the daily brief

Cyber / Brief, 4 Nov 2026: EU court adviser backs AI training but limits chatbot reuse of news

curated by Paolo De Rosa updated 04 Nov 2026

An adviser to the EU's top court has said AI firms may generally train on copyrighted works but that chatbots can infringe the press publisher's right when they reuse articles in their answers, with the operator liable where infringement is built into its business model; the opinion is not binding, though the court usually follows such advice. It lands as US publishers sue Brave for allegedly supplying paywalled news to AI companies, and as a leaked draft of the Commission's 2027 work programme promises an industrial AI blueprint and a package on copyright. In Washington the White House is refusing to release any of its frontier AI review framework, even under a lawsuit. Binance, meanwhile, traced its $6.3bn theft to fake job interviews and a compromised internal AI tool, an attribution to North Korea that Pyongyang denies, and the supermarket fridge attacks have reached British food suppliers while researchers caution that no one has yet been shown to be behind them.

AI & Power

White House: AI Vetting Framework Still a Secret — HealthcareInfoSecurity.com RSS Syndication
Why it matters: The White House is withholding all 60 pages of records on its frontier AI review, including the seven-page framework, after two nonprofits sued for its release.
The Office of the National Cyber Director cited national security and confidential commercial information in its reply to Protect Democracy, ISMG reports. The review was created by a June executive order under which developers may voluntarily give the government access to frontier models for up to 30 days before release; the NSA decides which models qualify, using classified benchmarks. The complaint notes that the framework is not classified. Europe's own systemic-risk regime publishes its code of practice, so the US model of pre-release vetting offers allies no text to compare against.

Artificial intelligence and cyber intrusion — All Feed
Why it matters: The UK's NCSC has set out three scenarios for the AI-cyber threat in 2028, which it says are plausible but are not predictions.
The scenarios range from a rising global threat, through proliferation that far outstrips British defences, to a slowdown that lets the UK build countermeasures. The assessment judges China and Russia highly likely to remain the greatest state threats, with Russian actors adapting open-source models rather than building their own. It is the primary text behind the warning from the agency's chief reported this week, and its reasoning on open models bears directly on Europe's open-weight debate.

A Defense Contractor Gave Their Personal AI Agent Access to a Secure Pentagon System — DataBreaches.Net
Why it matters: WIRED reports that an Accenture contractor connected a secure Defense Department system to a personal Claude Code account, and that the agent then sent details including login credentials to a high-risk third-party site.
The system holds controlled unclassified information and is used by several intelligence agencies, according to WIRED's sources, who spoke anonymously; the department declined to comment. DataBreaches relays the account, and we have not seen the original. The failure described is one of governance, a personal agent wired into a sensitive system, and the same control gap applies in any European ministry that has contractors and agents.

NIST sets 10 principles for AI agent identity and authorization — Biometric Update
Why it matters: NIST has published ten design tenets for agent identity systems, its starting blueprint for how agents should be identified and authorised.
The post from NIST and MITRE authors, part of a National Cybersecurity Center of Excellence project, follows a concept paper that drew more than 600 responses. NIST now writes "super intelligence" for AI, as a September executive order requires of federal agencies. It is guidance and not a standard, but it arrives before Europe has an equivalent, and the agent identity question sits between the EUDI wallet and the AI Act.

NYT demands Brave shut down its paywall blocker and end deals with AI firms — Ars Technica - All content
Why it matters: The New York Times and other publishers have sued Brave, alleging that it bypasses paywalls and sells stolen news content to AI firms, including through its search API.
The suit, filed in New York, names Anthropic, Perplexity, Mistral, xAI and Cohere among the companies it says receive the content, and claims Brave made more than $100m from it; those are the plaintiffs' allegations. It shifts the fight from the AI lab to the intermediary supplying the web index. It comes as an adviser to the EU's top court says that circumventing paywalls bears on a chatbot's liability.

OpenAI pushes policy rebrand to a skeptical audience — Semafor
Why it matters: OpenAI is calling data centres "compute campuses" and likening AI rules to speed limits, and critics, including former congressman Brad Carson, are dismissive.
Semafor reports the push also seeks community input on buildouts and global AI standards, and comes as Democrats are expected to hold more power after the midterms. For Europe the call for global standards is the part to watch, because it would have to sit alongside the AI Act.

Investors increasingly nervous over AI bubble — Semafor
Why it matters: Investors are voicing concern about AI capital spending and debt, as Alphabet, Meta and Oracle have issued or plan new bonds, Semafor reports.
Institutional investors have urged Anthropic to lower its IPO valuation target, according to The Wall Street Journal as cited by Semafor, and demand for protection through options and credit-default swaps has surged. A financing shock would reach European buyers through the same few suppliers on which they depend.

EU & Technology

AI faces limits in reusing news articles, says top EU court advisor — Tech | Rapporteur
Why it matters: An adviser to the EU's top court says AI firms may generally train on copyrighted works under the text-and-data-mining exception, but chatbots can infringe the press publisher's right when they reuse articles in their answers.
Advocate General Szpunar's non-binding opinion, in a Hungarian publisher's case against Google's Gemini, turns on whether the chatbot accessed the article unlawfully, for example by circumventing a paywall or anti-scraping measures, and whether its answers reuse the article's form of expression recognisably. Merely reporting facts would not infringe. He also says the operator is liable if infringement is inherent to its business model or it took no effective preventive measures. He advised that the referred questions be declared inadmissible, since nothing showed Google trained on those articles. The court usually follows such opinions, but it has not ruled, Rapporteur notes.

EXCLUSIVE: EU executive wants to boost AI use in 2027 work plan — Tech | Rapporteur
Why it matters: A leaked draft of the Commission's 2027 work programme, due on Wednesday, promises an industrial AI blueprint for five sectors and a package on digital transformation, simplification and copyright, Rapporteur reports.
The sectors are health, transport, agri-food, advanced manufacturing, and defence and space. The draft also speaks of strengthening Europe's position in the AI stack through chips, data, compute and funding instruments, and includes a review of the digital decade targets. It is a leak of a draft, so the published text may differ; it would set the next year's agenda for Europe's AI policy, and Rapporteur links the blueprint to the report of the special AI envoy, Jim Hagemann Snabe.

Digitalgipfel: Im Takt der Wirtschaft — netzpolitik.org
Why it matters: Netzpolitik's comment argues that Germany's digital summit passed over the social regulation of AI in favour of growth and data use, while Berlin relies on US frontier models as a bridge.
This is an opinion piece. It points to the government's AI taskforce report, which allows at most 18 months for the key decisions, and to Berlin's push to weaken the GDPR so that AI providers can train on personal data, a move the author says benefits US and Chinese incumbents most. It contrasts this with the independence from China and the US that Merz and Macron demanded at last year's sovereignty summit.

EU approves JD.com’s acquisition of German retail group Ceconomy — Tech | Rapporteur
Why it matters: The Commission has cleared JD.com's purchase of Ceconomy, owner of MediaMarkt and Saturn, under the Foreign Subsidies Regulation, on conditions.
JD.com must deal with Ceconomy on market terms, including any financing, and offer its logistics and technology services to third-party retailers on the same terms, under an independent trustee. The in-depth probe opened in May looked at whether subsidies let the Chinese group offer a higher price. It is a test of how the FSR handles Chinese ownership of a European retailer: by conditions, not by a block.

Microsoft cloud in Ireland under fire for hosting Israeli app used to monitor Palestinians in occupied West Bank — EUobserver
Why it matters: A report by campaign group Ekō says Microsoft hosts key components of Israel's Al Munasseq permit app in Irish data centres; an Irish lawmaker wants an investigation.
The app, run by Israel's COGAT unit, manages Palestinians' movement for work, healthcare and prayer. The findings are the campaign group's, and the article is cut off for non-subscribers, so Microsoft's response, if any, was not read. It raises the question of what EU jurisdiction means for what a US cloud provider hosts on European soil. Excerpt-based.

Russian drones stir fears for EU copper-to-fibre switch-off rules — Tech | Rapporteur
Why it matters: Baltic countries and Poland warn that rural citizens could be cut off if drones damage 5G towers, Rapporteur reports, in the debate over copper-to-fibre switch-off rules.
Only the headline and the standfirst were readable, so the details of the position are not known here. Excerpt-based.

Rules on unsafe ecommerce products coming next month, says Commission — Tech | Rapporteur
Why it matters: The Commission says a delayed European Product Act will come next month, after next week's consumer protection reform, Rapporteur reports.
Only the headline and the standfirst were readable. The file matters for marketplaces selling non-EU goods online, and for how far product liability reaches connected devices. Excerpt-based.

US & Technology

Democrats run more anti-tech ads amid AI boom — Semafor
Why it matters: Democrats in more than 130 federal and gubernatorial races ran anti-tech or anti-data-centre ads this cycle, four times as often as Republicans, says the Tech Oversight Project.
The analysis comes from an advocacy group, shared first with Semafor, which urges Democrats to press the message after the vote. If it holds, the US politics of AI that Europe has to deal with may look less like the current White House line.

States take steps to secure vote after federal pullback — Axios
Why it matters: States largely secured the midterms themselves after federal cuts, using National Guard units, fusion centres and private firms, Axios reports.
Arizona's election security chief says the state has been without a dedicated CISA adviser. Axios cautions that a flaw existing does not mean results can be manipulated. The article is cut short for non-subscribers. The arrangement is a live test of decentralised election defence, a structure European states also rely on.

Defense and aerospace firm settles with government over allegedly failing to meet cybersecurity contract requirements — CyberScoop
Why it matters: ILC Dover and ILC Astrospace will pay $13m to resolve allegations that they billed the Army, Missile Defense Agency and NASA while knowingly missing cybersecurity requirements from 2018 to 2024.
Allegations include storing sensitive data with a cloud provider without proper safeguards, under the False Claims Act. A settlement of this kind makes security clauses a financial liability, which is the same leverage the CRA and NIS2 are meant to exert in Europe.

Postal Service Surveilled Protest Activities Online With Little Rules, Oversight — Deeplinks
Why it matters: Records obtained by EFF show the US Postal Service's iCOP programme monitored social media for protests across the political spectrum, with little sign of oversight.
The bulletins cover 2020 and 2021, and EFF says years of delays and lost emails preceded the release. The account is that of one of the requesters. It shows how an agency with no obvious intelligence role can drift into monitoring.

China & Technology

Alibaba’s Joe Tsai champions open-source AI at Wuzhen Summit amid US pushback — Tech - South China Morning Post
Why it matters: At the Wuzhen summit Alibaba's chairman Joe Tsai called open source the only viable path to a sustainable AI industry, while Premier Li Qiang spoke of inclusive balance and open dialogue.
SCMP places the remarks at an event backed by the Cyberspace Administration of China and amid US pushback, and notes that demand is running up against shortages of compute. Open weights are China's main route of influence on global AI, and that puts Europe's open-model strategy, including its own builders, in Beijing's frame.

Why Chinese AI stars like Z.ai, MiniMax struggle to match Anthropic’s profit margin — Tech - South China Morning Post
Why it matters: Anthropic's IPO filing shows a gross margin of 85.4% in the first half, against 26.4% for Z.ai and 17.9% for MiniMax, SCMP reports.
First-half revenue was $16.3bn at Anthropic, against $141m and $116.6m at the two Hong Kong-listed Chinese firms, a gap HSBC analysts also trace to how each monetises compute. Margin decides how long a lab can keep offering open models at low prices, and so how long European buyers can count on them.

Can Washington Afford to Deter Chinese Cyber Activity? — Foreign Policy
Why it matters: A Foreign Policy analysis argues that takedowns of Chinese hacking infrastructure cannot reverse the strategic gains of years of intrusion.
It cites the US actions in August and October against state-sponsored groups, one of which had been disrupted before, in 2024. This is an argument and not a report, but the same question of what disruption achieves applies to Europe's hybrid-threat toolbox.

Huawei Cloud to Retire openPangu-2.0 Models From MaaS, Recommends DeepSeek-V4.1-Flash and GLM-5.3 — Pandaily - China Tech News, AI & Electric Vehicle Insights
Why it matters: Huawei Cloud will stop selling its openPangu-2.0 models on 6 November and take them offline on 30 November, recommending DeepSeek and GLM models instead, Pandaily reports from a retirement notice.
The national champion pointing customers to rival Chinese models says something about where China's model race stands, though the notice gives no reason in what was readable. Excerpt-based.

Czech MEP Markéta Gregorová stopped at Chinese border in ‘pseudo-scare tactics’ — EUobserver
Why it matters: Czech MEP Markéta Gregorová says she was detained for 1.5 hours in Beijing, in what she calls pseudo-scare tactics linked to the arrest of a Chinese national accused of spying in the Czech Republic.
The account is hers, and only the opening was readable. Excerpt-based.

Threat Intelligence (CTI)

[P2] Defrost and Disrupt | An Assessment of Europe’s Refrigeration Attacks — SentinelLABS | The Latest Threat Research and Intelligence
Why it matters: SentinelLABS separates incidents from claims in the fridge attacks: Russian-aligned groups are credible suspects, but the evidence does not yet establish who did it, or that it is one campaign.
The chronology runs from Danfoss's 2022 cases and the 2024 Los Angeles incident through the US commissaries, about 700 French stores in October, and six countries on 2 and 3 November. It names CARR, NoName057(16) and Z-Pentest as lines of inquiry and warns that copied techniques may look like one campaign. Further incidents are likely wherever the same access conditions persist.
severity high · exploited in the wild · EU: NIS2, CRA

[P3] UK school estate hit by 3AM ransomware in suspected AI-assisted attack — BleepingComputer
Why it matters: A 3AM ransomware affiliate encrypted about 37 machines across a UK school estate, and Bitdefender suspects AI-generated commands in an automated loop, but says it cannot document the model.
Bitdefender infers the loop from repeated, slightly varied commands every 40 to 100 seconds between 10 and 19 September. It could not access the attacker's machine, and says a person may have been copying between the implant and a model. Hackread's "37 UK school systems" reads machines as schools; Bitdefender's figure is machines.
severity medium · exploited in the wild · EU: NIS2, GDPR · actor 3AM affiliate (70%)

[P2] Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware — The Hacker News
Why it matters: ESET says Russia-aligned Gorbag has targeted Ukrainian law enforcement, justice, frontline administrations and defence since February 2025, using simple stealers.
Its tool GIFTEDCROOK steals browser data, VPN configurations and documents, and Trend Micro has linked the group to a WinRAR flaw (CVE-2025-8088), in CISA's KEV catalogue since August 2025 with a very high EPSS. The cluster overlaps with CERT-UA's UAC-0226. The Russia alignment is ESET's assessment.
severity high · exploited in the wild · EPSS 0.94008 · CVE-2025-8088 · EU: NIS2 · actor Gorbag (Russia-aligned, per ESET) (65%)

[P2] Chainstack Reports Production Systems Breach Exposing Customer Data and Password Hashes — The Hacker News
Why it matters: Blockchain infrastructure provider Chainstack says an attacker reached production through a third-party component, accessing customer data, password hashes and systems holding node credentials.
Access began on 26 October in a development environment and was cut on 31 October. The Hacker News says the company assesses it as part of a large AI-powered campaign that came to light last week; that link is reported and not shown here.
severity high · exploited in the wild · EU: GDPR, DORA

Health & Cyber

[P2] Marathon Health Data Breach Reportedly Affects 5.7 Million Individuals — The HIPAA Journal
Why it matters: Marathon Health, which runs employer clinics in 41 US states, may have exposed data on almost 5.7 million people, according to figures reported to the Texas attorney general.
The total comes via a law firm reading the Texas filing, and is not yet on the federal HHS portal; the Massachusetts and Vermont figures are in the thousands. Suspicious activity on an employee account was found on 24 August. No disruption to care was reported in what was read. If confirmed, it would be this year's fourth-largest HIPAA breach.
severity high · EU: GDPR Art. 9, NIS2

Athenahealth's Claude AI Connection Raises HIPAA Questions — HealthcareInfoSecurity.com RSS Syndication
Why it matters: Athenahealth now lets patients connect their medical records to Claude, and says HIPAA does not apply because the transfer is patient-directed; lawyers say the answer can change with the arrangement.
The AthenaPatient connector uses the Model Context Protocol and is initially for US Claude Pro and Max subscribers; Epic records reached ChatGPT in September. The company stresses patient consent and revocable permissions, while attorneys point to the FTC rule and state laws such as Texas's. In the EU the same flow would meet GDPR Art. 9 and the EHDS, and medical advice from the assistant would raise AI Act and MDR questions.

AI vendors, health systems join physicians in liability for clinical AI: AMA — MedTech Dive - Latest News
Why it matters: The American Medical Association says clinical AI developers and deploying health systems share responsibility with physicians, who should not be the safety net for failures they cannot see.
The issue brief assigns design safety to developers, tool selection, training and monitoring to deployers, and clinical judgment to physicians. It is an advocacy position, not law. Europe has addressed this through the AI Act's provider and deployer duties, and the revised Product Liability Directive.

[P3] AU: Criminal investigation after NSW Health hit by cyber breach — DataBreaches.Net
Why it matters: New South Wales has declared a major cyber incident at NSW Health and police are investigating; officials say an isolated server was hit and no patient data is affected or at risk.
Cyber Security NSW gave no further detail because of the criminal investigation. No care disruption was reported in the short statement read.
severity medium · EU: NIS2

Defence & National Security

Ukraine’s drone strikes spur hasty Russian plans for underground data centers — Ars Technica - All content
Why it matters: Ukrainian strikes have damaged data centres of Yandex, Sberbank, VKontakte and Russia's finance ministry, and Russian firms are now looking at moving facilities underground, Ars Technica reports.
Rostelecom has raised the idea with miner Norilsk, according to Vedomosti, and the Kremlin requires owners to reserve capacity for emergency state needs. Russia has been striking Ukrainian data centres since late September. Compute is now a target in war, and European planning for AI gigafactories has yet to address it.

Wingman out, Ravenstorm in: Airbus changes tact to meet Germany’s accelerated operations timeline — Breaking Defense
Why it matters: Airbus has scrapped its Wingman drone concept for the U760 Ravenstorm collaborative combat aircraft after a customer asked to bring service entry forward.
Airbus did not name the customer, but said in 2024 that Wingman was designed for the German Air Force, Breaking Defense notes. It shows how far procurement timelines in Europe's air forces have moved, and leaves open how the choice will fit with FCAS.

French defense minister kicks off ‘pact’ with industry in rush to field naval drones — Defense News
Why it matters: France's armed forces minister has launched a pact with industry to build a national ecosystem of naval drone makers, including for seabed work.
Catherine Vautrin announced it at Euronaval, following the model used for aerial drones. Mastering the seabed bears directly on the protection of undersea cables and pipelines.

On ‘NATO’s lake,’ Nordic allies worry about escalation with Russia — Defense News
Why it matters: Nordic allies are struggling to counter Russian hybrid activity in the Baltic without escalating, Defense News reports from interviews including the Danish army chief.
Maj. Gen. Peter Boysen calls it a very difficult question, and Dutch military intelligence has warned of a real risk of unintended escalation. Undersea cables and pipelines are part of what is at stake, which ties this to Europe's connectivity dependence.

Digital Sovereignty & Identity

Fourthline and Veridas complete merger to create a European leader in Bank-grade digital identity — Identity Week
Why it matters: Fourthline and Veridas have closed their merger with up to €65m in funding, aiming at a European bank-grade identity platform.
The combined group projects more than €50m of revenue in 2026 and says it targets €85m of recurring revenue by 2029, company figures reported by Identity Week. It presents itself as sovereign AI, which it does not define. Consolidation matters for who supplies identity verification to European banks as the EUDI wallet arrives.

SEPA: Europe’s unsung hero — ECB - European Central Bank
Why it matters: An ECB blog argues that many households in south-eastern Europe still use costly remittance channels because they have not heard of SEPA.
Drawing on the OeNB Euro Survey across six countries, the authors say SEPA's silent success creates a paradox: its users do not notice it, and those who would benefit most do not know it. It is a reminder, in the digital euro debate, that Europe already has a public payment rail that people do not see.

Quantum & Cryptography

Quint Computing raises €9.1M to scale quantum computing technology — Tech.eu
Why it matters: German start-up Quint Computing has raised €9.1m and won a €2.2m EIC Pathfinder grant for a superconducting chip designed to cut error rates.
Vsquared leads the round, with Quantonation among the investors and IQM founder Mikko Möttönen as an industry backer. The claim on its architecture is the company's. It comes out of Erlangen-Nürnberg and Munich Quantum Valley, part of Europe's bid to keep a position in quantum hardware.

Cybersecurity & Threats

[P1] Binance CEO says ‘months-long campaign’ led to $6.3 billion theft as N. Korea denies responsibility — The Record from Recorded Future News
Why it matters: Binance says North Korean hackers needed months, fake job interviews and a compromised internal AI tool to steal about $6.3bn; the company's post-mortem traces the attack to June.
An engineer downloaded a trojanised Homebrew installer for an AI tool in June, a second was given a malicious repository as an interview assignment in September, and in October the attackers abused an internal AI tool and a deployment token to reach a wallet signing service. The Hacker News gives $6.43bn; other outlets give $6.3bn. Binance says it stopped 57 North Korean attempts this year. The account is the victim's own.
severity critical · exploited in the wild · EU: MiCA, DORA · actor North Korea (per Binance; Pyongyang denies, per The Record's headline) (60%)

[P1] British businesses caught in Europe-wide supermarket fridge attacks — The Record from Recorded Future News
Why it matters: Three British meat suppliers were hit through Copeland XWEB controllers in the fridge attacks, and a British wholesaler reports the same, widening the wave beyond the EU supermarkets.
The Association of Independent Meat Suppliers calls its members collateral because they ran the same software, and says none lost meat. Copeland confirms certain XWEB products are affected and has re-sent patching guidance. Nobody has claimed it; Belgium's cyber agency says the authors may never be identified.
severity high · exploited in the wild · EU: NIS2, CRA

[P2] cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes — The Hacker News
Why it matters: An attacker used stolen credentials to push a backdoor through the update system of the cPGuard Linux security tool on 2 November and has taken data from some servers.
The malicious script went out in cPGuard 5.88.12 to 5.88.19 and collected password hashes and sensitive files; maker OPSSHIELD says it detected this within 12 hours and fixed it from 5.88.25, but has not said how many servers ran it. No CVE; a compromise of the vendor, not a flaw in the product.
severity high · exploited in the wild · EU: NIS2, CRA

[P2] UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame? — Ars Technica - All content
Why it matters: A new bootkit, BlackX, bypassed Secure Boot on fully patched Windows machines by exploiting a 2022 flaw, because the fixes need manual steps that Kaspersky says administrators rarely find.
Baton Drop (CVE-2022-21894) was fixed in 2022, but the revocation that closes it stays optional, since enforcing it could make devices unbootable. Kaspersky, which found the infections, says the instructions are buried; Ars Technica says Microsoft's current guidance does not warn that patches alone leave systems open. CVSS and EPSS were not checked for this older flaw.
severity high · exploited in the wild · CVE-2022-21894 · EU: NIS2

[P2] Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access — The Hacker News
Why it matters: Two Barracuda flaws can be chained into root access on Email Security Gateway and other products by an attacker who can reach the administrative interface.
CVE-2026-116606 (CVSS 9.3, Email Security Gateway) bypasses authorisation before login, and CVE-2026-111560 (CVSS 8.6) allows command injection. Neither is in CISA's KEV catalogue as of 3 November, and no exploitation was reported in what was read.
severity high (CVSS 9.3) · EPSS 0.00728 · CVE-2026-116606 · EU: NIS2, CRA

[P3] WorkOS says attacker used ARTEX AI to breach internal sales app — BleepingComputer
Why it matters: WorkOS, an authentication supplier to OpenAI, Anthropic and others, says an attacker using the ARTEX AI framework reached an internal sales app, exposing customer contacts and call summaries.
The company says no app data or production services were touched. Its founder says user agents point to ARTEX AI, a Chinese-developed penetration-testing suite with public forks, which CrowdStrike has linked to a group called Vapor Panda. Attribution to a person or group has not been made here.
severity medium · exploited in the wild · EU: GDPR, NIS2

The daily brief, every morning on Telegram →

Top Stories