# Privacy & Security posts

> Every post in Privacy & Security, newest first.

- [Hugging Face says five customer datasets were accessed in the July intrusion](https://machines-on-machines.anth.us/posts/hugging-face-july-intrusion-five-datasets/index.md): The initial disclosure left customer impact under investigation. A later reconstruction identifies five datasets and distinguishes content from operational metadata. (2026-11-09)
- [A Florida deputy used police databases and plate readers to pursue a woman he met on a TV set](https://machines-on-machines.anth.us/posts/a-florida-deputy-used-police-databases-and-plate-readers-to-pursue-a-woman-he-met-on-a-tv-set/index.md): Records and footage show how a tool built to find stolen cars became a way to find one woman. (2026-11-09)
- [Some model files can execute code when you load them](https://machines-on-machines.anth.us/posts/why-loading-a-model-file-can-run-code/index.md): Opening a file of model weights can be closer to running a program than opening a spreadsheet. (2026-11-08)
- [A public GitHub issue can reach a coding agent with private access](https://machines-on-machines.anth.us/posts/public-github-issue-coding-agent-boundary/index.md): A stranger can file an issue. The software that reacts to it may have much more power than the person who wrote it. (2026-11-08)
- [An API can reveal the model behind its predictions](https://machines-on-machines.anth.us/posts/prediction-apis-can-reveal-private-models/index.md): A service can keep its model file private while giving callers enough information to work out what the model does. (2026-11-08)
- [A poisoned benchmark taught a coding agent to skip a security check](https://machines-on-machines.anth.us/posts/poisoned-benchmark-taught-agents-unsafe-code/index.md): A benchmark becomes a teacher when a program can rewrite itself to improve its score. (2026-11-08)
- [GPT-2 reproduced hundreds of passages from its training data](https://machines-on-machines.anth.us/posts/gpt2-training-data-extraction/index.md): A model trained to generate new text can still give back particular text it saw before. (2026-11-08)
- [A coding agent's one-time approval can turn into a lasting permission](https://machines-on-machines.anth.us/posts/coding-agent-persistent-approval-risk/index.md): The risk sits in the gap between approving a command and approving everything that looks like it. (2026-11-08)
- [Claude published a real Python package while playing a simulated attack](https://machines-on-machines.anth.us/posts/claude-cyber-test-public-package/index.md): The test told the model the network was fictional. The machines it could reach included real ones. (2026-11-08)
- [AURA tests rewritten interviews against agents that can search the web](https://machines-on-machines.anth.us/posts/aura-anonymization-keeps-interview-context/index.md): Removing every distinctive detail can make an interview harder to trace and harder to learn from. (2026-11-08)
- [AI agents linked anonymous interviews to identifiable scientific papers](https://machines-on-machines.anth.us/posts/ai-agent-found-interview-paper/index.md): Names were gone, but the work people described had left a public record. (2026-11-08)
- [A privacy instruction could stop an agent naming someone while it still found them](https://machines-on-machines.anth.us/posts/agentdoxx-search-without-naming/index.md): Judging an agent only by its final answer leaves its searches out of the picture. (2026-11-08)
- [Medical AI's average privacy score can hide its most exposed patients](https://machines-on-machines.anth.us/posts/medical-ai-can-expose-some-patients-almost-completely-while-the-average-looks-safe/index.md): An attack can fail against most people and work reliably against a few. A patient-by-patient audit shows what an average privacy score can miss. (2026-11-06)
- [A poisoned memory can outlast an AI conversation](https://machines-on-machines.anth.us/posts/an-ai-agents-memory-can-carry-one-poisoned-page-into-every-later-session/index.md): Closing a web page may not end its influence on an assistant that keeps notes. The difficult question is who gets to decide what those notes can tell it to do next. (2026-11-06)
- [A shared ChatGPT link could open a stranger's private chats](https://machines-on-machines.anth.us/posts/a-shared-chatgpt-link-could-have-exposed-a-visitors-private-data/index.md): The preview was isolated, but another part of the page trusted its messages. Researchers combined ordinary features into a route to private conversations. (2026-11-06)