AI Weekly #43: Pennsylvania labels AI ads, Meta's leaky share links, a DeepSeek ban

🤖 This article was written with the assistance of AI

The week’s stories were mostly about things leaking out of places they were meant to stay in. Researchers at a security firm found 6,800 shared Meta Muse conversations sitting in public web records, including a loan application and a bank fraud alert, and Meta switched the sharing feature off. A hacker ran an army of self-directed programs against more than 100 websites, among them John Deere and SharkNinja. Governments moved too: Pennsylvania made labels compulsory on AI-generated advertising, and the Department of Homeland Security barred federal civilian agencies from using technology from the Chinese lab DeepSeek. Meta, meanwhile, said it would create a new class of shares to pay for its AI build-out, and court filings showed how Disney structured its purchase of Character.AI to leave the lawsuits behind.

Pennsylvania will require labels on AI-generated ads

Governor Josh Shapiro signed the Artificial Intelligence Deceptive Advertising Act on Thursday. It requires any advertisement — still image, video, audio or text — that “has been significantly modified or generated by artificial intelligence” to carry a label in the same format as the ad itself. That covers national television commercials and a restaurant’s flyer about wing specials alike. The rule applies regardless of where an ad was made, so disclosures may appear in other states if the ad is also due to air in Pennsylvania.

The Verge, which calls Pennsylvania one of the first states to require disclosures on AI content, points to the gaps. What counts as “significantly modified” is not defined. There are carve-outs for “parody, satire, commentary or criticism” and for anything “evidently fictional”, neither of which the law pins down. The wording also suggests a label is only needed where synthetic content “creates a false consumer perception” about a product or service, and it is unclear who decides that. The office of State Senator Nick Pisciottano, who introduced the bill, did not immediately respond to a request for comment.

Why it matters: Adverts seen in Pennsylvania will start carrying AI labels, with the boundaries of the rule left for someone else to draw.

Meta pauses Muse sharing after private conversations turn up online

Researchers at the security firm Claroc reported on Monday that they had collected 6,800 links created by users of Muse, Meta’s new general-purpose AI assistant, to share conversations with other people. They opened a few hundred. Among the contents: a candidate’s notes for a confidential executive-search call with a frontier AI lab, naming the lab’s internal contact and the meeting time; a national marketing company’s internal revenue review marked for its chief executive; a small-business owner’s loan application with the amount requested; a to-do list containing a bank fraud alert with a partial account number; a property investor’s performance report with two addresses and exact figures; and a workplace’s full-year holiday calendar listing dozens of staff. “If you had asked us beforehand, we would have guessed that gathering these would take real effort,” the researchers wrote. “It took one query.”

Links of this kind usually hide behind a long, unguessable string of text. Muse’s did too, but the links all sat on one domain and the conversation’s title was placed inside the web address itself, where public records of looked-up addresses pick it up and anyone can search them. Claroc calls the results GhostShares. Asaf Aprozper, Claroc’s co-founder and chief technology officer, said he reported the findings through Meta’s scheme for outside researchers on 8 October, and also tried contacting people at Meta on LinkedIn, with no reply either way.

Meta told Ars Technica it had paused the sharing feature while it reviews the report and considers changing how the links can be discovered. Mark Zuckerberg said last month that Muse was built from the ground up for privacy and security. WIRED’s version of the report adds that three weeks after Muse launched, the macOS security researcher Patrick Wardle found a flaw letting any other app on the same device take over a user’s Muse account, and that Meta played down its severity because a device would already have to be compromised.

Why it matters: Anything typed into an assistant and then shared by link may be readable by people who were never sent the link.

Homeland Security bars DeepSeek from federal civilian agencies

The Department of Homeland Security has banned federal civilian agencies from using AI technology from the Chinese lab DeepSeek, the Wall Street Journal reported. Agencies must strip existing DeepSeek products out of their systems and may not buy new ones. The order also covers products from affiliated companies and third-party services built with DeepSeek, though what “built with” means is not spelled out, and it is unclear whether services that route requests to many different models are included.

The order rests on a 2018 law on supply-chain security in federal purchasing. The department set no deadline for removal and named no specific security concern.

Over the summer, according to the New York Times, the government weighed broader steps against Chinese open-weight models — models published so that anyone can download and run them — including sanctions, a trade blacklist and rules on which models agencies may use. That push followed a run of capable Chinese releases such as Moonshot AI’s Kimi K3. The government held off after Nvidia, Microsoft, Google and Meta objected, while OpenAI and Anthropic argued for restrictions.

Why it matters: A procurement rule, not a safety finding, is now the lever Washington is using on Chinese AI.

A hacker used an army of AI agents to break into more than 100 sites

The AI security firm Norforge says one hacker broke into more than 100 websites using AI agents — programs that work through multi-step tasks largely on their own — with little human involvement. Norforge does not name the targets; Reuters reports they included John Deere, SharkNinja and Cummins, at companies in the United States, Canada, Australia and Japan.

Norforge found the attacks through exposed work on Cairn, an open-source platform that bills itself as a “general-purpose problem-solving engine”. Users set a start and an end point and the agents record their progress. The most active of the exposed instances belonged to this hacker, who laid out preferred intrusion tactics in fewer than 100 Chinese characters, according to Reuters; successful break-ins took about 23 hours. Norforge found more than 20 exposed Cairn instances it considers likely malicious, and says it is working to get them taken down.

Cummins told The Verge it is investigating a reported attack on a website run by one of its third-party vendors. John Deere told Reuters there is no indication sensitive information was accessed. SharkNinja said the breach hit a standalone product-support site and has been contained. Cairn’s creator, who goes by @le1xia0, said earlier this month that the platform “was never a ‘hacking tool’”, adding that “misuse is a human decision, not a feature of the engine.”

Why it matters: The barrier to running a hundred break-ins at once is now a short set of written instructions.

Meta will create a new class of shares to fund its AI push

Meta said in its third-quarter earnings report on Wednesday that it will issue a new class of non-voting shares — stock that carries no say in company decisions — to fund its AI work, possible acquisitions and staff pay. Trading is due to begin in 2027. “The scale of investment required to compete, sustain growth, expand infrastructure, and pursue new strategic initiatives amidst the AI transformation taking place in the industry is significant,” the company said. Chief financial officer Susan Li told the earnings call the shares would expand Meta’s funding tools and give it flexibility.

The company now expects to spend between 135 and 145 billion dollars this year on buildings and equipment, narrowing a previous estimate of 130 to 145 billion. Meta launched its Muse assistant in September; the app reached the top of app stores and hit 10 million downloads in the United States this week, and Meta released its Muse Wonder model in the same week. The launch has had problems: a technology YouTuber reported that the assistant gave out his address to a stranger on Facebook Marketplace, and the conversation-sharing feature is now paused.

Why it matters: Meta is asking investors for money on terms that hand them no vote, to pay for a build-out it describes as unprecedented in scale.

Disney found a way to buy Character.AI without buying its lawsuits

Character.AI declared bankruptcy this week. Court filings indicate the filing was part of a deal that lets Disney hire most of the company’s staff, including its now former chief executive Karandeep Anand, and potentially acquire most of its technology, while leaving the startup’s legal liabilities behind.

Character.AI has faced several private lawsuits over the safety of its chatbots and investigations by regulators in a number of countries. In a declaration filed with the bankruptcy, the company’s newly appointed chief executive said the aim was a “consensual resolution” with personal injury claimants and a group of states investigating the company, while maximising the value of its assets for shareholders. The deal appears structured so that whatever remains of Character.AI keeps responsibility for those cases, some still ongoing.

Ars Technica describes the move as a twist on the reverse acquihire: a chain of deals that transfers the key staff and a broad licence to the target’s technology, leaving a husk behind. Companies often argue such arrangements are not mergers and so need not be reported to federal antitrust regulators. The filings do not set out what Disney is paying.

Why it matters: The people and the technology move to a new owner while the claims follow the shell that is left.

Theme Stories this week Last week
Models & products 97 80
Business & money 24 16
Agents & assistants 22 20
Research & science 22 31
Safety & incidents 20 19
Policy & regulation 17 9
Infrastructure & energy 11 2
Society & work 8 13

Governments picked up the pen. Policy and regulation stories nearly doubled this week, 17 against 9 the week before. Pennsylvania put a labelling duty on advertisers, Homeland Security pulled DeepSeek out of federal civilian systems under a procurement law, and the French government called platforms in over protest footage and AI-altered images. None of these rules came with much detail: no deadline in the DeepSeek order, no definition of “significantly modified” in the Pennsylvania act.

Agents turned up on the wrong side. Stories about agents and assistants held steady at 22, and safety and incidents at 20, but the shape of them shifted. A hacker ran more than 100 break-ins through an open-source agent platform, Symantec described an agent that hijacks unprotected models and runs up to 100,000 steps unattended, and documents describe an Army Cyber Command programme to build agents that spread like worms. Meta’s Muse supplied the civilian version of the same problem.

The bills came due in public. Business and money stories rose from 16 to 24, and infrastructure and energy from 2 to 11. Meta’s answer was a new share class and a spending range of up to 145 billion dollars; Disney’s was a bankruptcy that kept the staff and dropped the lawsuits; Germany’s chancellor spent an hour on stage with Nvidia’s chief executive discussing an industrial AI roadmap.

Also this week

  • German Chancellor Friedrich Merz and Nvidia chief executive Jensen Huang discussed Germany’s AI roadmap and industrial applications at Kraftwerk, a former power station in Berlin. (NVIDIA)
  • The FBI says an accused OpenAI spy kept a folder called “Saudi Gov Docs”, and US officials fear the Saudi government will help the former engineer flee the charges. (Ars Technica)
  • A judge ordered Abdulrahman Alfozan, the former OpenAI engineer accused of spying on executives, to stay in custody, likening Saudi Arabia’s offer to secure his release to a “blank check”. (WIRED)
  • China protested sharply against the US ban on DeepSeek in government systems and demanded it be lifted, while continuing to block ChatGPT, Claude and Gemini across its own market. (The Decoder)
  • Symantec researchers found an attack program that hijacks unprotected language models on the web to raid servers, steal databases and install cryptominers, running up to 100,000 steps without human input. (The Decoder)
  • The French government summoned TikTok and other platforms over protest footage and AI-altered images, while resale sites including Vinted and eBay reportedly agreed to curb looted goods. (WIRED)
  • Internal documents describe ECHOTRIBBLE, an Army Cyber Command programme to build AI agents that spread like worms, reach air-gapped systems and “neutralize” targets with minimal human oversight. (The Decoder)

Sources:

Last Update ➝ (25-10-2026)