaded not guilty.

There is no public indication that such a case has been brought against Microsoft or anyone involved in the GCC High authorization. The Justice Department declined to comment. Monaco, the deputy attorney general who launched the department’s initiative to pursue cybersecurity fraud cases, did not respond to requests for comment.

She left her government position in January 2025. Microsoft hired her to become its president of global affairs.

A company spokesperson said Monaco’s hiring complied with “all rules, regulations, and ethical standards” and that she “does not work on any federal government contracts or have oversight over or involvement with any of our dealings with the federal government.”

This story originally appeared on ProPublica. ProPublica is a Pulitzer Prize-winning investigative newsroom. Sign up for The Big Story newsletter to receive stories like this one in your inbox.