On social media, videos show people clearing out their fridges, swearing off salads and debating whether it’s safe to eat cilantro. You might dub it “produce paranoia.” 

It’s the frantic but expected internet response to the surge in cases of a diarrhea-causing parasite that’s rapidly spreading across the US, as health officials investigate what type of produce is contributing to the outbreak.

The gastrointestinal illness is caused by cyclospora, a foodborne pathogen that’s difficult to trace but has historically been linked to fresh produce such as berries and lettuce. For several weeks, no specific food, brand, grower or supplier was conclusively identified as the source of the outbreak, which has led to panicking and a whole lot of dark memes.

The CDC reported late Thursday that officials are investigating a link to shredded iceberg lettuce served at Taco Bell locations in Indiana, Kentucky, Michigan, Ohio and West Virginia. The agency advised consumers to avoid eating shredded lettuce from Taco Bell locations in those states. The CDC said Taco Bell is working to remove the contaminated produce from its locations and is also working with the supplier to determine whether any was sent to other locations.

Earlier this week, the US Centers for Disease Control and Prevention had received reports of 1,645 laboratory-confirmed domestic cases of cyclosporiasis and was investigating 5,100 additional reports. Cases of the “explosive diarrhea parasite” have been reported across 34 states, with Michigan among the hardest-hit regions. 

With any health scare, bad advice and myths spread just as fast as the actual illness. So we turned to health care experts to learn the facts. 

“I wouldn’t necessarily suggest that people avoid produce,” said Dr. John Openshaw, an infectious disease physician and medical epidemiologist at Stanford University. “Even though the number of people involved in the current outbreak or outbreaks seems large, overall the risk remains very low to most people.” 

What is cyclosporiasis?

Cyclosporiasis is caused by cyclospora cayetanensis, a microscopic parasite transmitted through fecal matter that infects the small intestine. According to infectious disease experts at Johns Hopkins, it takes only a few microscopic cyclospora eggs to hijack your gastrointestinal tract. 

In the US, previous cyclospora outbreaks have frequently been associated with fresh produce, including bagged salad mixes, cilantro, basil, raspberries, snow peas and green onions. Any food that’s contaminated and eaten uncooked can theoretically transmit cyclospora. 

Unlike some stomach illnesses, such as the norovirus, cyclosporiasis is unlikely to spread directly from one person to another. After the parasite leaves an infected person’s body, it generally needs at least one to two weeks in the environment before it becomes infectious.

Advertisement

What are the symptoms of cyclosporiasis?

The most common symptom is watery diarrhea that can be frequent and, according to the CDC, sometimes “explosive.” Other unpleasant symptoms can include stomach cramps, nausea, loss of appetite, bloating and gas, fatigue, vomiting and a low-grade fever. 

Unlike deadlier foodborne illnesses such as listeria or E. coli, cyclosporiasis isn’t usually life-threatening. The biggest risk right now during the hot summer months is dehydration. “People who are sick and are having trouble keeping hydrated should talk to a doctor,” Openshaw said. 

Symptoms typically begin about one week after exposure, although they can appear anywhere from two days to two weeks or longer afterward. Dr. Timothy Henrich, professor of medicine at UCSF, said it’s typical for people to have “waxing and waning symptoms” over weeks to months. Others who are infected might have minimal or even no symptoms, he said. 

Because symptoms can come and go, it’s important to get tested for cycolosporasis and talk with a doctor about treatment, which is generally well-tolerated and “may reduce the chances of further local fecal-oral spread,” Henrich said. 

How high is the risk?

While cyclosporasis cases span a lot of the country, the outbreak’s highest concentration is in a small cluster of states, mostly in the Midwest. Jessica Steier, a public health scientist and CEO of Unbiased Science, said the risk remains low outside those areas, but that anyone who is “pregnant or immunocompromised might consider erring on the side of caution.” 

The CDC says that only about 9% of people who contract the parasite require hospitalization, but the risk of severe illness and lasting complications is significantly higher for seniors, young children and others with weakened immune systems. The CDC said Tuesday that it had received no reports of deaths linked to the outbreak.

Advertisement

How can you reduce your risk?

As of Tuesday, there was no nationwide recommendation to throw away lettuce. However, Michigan health officials have issued more specific guidance for lettuce during the current investigation, including buying whole heads of lettuce instead of bagged lettuce or premixed salad kits (then discarding the outer three layers of leaves) and cooking leafy greens when practical. 

Though washing fresh produce might reduce your exposure to cyclospora and other foodborne contaminants, it can’t guarantee the parasite will be completely removed.

“Washing produce does not meaningfully decrease the risk of cyclospora, and heat remains the gold standard for risk reduction,” Steier said. Cooking vegetables at an internal temperature of 158 degrees Fahrenheit or higher is the only surefire way to kill the parasite.

Experts also warn against using soap, bleach or household disinfectants on produce. Fruits and vegetables can absorb soap and detergent, which may make you sick, and the CDC says routine chemical disinfection is unlikely to kill cyclospora.

Household tools or countertop items such as UV produce washers, ultrasonic cleaners or ozone devices won’t make contaminated food safe to consume, either. Steier confirmed that none of those methods have sufficient real-world evidence to support their use in killing the parasite.

What should you do if you have symptoms?

Experts advise contacting a health care provider if you develop persistent watery diarrhea, especially if it is severe, lasts longer than a week or goes away and then returns. Drinking fluids is also important because prolonged diarrhea can cause dehydration. 

Diagnosing cyclospora requires special lab testing, and the parasite isn’t included in routine stool testing. The CDC says patients sometimes need to provide multiple samples because cyclospora can be difficult to detect.

The standard treatment is the prescription antibiotic combination trimethoprim-sulfamethoxazole, commonly sold under the brand names Bactrim and Septra. People who are allergic to sulfa drugs should discuss other options with a medical professional. 

Why is it so hard to identify the source of an outbreak? 

It often takes weeks or longer to identify the source of a parasitic outbreak because investigators have to compare what sick people ate, then trace the foods back through the supply chain. For cyclospora, that process is especially difficult because symptoms often begin days after exposure. 

Public health agencies have also faced staffing cuts and funding reductions in recent years, making it harder to identify outbreaks quickly and to tell people which foods to avoid. A recent study found that states with more CDC support reported more outbreaks than those without those programs, suggesting that federal funding improves detection and management. 

“Tracing any outbreak like this requires trained staff and resources — any cut to those elements of a public health response would impede efforts to trace an outbreak to a specific food item and identify how a pathogen like cyclospora got into the food supply,” Openshaw said. 

It’s a mammoth task to bring a beloved IP like Heartstopper to a close, but creator Alice Oseman has done an incredible job with the new Netflix movie, Heartstopper Forever.

If you’re bummed out because we’re not getting a full fourth season, don’t be. As Nick (Kit Connor), Charlie (Joe Locke), and the gang all brace before going their separate ways to university, a feature film actually reflects their growing maturity and crises of confidence much more fittingly.

A new macOS information-stealing malware dubbed ClickLock terminates all visible processes to force users into entering their system login password.

The malware is designed to steal cryptocurrency assets, login credentials, password-manager data, browser information, and macOS authentication data, and it can also install a persistent backdoor for ongoing remote access to infected systems.

Researchers at Group-IB analyzed the ClickLock shell script after discovering the malware on VirusTotal, where it was first submitted on June 9. At the time of the report, it remained undetected by all security vendors available on the platform.

Further investigation revealed that the malicious script has infected at least 100 systems across 33 countries since May.

The compromise likely begins via a ClickFix lure, as the researchers observed pastes of a malicious command in the Terminal that trigger a fake Cloudflare “human verification” sequence with an animated progress bar.

At the same time, keyboard interrupts are disabled, the terminal cursor is hidden, and the stealer modules are downloaded in the background.

The macOS NotificationCenter is also suppressed for about six hours, effectively disabling notifications that could expose the attack.

Forcing password entry

Group-IB researchers highlight that ClickLock does not require any exploits or elevated privileges but achieves its goal through social engineering and forced interaction loops.

Operational success is obtained through the malware’s mechanism for coercing the victims into entering their macOS system password.

Group-IB says that the script initially displays a fake macOS password dialog using the victim’s real username and a downloaded Apple icon.

If the user enters their password, the malware validates the data and exfiltrates it to the attacker via Telegram.

In case the user cancels the dialog, the malware establishes persistence via two macOS LaunchAgents (com.authirity.plist, com.chromer.plist) and reloads at the next login.

At the next activation, the password-stealing module runs a termination loop every 210 milliseconds, targeting key apps (e.g., Finder, Dock, Terminal, Activity Monitor, Console, System Settings, Spotlight, web browsers) and shows only a password dialog on the screen until the victim complies.

Group-IB reports that the loop is configured to continue for 300,000 seconds (about 83 hours), or until the victim supplies a correct password.

The second LaunchAgent runs a separate coercion mechanism that also terminates many of the mentioned system applications, requesting Keychain authorization via a legitimate system prompt, seeking approval to access Chrome’s Safe Storage key.

That key could then be used to decrypt offline Chromium-stored passwords, cookies, and autofill information from stolen databases.

This second mechanism has a repeat interval of 200 milliseconds and is configured to last for nearly 35 days (3 million seconds).

ClickLock also deploys a data-harvesting module, which targets the following:

• Data from eight browsers: Chrome, Firefox, Brave, Edge, Opera, Vivaldi, Arc, and Chromium
• Saved logins, cookies, autofill data, bookmarks, local storage, and session storage
• Cryptocurrency wallet extensions and desktop wallet files
• Encrypted wallet vault material for potential offline cracking
• Password-manager extension data
• Cached cryptocurrency addresses across EVM, Bitcoin, Solana, TRON, TON, and Stacks
• Shell histories
• FileZilla FTP configuration and recent-server data
• Basic system information and the public IP address

The harvesting module packages the collected information and a summary log file into a ZIP archive, then uploads it via the Telegram Bot API.

Files larger than 40 MB are split into smaller parts, while retry logic ensures that uploading resumes after temporary network failures.

The final module is a modified version of the open-source tool GSocket that acts as a persistent backdoor for the attackers.

The backdoor establishes persistence through multiple methods, including a LaunchAgent, crontab entries, and modifications to shell configuration files.

It connects through a GSocket relay, allowing the attacker to open a reverse shell and remotely control the system.

Unlike the other ClickLock modules that self-delete after execution, GSocket is the only component that persists on infected systems.

Group-IB warns that “malware leaves a narrow detection window” and that the malicious payloads are hosted on compromised legitimate domains with a clean reputation.

Additionally, the script is not flagged as malicious on VirusTotal, and its modules self-delete after execution, leaving no artifacts.

Despite this, the researchers say that detection is possible based on the activity generated by the malware, such as osascript launching password dialogs, repeated process termination, mass access to browser profile directories, and outbound connections to Telegram’s API.

To defend against these attacks, users should avoid pasting in Terminal commands they don’t fully understand, especially if the request comes from a website.

“Any page that instructs you to open Terminal, regardless of how professional it looks, is attempting to compromise your system,” the researchers say.

If prompted to enter the login password when the rest of the system appears unresponsive, Group-IB recommends forcing a system shutdown by holding the power button and then booting into Safe Mode to recover the system.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

Build starts limited alpha testing later this month.

1Password has launched a browser integration that lets Anthropic’s Claude use stored credentials to complete tasks on the web without the passwords ever reaching the AI model, according to a blog post published on Thursday. The company calls it a zero-exposure architecture: when Claude needs to sign in, 1Password shows the user which credential is being requested and why, then waits for biometric approval before injecting the login directly into the page. Claude never sees the vault item, password, or one-time code, and access ends when the task is complete.

The integration addresses a fundamental tension in agentic AI. Browser-based agents like Claude can navigate websites, fill out forms, and complete purchases, but reaching a login page has historically forced users to either hand over their password or take the wheel themselves. 1Password says this is the first browser integration that lets an agent use credentials without granting direct access to them.

After autofill, 1Password checks whether secrets were exposed on the page. If submission fails, the extension clears the filled values before returning control to Claude. The credential stays encrypted and controlled by 1Password throughout the process.

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!

The launch also introduces Agentic Mode, a feature in the 1Password browser extension that automatically locks down the vault when a compatible AI agent takes control. The agent can only use logins and one-time codes explicitly approved for the current task, and the rest of the vault stays out of reach. Agentic Mode activates even if the 1Password-Claude integration is not configured, and supports agents beyond Claude.

The timing is notable given that security researchers recently demonstrated how AI browsers could be tricked into leaking user credentials through prompt injection attacks, with Anthropic’s own Claude extension among those affected. 1Password CTO Nancy Wang said in the company’s announcement that the answer is not handing agents your secrets, but letting a user give an agent permission to use a credential without letting the agent see it. She called that distinction the foundation of trust in AI agents.

1Password for Claude is available now on Mac for business, family, and individual plans, and requires the 1Password desktop app, browser extension, Claude desktop app, and Claude browser extension. The company, which recently acquired Israeli startup Apono to govern AI agent access inside enterprise systems, said it plans to add support for payment cards and identity details after launch.

CNET’s password manager expert Joe Supan said he would normally be very wary about giving an AI agent access to his password manager, but that 1Password appears to have several good guardrails in place, particularly biometric authentication for each login. The integration marks the first time a major password manager has built a dedicated secure channel for an AI agent to use credentials at runtime, rather than exposing them to the model’s context. Whether the approach holds up against the kind of prompt injection attacks that have already compromised AI browsers remains to be seen.

The brand iRobot launched the first Roomba robot vacuum back in 2002, and popularity for the handy devices skyrocketed from there. Countless competitors have emerged, but Roomba is still going strong. Its latest models have all the new features we love, from doubling as a vacuum and a mop to fantastic navigation and suction. The Roomba Max 705 is currently keeping my house clean as I test it for our robot vacuum guide, and it’s doing a great job both mopping and vacuuming the floors in my massive second story.

Looking to own your own Roomba robot vacuum? These iRobot promo codes and coupons will make it more affordable than ever to own your own powerful robot vacuum from the iconic brand.

Save $400 Off for Fathers Day at iRobot

Give Dad the gift of a clean home (that’s easier than ever) with up to $400 off bestselling iRoomba robot vacuums. This means hundreds of dollars off popular models like the Roomba Plus 505 Combo, Roomba Max 705, and more. Act soon before Father’s Day passes and the deals disappear. A clean home has never been easier (or cheaper) to achieve.

iRobot Promo: Treat a Friend to 15% Off a Robot and Save $15 on iRobot Accessories

I once gifted a friend a robot vacuum and she regularly tells me how it’s a marriage saver. If you want to change a friend’s life (and potentially save their marriage) you can gift a friend 15% off a robot vacuum with this iRobot coupon code, and you’ll get $15 off robot accessories for yourself. A clean win for everyone.

Save 33% on the Roomba Max 705 With Anti-Tangle Brushes Using This iRobot Offer

I test lots of robot vacuums, and my favorite from iRobot’s lineup is the Roomba Max 705. It’s packed with two anti-tangle brushes, excellent navigation, a self-emptying base station, and left my home sparkling clean. It’s a great choice for a Roomba for pet hair, and it’s done a great job with the litter my cat leaves all over the house, too. Extra bonus: it’s gorgeous. You can get 33% off this powerful robot vacuum right now with this iRobot discount code.

Tackle Every Mess Effortlessly: $300 Off the Roomba Plus 405 Combo Robot With AutoWash Dock

Looking for something a little more affordable? The Roomba Plus 405 Combo Robot is cheaper but still packs mopping and vacuuming, and still comes with an auto-emptying docking station. It’s already a pretty affordable model and a great iRobot vacuum for hardwood floors, and right now you can get it for $300 cheaper with this iRobot coupon.

Save $290 on Smart Cleaning: The Roomba 205 DustCompactor Combo Robot Vacuum & Mop

If you don’t want a big base station in your home but still want a robot vacuum that can vacuum and mop, the Roomba 205 DustCompactor is for you. The Roomba 205 will compact and store debris for up to 60 days inside the robot itself, no emptying station required. It’s bagless, like my favorite Shark robot vacuum, so you don’t need to worry about buying and replacing bags to use the vacuum. If that sounds up your alley, don’t miss your chance to save almost $300 on this robot vac with this iRobot promo code.

Get 10% Off Your First iRobot Purchase When You Sign up for Emails

Not sure what you want to get from iRobot, but know you want an iRobot discount code? You can sign up for iRobot’s emails and get a code for 10% off whatever your first purchase is. Enjoy!

Save $500 on Max 705 Combo

The Roomba Max 705 Combo robot + AutoWash dock is the perfect household helper. With a self-cleaning roller mop, detailed edge cleaning, anti-tangle dual rubber brushes, and a powerhouse dock, this impressive robovac-mop combo takes all of the gruntwork out of the normal household cleaning chores. Usually $1,300, the Max 705 is nearly half off at $800. If you’ve been looking to upgrade your cleaning routine, snag this model for $500 less than usual, for a limited time.

Get 20% Off iRobot Accessories

An iRobot is an investment, requiring parts replacement, upgrades, and routine maintenance to keep your device in tip-top shape. iRobot knows this and wants to keep the costs down while maintaining the longevity of this top tech. Be sure to check out iRobot Accessory Offers for huge savings on genuine iRobot accessories for your robot, including up to 20% off with bundle deals. With this “buy more, save more” sale, you can build your own bundle for increased savings, so when you buy any 2, you’ll get 10% off; buy any 3, get 15% off; or when you buy any 4, you’ll get 20% off on eligible accessories. So whatever your need is, make sure you take advantage of this deal and stock up on essential accessories like filters, dirt disposal bags, replacement parts and more.

U.S. beverage maker Coca-Cola said one of its dairy subsidiaries was hacked and that it’s shutting down its operations for the foreseeable future. The multinational giant said in a disclosure with the U.S. Securities and Exchange Commission that its Fairlife dairy company was hit by ransomware and that its production systems are affected. The company said that its Fairlife production operations across the United States are “temporarily suspended.”

Fairlife’s operations in Canada are unaffected.

Coca-Cola is one of the largest companies in the world, with products spanning carbonated drinks, water, and dairy products. Its Fairlife dairy is one of the company’s major brands, with an estimated $4 billion in sales by 2024.

Ransomware attacks on food and beverage companies can have lasting effects. Past incidents at Arizona Beverages in 2019 and food distributor giant UNFI last year resulted in weeks-long disruptions to their respective production lines and empty grocery shelves.

Coca-Cola didn’t say when Fairlife’s systems would be restored.

Do you know about the cyberattack at Fairlife? Do you work at the company? We would love to hear from you. From a non-work device, you can securely contact Zack Whittaker on the Signal messaging app with the username zackwhittaker.1337.

Weekly newsletters

Get daily news, weekly deals and the week’s top tech stories

Commenting access

Join the conversation, share your thoughts and get expert advice

Member badges

Earn badges as you explore news, deals, reviews, guides and more

Exclusive deals

Save on gadgets, subscriptions and accessories with handpicked discounts

Presented by Ping Identity

Enterprises need to treat zero trust security architecture as an immediate requirement for AI agents rather than a long-term goal, says Andre Durand, CEO and founder of Ping Identity. Zero trust, the security model built on the assumption that no user, device, or system should be automatically trusted, requires continuous verification before every action rather than a single check at login. Agentic AI has profoundly compressed the risk timeline enterprises must manage, demanding that permission decisions be evaluated in real time.

That compression shows up in how permissions accumulate. Every time an employee approves an AI agent’s request for access to a company drive, a database, or a code repository, the enterprise hands over a sliver of control that looks routine in isolation. Across thousands of agents making thousands of requests, those approvals accumulate into an exposure that most existing security architectures were never built to measure.

“The rise in desire to use agents right now, and the speed of agentic, is highlighting the need to move faster on the principles of zero trust,” Durand says. “Agents just move faster, full stop. A human compromise might be measured in minutes or hours, sometimes days. At agentic speed, a thousand actions could happen in five minutes.”

Why zero trust is now urgent for agentic AI

That difference in velocity changes how enterprises need to think about permissions. Two variables matter: the surface area of access an agent is granted and the duration that access remains valid. Traditional identity and access management tends to grant broad permissions and leave sessions open for extended periods because the human using them moves at human speed. Zero trust, in contrast, collapses both variables at once by narrowing access down to what is strictly necessary and revalidating it continuously, rather than once at login.

“Zero trust really just says, just enough, just in time,” Durand says. “It’s your next action that we care about. We’re moving identity from an era where access was our runtime control point — meaning were you logged in, did you have a session — toward the decision that sits behind that login.”

Why agents must be treated as first-class identities

That shift to decision-based control has direct implications for how agents should be provisioned in the first place. The common practice of letting an agent operate under a cloned human login or a shared service account doesn’t work, Durand says.

“Each agent should have its own identity,” he explains. “It should not be impersonating the human. It can act on behalf of the human, we could explicitly delegate authority to an agent, but we don’t want to blur the lines between the human taking action and the agent taking action.”

And beyond that is another concern: the shared secrets, API keys in particular, that many service accounts still rely on. For example, the habit of embedding keys directly in source code, where they can be committed accidentally and exposed, is a convenient but weak security pattern that agentic workflows make considerably riskier. Building service account architectures that let agents authenticate without relying on those shared credentials or other long-lived standing access is now an urgent priority rather than a long-term cleanup project.

Where enterprises can enforce zero trust policies

Enforcing any of this in practice requires identifying where policy can actually be applied. Several existing choke points, including API gateways and the agent gateway sitting in front of MCP servers, offer practical locations where enterprises can inspect what an agent is requesting and apply policy rules before granting it.

“Those policies could leverage real-time risk and fraud signals, and then enforce, deterministically, what the agent can do when it interacts with these systems,” Durand explains.

The goal is to move authorization from something decided once at login to something evaluated at the moment of every consequential action, such as an agent attempting to commit code to a repository. Instead of carrying a standing permission to write to GitHub, the agent’s request would be checked against context and policy at that specific moment, closing the window of trust down to the scope of a single action.

Stopping AI agents from rewriting their own permissions

That model becomes especially important given how agents can behave once they are already inside a system — for example, coding agents that have acknowledged, when questioned, either ignoring a specific guardrail entirely, or attempting to rewrite the permissions they were given.

“Who’s watching the watcher? Zero trust needs to apply here,” Durand says. “If generative AI systems follow your instruction 97% of the time, and you’re simply asking it for advice, that might be fine. If it’s responsible for making a decision about who gets let in, 97% is not good enough.”

How to trust AI-generated output at agent speed

The answer to that gap is not to eliminate AI from the review process, but to structure reviews so no single agent’s judgment is taken at face value. Because human review cannot scale to the volume and speed of agentic output without erasing the advantage of using agents at all, a new framework is necessary, so that when one agent produces work, such as code, separate agents evaluate it, provided those reviewing agents are kept from communicating with one another or with the one they are checking. It’s a new human-AI paradigm, Durand says.

“We probably will have to develop frameworks that we trust without seeing or verifying the output directly,” he explains. “It’s not that that construct is 100% foolproof. However, it’s the best we can do to move at agent speed. We can’t trust the exact output, but we can trust the framework.”

In practice, that means combining automated review with clear human accountability for higher-risk decisions, rather than treating agent output as self-validating.

For traditional auditors, reviewing every transaction individually is never feasible, and statistically valid sampling stands in for full verification. The same applies to risk accumulation: a single agent action might carry little risk on its own, while a sequence of actions moving in a consistent direction could cross a threshold that triggers an intervention, including a kill switch capable of halting the agent before further harm occurs.

What to ask when evaluating agentic identity platforms

For security leaders evaluating identity platforms for agentic AI, there’s no narrow checklist. Enterprises should evaluate what their full lifecycle of agent management looks like. Most enterprises are managing agents on two fronts simultaneously: customer-facing agents acting on behalf of external users, and internal agents deployed to automate enterprise processes.

“Pause long enough to see the totality of what it would mean to secure multiple agents, both interacting with you from the outside as well as being deployed on the inside,” Durand says. “We need discovery and visibility of all the agents operating within our estate, a place to register them, a standard way to assign custodians, and a way to construct and centralize policy so security can enforce it across the organization.”

And while basic security principles were already fully understood before agentic AI arrived, what has changed, Durand says, is that the cost of moving slowly has finally caught up with the cost of moving carelessly, giving enterprises a narrowing window to build the right architecture before widespread agentic adoption makes retrofitting far more expensive.

Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.