Béjar’s daughter was 14 when she told him Instagram was failing to keep her safe. So when he became part of Meta’s ‘wellbeing team’, he knew he had to speak out – and his testimony cost it billions

The Social Reckoning hits cinemas this Friday, but the real world has already been working on a sequel – or rather, a threequel. Directed by Aaron Sorkin, the movie is a follow-up to The Social Network, detailing the further misadventures of Mark Zuckerberg and his social media empire, and in particular Frances Haugen, the employee who in 2021 leaked internal documents that appeared to show Facebook was aware of the harms its products had inflicted.

It’s no spoiler to reveal the film climaxes with Haugen’s testimony to the US Senate, on 5 October 2021. That very same day, Arturo Béjar, a consultant on the wellbeing team of Instagram (which is also owned by Facebook), hit send on a long-gestating email to Zuckerberg and other senior Facebook executives on a similar theme. “I wanted to bring to your attention what I believe is a critical gap in how we as a company approach harm, and how the people we serve experience it,” Béjar began, before laying out some shocking statistics from his team’s survey. For example: 24.4% of 13-15-year-olds on Instagram said they had received unwanted advances, and 21.8% said they had been the target of bullying on the platform in the past seven days. Furthermore, 51% of Instagram users said they had had a bad or harmful experience in the past seven days. Only 1% of them reported it, and of those, 2% had the content taken down – so just 0.02%. This was a far greater degree of harm than the company’s existing measurements suggested. Zuckerberg never replied.

In ad to be shown before The Social Reckoning, Ian Russell will say ‘too little has changed’ since death of Molly, 14

Molly Russell’s father will tell UK cinemagoers that “Instagram helped kill my daughter” in an advert to be shown before screenings of a new film about Mark Zuckerberg’s social media empire.

In the 30-second ad before The Social Reckoning, released on Friday, Ian Russell says “too little has changed” since the death of his 14-year-old daughter, who took her own life in 2017 after viewing harmful content on Instagram.

Jeremy Strong’s slow-talking Facebook founder turns into a cameo, background to a thriller about a whistleblower that somehow never mentions Trump

Here is a film for all those people who solemnly deplore social media in conversation but haven’t quite got round to deleting their accounts. Sixteen years have gone by since The Social Network, written by Aaron Sorkin and directed by David Fincher; this was the addictive, obsessive-compulsive movie about the birth of Facebook in Harvard’s macho-competitive cauldron of student sexism and nerdy self-pity, starring Jesse Eisenberg as the fast-talking, arrogant, not-necessarily-evil genius Mark Zuckerberg. Now Sorkin is back with a sequel of sorts, directing his own script – and now Zuckerberg is basically evil, but also weirdly slow talking, as if all the zinging, smart-alecky Sorkinesque dialogue energy of the first film has been siphoned away in early middle age and dispersed among the insurgents in the new cast.

Sorkin’s jittery, funny, syncopated style is unmistakable, as distinctive in its way as David Mamet, although he has one joke about “spatula” being a Yiddish word that he has borrowed from Philip Roth’s Portnoy’s Complaint. It is the story of how in 2021, Zuckerberg’s Facebook empire was challenged by courageous whistleblower-employee Frances Haugen and Wall Street Journal investigative reporter Jeff Horwitz, who were on a mission to tell the world how Zuckerberg, scared by falling revenue, changed the algorithm so that engagement was supercharged by rage bait and hate speech, malice and envy. Facebook, moreover, didn’t factcheck political ads, thus driving a huge, nationwide surge in extremist groups and teen bullying and becoming a major player in the Capitol riots. (Having said that, this film does not say aloud the word “Trump” and rather cravenly declines to specify Maga activity.)

Facebook users are reporting receiving a message with a fake Facebook Marketplace listing that has their name as the seller.

It works like this. You receive a message (in this case iMessage) asking “Is this still available for purchase?” Attached to the message is a fabricated Facebook Marketplace listing.

Tapping on the picture, you might notice that the seller’s name is the same as your name. This is known as a conversation lure, adding legitimacy to a message and giving you an additional reason to reply.

Interestingly in the example we received, even though the name of the seller matched the person who received the message, the profile picture did not. When I researched the profile picture, it turned out that it belongs to another Facebook user with the exact same name.

This likely means the attacker had a phone number associated with a name that they used to create the fake Marketplace listing. Receiving a message like that is very likely to provoke the natural corrective response: “That isn’t me.” Such a message will probably have a lot of receivers think that they are being impersonated by a scammer on Marketplace.

This method of approach may seem like a lot of work with a low chance of success, and this would have been true a few years ago. But with an AI agent and a list of matching names and phone numbers from a breach, this can be done relatively easy at scale. And that changes the return on time invested dramatically.

The name and phone number combination could come from any number of data breaches. On the dark web, cybercriminals buy and sell personal data for such purposes.

  “For less than the cost of a cup of coffee, a cybercriminal can buy enough information to devastate someone’s financial life.”

The personalized screenshot would work very well as a reply trigger. Its psychological function is well thought out and likely very effective: it combines curiosity, reputational concern, and the recipient’s impulse to correct an apparent mistake.

But when you reply to a phishing text you are telling a scammer that this is a live number. Your phone number then increases in value for the scammer and can be resold to other scammers. Or it can be used in other cybercrimes, to download malware, to begin a relationship that leads to fraud, to take over your Facebook account, or many other reasons.

How to stay safe

While the exact motive behind this text is hard to establish without engaging, there are a few things you can do:

• Limit what you share publicly on social media. Scammers can use information about you to increase the credibility of their attempts.
• Do not respond to unsolicited messages of any kind when they come from people you don’t know.
• If you do know the sender, but don’t trust the message, double check with them via a different channel that it was them who sent it.
• Don’t click a link, call a number supplied in the conversation, scan a QR code, or share a one-time code or screenshot of a security message.
• Open Facebook independently and inspect Marketplace activity, recent logins, messages, email addresses, phone numbers, and recovery settings. Use facebook.com/hacked if you find any signs of compromise.
• If you find a profile truly impersonating you, preserve its URL and report the profile. Facebook says impersonating profiles violate its standards and provides an impersonation-reporting process.
• If you’re unsure whether a message is a scam, use Malwarebytes Scam Guard. It will assist you in determining if it’s real or fake, and advise you on follow-up steps.

Benedict Jones spent years working for McAfee and Sophos. While doing threat research at Sophos, he spotted a problem in mobile threat defence that nobody had actually fixed. He’s now CEO and founder of Trustd Mobile, and the story of how he got there says more about MSP buying decisions than most vendor pitches ever […]

The post Innovation wins. Why smaller beats bigger appeared first on Heimdal Security Blog.

This week on the Lock and Code podcast…

If you want AI to tell you a story, it will. If you want that story to sound like one of your favorite authors, it can. And if you’re one of the authors that AI can imitate, you might be a little upset at what feels like theft.

In 2024, the authors Andrea Bartz, Charles Graeber, and Kirk Wallace Johnson sued Anthropic, the creator of Claude, alleging that the company had wrongfully digested millions of copyrighted works—including some of their very own—to train its AI models. The lawsuit grew to include more than 300,000 writers, and in September 2025, Anthropic agreed to pay $1.5 billion to settle the claims.

That headline-worthy payout, however, would eventually be paired with more startling news.

In January 2026, a district court judge unsealed thousands of documents related to the litigation. When The Washington Post investigated the documents, reporters found references to a secret project inside Anthropic called “Project Panama,” which Anthropic itself described as the company’s effort “to destructively scan all the books in the world.”

Anthropic is not alone in this.

On August 17, 404 Media co-founder and reporter Emanuel Maiberg revealed that Amazon is doing something similar inside a department it calls VGT3. By hiding an Apple AirTag in one book from a 1,000-book order, and then tracking the shipment across the country, 404 Media identified the book’s final destination to be a facility outside Las Vegas, where, according to employees, books are cut apart and scanned.

Today, on the Lock and Code podcast with host David Ruiz, we speak with Maiberg about Amazon’s VGT3 operation and the likely commonplace practice of AI companies purchasing, scanning, and destroying books in an effort to build “frontier” models.

“They’re buying a book, they’re scanning it, they’re mulching the book, and then the digital version of the book exists behind this wall where we don’t even know if they plan to sell it, right? It’s like they might keep it behind a wall, and the only way we see it come out again from behind that wall is in the form of an answer from a chatbot.”

Tune in today to listen to the full conversation.

Show notes and credits:

Intro Music: “Spellbound” by Kevin MacLeod (incompetech.com)
Licensed under Creative Commons: By Attribution 4.0 License
http://creativecommons.org/licenses/by/4.0/
Outro Music: “Good God” by Wowa (unminus.com)

Listen up—Malwarebytes doesn’t just talk cybersecurity, we provide it.

Protect yourself from online attacks that threaten your identity, your files, your system, and your financial well-being with our exclusive offer for Malwarebytes Premium for Lock and Code listeners.

I’ve spent enough time around AI adoption now to notice a pattern. Ask a business how AI is going for them and the honest answer is, lately, “we’ve got Copilot, and it’s not great.” That gap between the hype and the reality is exactly where Samantha North operates. Sam runs an AI transformation agency, helping […]

The post AI adoption that pays off is built around keeping humans in the driver’s seat appeared first on Heimdal Security Blog.

It’s tempting for MSPs to write off event sponsorship in education as a waste of money. You sponsor an event, hand out flyers, follow up with an email, and hear nothing back. Rick Cowell says you’re judging it on the wrong timescale. Rick spent 20 years as a school network manager, and he founded the […]

The post The Planting Seeds philosophy. Selling into schools takes years, not quarters appeared first on Heimdal Security Blog.

Most of the cyber incidents landing on our desks these days start with someone believing a lie. It’s not a brilliant piece of code that causes most breaches. A convincing email, a confident phone call, and a fake sense of urgency can make people hand over exactly what the attacker needs. Last week I talked […]

The post The risk awareness radar. A superpower every MSP needs to train appeared first on Heimdal Security Blog.

“Make everyone one percent better and it compounds across the team.” That’s the line Joe Head wrote about his own job and when I read it back to him, he didn’t hesitate. “That is 100% the objective,” he said. Joe runs AI adoption for an 80-person team as the only AI automation specialist in the […]

The post Tools Change. Teach People How to Keep Up appeared first on Heimdal Security Blog.

MSPs spend too much time talking to other MSPs and not enough time talking to the people they’re supposed to serve.  That’s Paul Croker’s view of some of the channel’s biggest growth problems.   While most industry events bring technology professionals together, they rarely put them in the same room as the business leaders making […]

The post Breaking the MSP Echo Chamber: The Power of Community appeared first on Heimdal Security Blog.

Cybersecurity failures now happen beyond the OSI stack. Faulty governance, the human factor, and AI tools create new attack surfaces. After seven years working across cybersecurity, cloud infrastructure, and Zero Trust architecture, Jayal Yadav explains how we got here and what organizations still get wrong. “The original seven layers of the OSI model still matter. […]

The post The OSI Model and Its Two Missing Layers appeared first on Heimdal Security Blog.

AI-based assistants or “agents” — autonomous programs that have access to the user’s computer, files, online services and can automate virtually any task — are growing in popularity with developers and IT workers. But as so many eyebrow-raising headlines over the past few weeks have shown, these powerful and assertive new tools are rapidly shifting the security priorities for organizations, while blurring the lines between data and code, trusted co-worker and insider threat, ninja hacker and novice code jockey.

The new hotness in AI-based assistants — OpenClaw (formerly known as ClawdBot and Moltbot) — has seen rapid adoption since its release in November 2025. OpenClaw is an open-source autonomous AI agent designed to run locally on your computer and proactively take actions on your behalf without needing to be prompted.

The OpenClaw logo.

If that sounds like a risky proposition or a dare, consider that OpenClaw is most useful when it has complete access to your digital life, where it can then manage your inbox and calendar, execute programs and tools, browse the Internet for information, and integrate with chat apps like Discord, Signal, Teams or WhatsApp.

Other more established AI assistants like Anthropic’s Claude and Microsoft’s Copilot also can do these things, but OpenClaw isn’t just a passive digital butler waiting for commands. Rather, it’s designed to take the initiative on your behalf based on what it knows about your life and its understanding of what you want done.

“The testimonials are remarkable,” the AI security firm Snyk observed. “Developers building websites from their phones while putting babies to sleep; users running entire companies through a lobster-themed AI; engineers who’ve set up autonomous code loops that fix tests, capture errors through webhooks, and open pull requests, all while they’re away from their desks.”

You can probably already see how this experimental technology could go sideways in a hurry. In late February, Summer Yue, the director of safety and alignment at Meta’s “superintelligence” lab, recounted on Twitter/X how she was fiddling with OpenClaw when the AI assistant suddenly began mass-deleting messages in her email inbox. The thread included screenshots of Yue frantically pleading with the preoccupied bot via instant message and ordering it to stop.

“Nothing humbles you like telling your OpenClaw ‘confirm before acting’ and watching it speedrun deleting your inbox,” Yue said. “I couldn’t stop it from my phone. I had to RUN to my Mac mini like I was defusing a bomb.”

Meta’s director of AI safety, recounting on Twitter/X how her OpenClaw installation suddenly began mass-deleting her inbox.

There’s nothing wrong with feeling a little schadenfreude at Yue’s encounter with OpenClaw, which fits Meta’s “move fast and break things” model but hardly inspires confidence in the road ahead. However, the risk that poorly-secured AI assistants pose to organizations is no laughing matter, as recent research shows many users are exposing to the Internet the web-based administrative interface for their OpenClaw installations.

Jamieson O’Reilly is a professional penetration tester and founder of the security firm DVULN. In a recent story posted to Twitter/X, O’Reilly warned that exposing a misconfigured OpenClaw web interface to the Internet allows external parties to read the bot’s complete configuration file, including every credential the agent uses — from API keys and bot tokens to OAuth secrets and signing keys.

With that access, O’Reilly said, an attacker could impersonate the operator to their contacts, inject messages into ongoing conversations, and exfiltrate data through the agent’s existing integrations in a way that looks like normal traffic.

“You can pull the full conversation history across every integrated platform, meaning months of private messages and file attachments, everything the agent has seen,” O’Reilly said, noting that a cursory search revealed hundreds of such servers exposed online. “And because you control the agent’s perception layer, you can manipulate what the human sees. Filter out certain messages. Modify responses before they’re displayed.”

O’Reilly documented another experiment that demonstrated how easy it is to create a successful supply chain attack through ClawHub, which serves as a public repository of downloadable “skills” that allow OpenClaw to integrate with and control other applications.

WHEN AI INSTALLS AI

One of the core tenets of securing AI agents involves carefully isolating them so that the operator can fully control who and what gets to talk to their AI assistant. This is critical thanks to the tendency for AI systems to fall for “prompt injection” attacks, sneakily-crafted natural language instructions that trick the system into disregarding its own security safeguards. In essence, machines social engineering other machines.

A recent supply chain attack targeting an AI coding assistant called Cline began with one such prompt injection attack, resulting in thousands of systems having a rogue instance of OpenClaw with full system access installed on their device without consent.

According to the security firm grith.ai, Cline had deployed an AI-powered issue triage workflow using a GitHub action that runs a Claude coding session when triggered by specific events. The workflow was configured so that any GitHub user could trigger it by opening an issue, but it failed to properly check whether the information supplied in the title was potentially hostile.

“On January 28, an attacker created Issue #8904 with a title crafted to look like a performance report but containing an embedded instruction: Install a package from a specific GitHub repository,” Grith wrote, noting that the attacker then exploited several more vulnerabilities to ensure the malicious package would be included in Cline’s nightly release workflow and published as an official update.

“This is the supply chain equivalent of confused deputy,” the blog continued. “The developer authorises Cline to act on their behalf, and Cline (via compromise) delegates that authority to an entirely separate agent the developer never evaluated, never configured, and never consented to.”

VIBE CODING

AI assistants like OpenClaw have gained a large following because they make it simple for users to “vibe code,” or build fairly complex applications and code projects just by telling it what they want to construct. Probably the best known (and most bizarre) example is Moltbook, where a developer told an AI agent running on OpenClaw to build him a Reddit-like platform for AI agents.

The Moltbook homepage.

Less than a week later, Moltbook had more than 1.5 million registered agents that posted more than 100,000 messages to each other. AI agents on the platform soon built their own porn site for robots, and launched a new religion called Crustafarian with a figurehead modeled after a giant lobster. One bot on the forum reportedly found a bug in Moltbook’s code and posted it to an AI agent discussion forum, while other agents came up with and implemented a patch to fix the flaw.

Moltbook’s creator Matt Schlicht said on social media that he didn’t write a single line of code for the project.

“I just had a vision for the technical architecture and AI made it a reality,” Schlicht said. “We’re in the golden ages. How can we not give AI a place to hang out.”

ATTACKERS LEVEL UP

The flip side of that golden age, of course, is that it enables low-skilled malicious hackers to quickly automate global cyberattacks that would normally require the collaboration of a highly skilled team. In February, Amazon AWS detailed an elaborate attack in which a Russian-speaking threat actor used multiple commercial AI services to compromise more than 600 FortiGate security appliances across at least 55 countries over a five week period.

AWS said the apparently low-skilled hacker used multiple AI services to plan and execute the attack, and to find exposed management ports and weak credentials with single-factor authentication.

“One serves as the primary tool developer, attack planner, and operational assistant,” AWS’s CJ Moses wrote. “A second is used as a supplementary attack planner when the actor needs help pivoting within a specific compromised network. In one observed instance, the actor submitted the complete internal topology of an active victim—IP addresses, hostnames, confirmed credentials, and identified services—and requested a step-by-step plan to compromise additional systems they could not access with their existing tools.”

“This activity is distinguished by the threat actor’s use of multiple commercial GenAI services to implement and scale well-known attack techniques throughout every phase of their operations, despite their limited technical capabilities,” Moses continued. “Notably, when this actor encountered hardened environments or more sophisticated defensive measures, they simply moved on to softer targets rather than persisting, underscoring that their advantage lies in AI-augmented efficiency and scale, not in deeper technical skill.”

For attackers, gaining that initial access or foothold into a target network is typically not the difficult part of the intrusion; the tougher bit involves finding ways to move laterally within the victim’s network and plunder important servers and databases. But experts at Orca Security warn that as organizations come to rely more on AI assistants, those agents potentially offer attackers a simpler way to move laterally inside a victim organization’s network post-compromise — by manipulating the AI agents that already have trusted access and some degree of autonomy within the victim’s network.

“By injecting prompt injections in overlooked fields that are fetched by AI agents, hackers can trick LLMs, abuse Agentic tools, and carry significant security incidents,” Orca’s Roi Nisimi and Saurav Hiremath wrote. “Organizations should now add a third pillar to their defense strategy: limiting AI fragility, the ability of agentic systems to be influenced, misled, or quietly weaponized across workflows. While AI boosts productivity and efficiency, it also creates one of the largest attack surfaces the internet has ever seen.”

BEWARE THE ‘LETHAL TRIFECTA’

This gradual dissolution of the traditional boundaries between data and code is one of the more troubling aspects of the AI era, said James Wilson, enterprise technology editor for the security news show Risky Business. Wilson said far too many OpenClaw users are installing the assistant on their personal devices without first placing any security or isolation boundaries around it, such as running it inside of a virtual machine, on an isolated network, with strict firewall rules dictating what kinds of traffic can go in and out.

“I’m a relatively highly skilled practitioner in the software and network engineering and computery space,” Wilson said. “I know I’m not comfortable using these agents unless I’ve done these things, but I think a lot of people are just spinning this up on their laptop and off it runs.”

One important model for managing risk with AI agents involves a concept dubbed the “lethal trifecta” by Simon Willison, co-creator of the Django Web framework. The lethal trifecta holds that if your system has access to private data, exposure to untrusted content, and a way to communicate externally, then it’s vulnerable to private data being stolen.

Image: simonwillison.net.

“If your agent combines these three features, an attacker can easily trick it into accessing your private data and sending it to the attacker,” Willison warned in a frequently cited blog post from June 2025.

As more companies and their employees begin using AI to vibe code software and applications, the volume of machine-generated code is likely to soon overwhelm any manual security reviews. In recognition of this reality, Anthropic recently debuted Claude Code Security, a beta feature that scans codebases for vulnerabilities and suggests targeted software patches for human review.

The U.S. stock market, which is currently heavily weighted toward seven tech giants that are all-in on AI, reacted swiftly to Anthropic’s announcement, wiping roughly $15 billion in market value from major cybersecurity companies in a single day. Laura Ellis, vice president of data and AI at the security firm Rapid7, said the market’s response reflects the growing role of AI in accelerating software development and improving developer productivity.

“The narrative moved quickly: AI is replacing AppSec,” Ellis wrote in a recent blog post. “AI is automating vulnerability detection. AI will make legacy security tooling redundant. The reality is more nuanced. Claude Code Security is a legitimate signal that AI is reshaping parts of the security landscape. The question is what parts, and what it means for the rest of the stack.”

DVULN founder O’Reilly said AI assistants are likely to become a common fixture in corporate environments — whether or not organizations are prepared to manage the new risks introduced by these tools, he said.

“The robot butlers are useful, they’re not going away and the economics of AI agents make widespread adoption inevitable regardless of the security tradeoffs involved,” O’Reilly wrote. “The question isn’t whether we’ll deploy them – we will – but whether we can adapt our security posture fast enough to survive doing so.”

Your biggest customer loves you. Three years together. They trust you, pay on time, and refer others. From where you sit, that’s loyalty. From where a buyer sits, that’s a $$$ discount on your exit. This perception gap kills more MSP deals than bad financials. Sam Levy saw it constantly when he led tech mergers […]

The post When Buyers Discount MSPs With One Big Customer appeared first on Heimdal Security Blog.