Issue #4 · July 18, 2026 · 19 min read

Issue #4 — A firewall bug leaking logins, an AI agent that ran a ransomware attack, and Google's new AI-training default

This week: an active credential-theft campaign hitting small-business firewalls, the first ransomware attack an AI agent ran entirely on its own, and a quiet change to how much of your Google data now trains its AI — plus a 15-minute fix and the QR-code scam still flooding text messages.

Needs human review checked 2026-07-18

Six of seven sections passed with only minor issues (undefined jargon, small omissions, one title paraphrase) after one revision round. The Big One section is flagged needs-review: it still implies the ~110 million stolen-credential figure is all FortiGate device logins, when independent reporting attributes most of that figure to a separate credential-sniffing tool that captured traffic for other systems passing through compromised firewalls — a human editor should confirm or correct that figure before wide distribution.

32 sources cited across this issue

top story A Firewall Bug Called FortiBleed Is Actively Stealing Logins From Small Businesses

If your office uses a Fortinet FortiGate device — the box that handles your firewall and lets staff connect remotely — there’s something you need to check this week, even if you have no idea whether you actually run one.

Researchers have been tracking an ongoing operation, nicknamed “FortiBleed,” in which criminals have collected working login credentials from tens of thousands of FortiGate devices around the world, across 194 countries. Fortinet’s own security team confirmed the activity and traced the cause to a mix of factors: attackers reusing passwords stolen in earlier, unrelated breaches, brute-forcing devices that had weak passwords and no second login step, and an old flaw in how Fortinet stored administrator passwords. Older FortiGate software kept passwords in a weaker, more crackable format even after a security update was installed — that older, weaker version stuck around until an administrator actually logged in again after upgrading. Reporting on the campaign has put the number of harvested credentials at more than 110 million across affected devices, with security firms tracking it describing small businesses and the IT companies that manage their networks as the primary targets. That matters because if your firewall is managed by an outside IT provider, criminals getting into that provider’s systems can be a backdoor into yours too.

Here’s the part that trips people up: this isn’t just a “download the update” situation. Because the attackers may have already stolen working usernames and passwords before you patch, installing a firmware update alone doesn’t undo a theft that already happened. A stolen password stays valid — and useful to a criminal — until you actually change it. Fortinet’s own guidance says exactly this: reset every administrative and VPN password and log everyone out of active sessions, on top of updating the firmware.

What this means for you: If you don’t know what brand of firewall or VPN box sits between your office and the internet, that’s normal — most business owners don’t. But this week is a good week to find out.

Do this now:

Ask whoever manages your network (an IT company, an employee, or yourself) one direct question: “Do we use a Fortinet FortiGate firewall or VPN, and if so, is it updated and have the passwords been changed recently?”
If the answer is yes, have them update the device’s software to the latest version and reset every administrator and VPN password tied to it — not just the main login — along with any API keys (automatic-login codes that other software or services use to connect to the firewall without a person typing a password).
Ask them to turn on multi-factor authentication (a second confirmation step beyond a password) for anyone who logs into the firewall itself, if it isn’t already on.
If you use an outside IT provider, ask them the same questions about their own systems — a break-in at your provider can expose you even if your own equipment is fine.
If nobody can answer these questions confidently, that’s worth fixing on its own, regardless of Fortinet.

Sources

Flagged for human review: the FortiBleed campaign, its 194-country scope, and the remediation steps are independently verified, but the ~110 million credential figure still reads as if it’s all stolen FortiGate logins when reporting attributes most of that number to a separate, unmentioned credential-sniffing tool — needs a correction before wide distribution.

threat Fake Toll and Traffic-Ticket Texts With QR Codes Are Still Everywhere

If someone on your team gets a text saying they owe an unpaid toll or missed a traffic hearing, and it includes a QR code to “settle it now,” don’t scan it. It’s a scam. The FTC’s April 2026 alert reported a sharp jump in these reports over the prior month, and by now it’s shown up in at least eight states.

The message usually looks official: a state seal, a case or reference number, sometimes a fake court date. It warns of consequences — late fees, a suspended toll account, even a “default judgment” (a court ruling issued against you automatically because you didn’t show up or respond) — if you don’t act immediately. Then it asks you to scan a QR code to pay or “verify your information.”

QR codes make this version of the scam sneakier than a typical phishing text. With a normal link, you can often spot trouble by looking closely at the web address before tapping it. A QR code hides that address entirely until after your phone has already opened it — so the usual “check the link first” habit doesn’t work.

Warning signs:

You weren’t expecting it. Toll agencies and courts don’t typically start collection by text, and real toll notices don’t threaten immediate legal action.
It creates urgency — pay now or face fines, a suspended account, or a hearing.
It asks you to scan a code and enter payment or personal information.
The message comes from a random 10-digit number or uses a generic greeting like “Dear Customer” instead of your name. Legitimate toll and government texts typically come from a registered short code (a special, short phone number businesses use for text campaigns), not an ordinary phone number.

What to do instead:

Don’t scan the QR code or click any link in the text.
Don’t reply — not even “STOP” or “N.” Replying just confirms your number is active.
If you want to check whether you actually owe anything, open a browser and type in the toll agency’s or court’s website address yourself (or use a bookmark you’ve saved before), rather than searching for it or using anything from the text.
Forward the text to 7726 (spells “SPAM” on the keypad) — most carriers use this to flag and block scam numbers.
Delete the message.

This one’s worth a quick heads-up to your whole team, not just whoever handles the books — it lands on personal phones as easily as work ones, and anyone who scans it and enters a card number is at risk, not just the business.

Sources

Checked 2026-07-18 — the scam pattern, FTC alert timing, eight-state spread, and recommended actions all verified; the one overstatement flagged is that QR codes “hide the destination address entirely,” when most phones actually preview it and people simply don’t check.

tool risk An AI Agent Ran a Ransomware Attack — But a Human Set It Up First

Security researchers at Sysdig say they’ve documented something new: a ransomware attack where an “AI agent” — software that can plan and carry out multi-step tasks on its own, not just answer questions — independently carried out the technical break-in and attack chain, adapting to problems along the way much like a human hacker would. Researchers named the attack JadePuffer.

Early coverage described the operation as running with no human involved at all. Days later, Sysdig’s own senior director of threat research, Michael Clark, clarified that wasn’t quite right: a person set up and pointed the operation, provisioned the attack infrastructure (the command-and-control server and the staging server used to hold stolen data), and chose the victim. A human was also the source of some of the access the AI used — more on that below. What was new wasn’t that a machine ran the whole operation unsupervised, but that a human handed the AI agent a goal and infrastructure, and the agent then executed the actual technical attack — the exploitation, credential use, moving across the network to reach more valuable systems, and encryption — on its own.

The AI agent got in through a known, already-patched flaw in Langflow, a popular open-source tool that businesses and developers use to build their own AI agents. Wherever Langflow was left unpatched and exposed to the internet, the flaw let an attacker run commands on the server without even logging in. From there, the AI agent explored the compromised machine, harvested passwords and access keys it found lying around, and used a set of default (never-changed) credentials to break into a storage server on its own. But the credentials that got it onto the real target — a second, more sensitive database server — weren’t something the agent discovered itself: they came from a separate, unrelated breach and were handed to the operation by a human before the attack began. Using those supplied credentials, the AI agent got administrative control on that server, scrambled more than 1,300 configuration records, and wrote its own Bitcoin ransom note. One additional wrinkle: Sysdig found the encryption key was randomly generated and printed once to a log but never saved or sent anywhere — meaning the data was unrecoverable even for a victim willing to pay.

How do researchers know the technical execution itself wasn’t human-driven, step by step? The attack code was full of plain-English notes explaining the reasoning behind each move — the kind of running commentary a human attacker doesn’t bother to write, but an AI narrating its own plan does. When one attempt failed, the agent diagnosed the problem and fixed it on its own in about 31 seconds.

This is the same capability — an AI system that can act independently across many steps once it’s given a goal and a foothold — that makes agents genuinely useful for automating real business work. JadePuffer is a reminder that once that capability is handed to an attacker, even one who still has to do some setup by hand, the actual break-in moves at machine speed instead of human speed.

What this means for you:

If your business or any vendor self-hosts an open-source AI tool like Langflow, patch it immediately and keep patching it — treat it exactly like any other server, because attackers now do.
If you use a commercial “AI agent” or “AI employee” product, ask the vendor plainly: which systems and data can this agent touch, and is that access limited to what it actually needs? Broad, always-on access is the ingredient that let this attack cascade from one server to the next.
Don’t count on being able to pay your way out of a ransomware attack — in this case, the attacker’s own encryption key was never saved anywhere, so paying wouldn’t have restored the data. Reliable, tested backups matter more than the ransom decision.

Sources

Checked 2026-07-18 — every specific fact about the JadePuffer attack, including the Langflow flaw, the encrypted records, and Michael Clark’s human-involvement clarification, was independently confirmed; the only issues found were one undefined jargon term and a small oversimplification of exactly how the agent gained admin access to the second server.

privacy development Google Quietly Turned On More AI Training By Default

In late June, Google sent account holders a routine-looking email announcing a new setting called “Search Services History.” Buried in that update: Google split how it collects your search activity away from the older “Web & App Activity” setting you may have configured years ago, and turned on a new sub-setting — saving your uploaded images, files, audio, and video — by default for many accounts. That saved material, drawn from things like Google Lens (Google’s image-search tool) photos, voice searches, and recordings from “Search Live” (the voice/camera feature built into Google Search), can now be used to train Google’s AI models. Google says it filters out identifying details first, but the setting itself didn’t ask for your permission — it just showed up. TechCrunch covered the change on July 6, calling it an under-the-radar update that most users hadn’t noticed; other outlets had reported on the rollout as early as late May and June.

Gemini, Google’s standalone chat assistant, is a separate product with its own separate control. Inside the Gemini app, a setting called “Keep Activity” decides whether your conversations there can be used for training; Google’s own in-app disclosure says a subset of chats may also be read by human reviewers for quality checks. Left on, Gemini chats are kept for up to 18 months before auto-deleting; you can shorten that retention window to 3 months in the app’s settings.

Here’s the part that matters for a business owner: this applies to ordinary personal Google accounts, not just to strangers. If you run your business off a free Gmail account — storing contracts, client files, or voice memos in Drive or Search — that material now falls under this default. Paid Google Workspace business accounts are contractually protected from this; a personal account used for business is not. Check which one you’re actually on, then see this issue’s Do This Now for the exact settings to change.

Sources

Checked 2026-07-18 — Google’s new default and the Search-versus-Gemini distinction are independently confirmed; the only gaps are an omitted note that human-reviewed Gemini chats can be kept for up to 3 years regardless of the auto-delete setting, and one undefined product term.

action checklist Do This Now: Turn Off Google’s AI Training Defaults

As we covered above, Google quietly widened what it can use to train its AI — including files, images, and voice recordings tied to your searches — and Gemini has a similar default that keeps and reviews your chats. Both are opt-out, not opt-in (meaning they’re on unless you turn them off, rather than off unless you turn them on). Here’s how to turn them off, in about 15 minutes.

Go to your Google Account settings. Sign in and visit myaccount.google.com, then click “Data & Privacy” in the left menu.
Turn down Web & App Activity. Under history settings, open Web & App Activity and either switch it off or set auto-delete to the shortest option offered (usually 3 months). Note: this only stops new activity from being logged going forward — it doesn’t delete what Google has already stored, so pair it with manually deleting your existing history if you want that gone too.
Do the same for Gemini. Open your Gemini Apps Activity (from the Data & Privacy page, or inside the Gemini app by tapping your profile icon). Turn off “Keep Activity” — this stops your chats from being kept and used for training going forward. Two catches: Google still holds chats briefly (up to a few days) to run the service even with this off, and any chat that was already sampled for human review before you turned the setting off can still be kept for up to three years — turning off the toggle doesn’t claw that back.
Turn off Search’s media-saving setting. Go to myactivity.google.com and open “Search Services History” (this setting also lives inside the Data & Privacy page used in the earlier steps). Uncheck the “Save Media” box — this is the specific control that stops future images, files, and voice recordings from your searches from being saved and used to train Google’s AI. As with Gemini, any media already used to train a model before you turn this off is disconnected from your account and can still be retained for up to 4 years.
Repeat for any second account. If you use a separate Google Workspace or business account, log into it and repeat steps 1–4 — settings don’t carry over between accounts.

You’ll lose a little personalization (Gemini won’t remember past chats, Search suggestions get more generic) but nothing about the switches is permanent — you can turn them back on anytime. Just remember: these controls govern what happens next, not what’s already been collected — clearing existing history is a separate, manual step.

Sources

Checked 2026-07-18 — every step traces to Google’s own documentation and matches current settings; the only gaps flagged were a missing parallel note about Search media’s 4-year post-training retention (now added above) and a slightly disorienting mid-instructions site switch.

definition Plain English: What’s an “AI Agent”?

A chatbot answers a question you type in, then stops and waits. An “AI agent” is different: it’s software that can carry out a multi-step task on its own — searching the web, logging into systems, writing and running its own code — to reach a goal, checking its own progress and trying again when something fails, without a person guiding each individual step.

The story in this issue about the JadePuffer ransomware attack shows why that matters — and also shows the limits of “on its own.” Researchers at security firm Sysdig found that an AI agent handled the technical break-in itself: it slipped through a bug in Langflow, a tool businesses use to build AI apps, then stole passwords, worked its way across the network, and locked up the victim’s database, rewriting its own attack code within seconds when something didn’t work — the way a human hacker would improvise. But Sysdig’s own Director of Threat Research, Michael Clark, later clarified that a person set the operation up first: choosing the target, building the attack infrastructure, and handing the agent some login credentials that had been stolen earlier in a separate, unrelated break-in. From there, the AI carried out the rest of the attack on its own. One added twist: the AI generated its own scrambling key to lock the data, displayed it once on its own screen, and never saved or sent it anywhere — so even a victim who paid the ransom couldn’t have gotten their data back.

The flip side is reassuring: that same self-directed ability, working within limits a person sets, is what makes legitimate AI agents useful for scheduling, research, or customer service. The practical lesson for your business: before you connect any AI agent to your systems, give it its own limited login — not your admin password or a shared one — scoped to only the specific accounts and data it actually needs, and turn off that access when the task is done. Treat it like handing a contractor a key to one room, not the master key to the building.

Sources

Checked 2026-07-18 — every claim about the JadePuffer attack checks out against independent reporting, and the security advice reflects current best practice; the one correction made was a title paraphrase (Sysdig’s Michael Clark is “Director of Threat Research,” not “lead researcher”).

roundup Quick Hits

Microsoft is making passkeys the default sign-in method for Entra ID — the identity system behind most organizations’ Microsoft 365 logins — starting September 1, 2026, and it’s phasing out its own SMS/voice codes by February 1, 2027. (Microsoft) Why you care: if you or your finance/admin staff sign into Microsoft 365 with a texted code, get everyone set up with a passkey (a fingerprint, face scan, or device PIN) now, before Microsoft nudges — or eventually forces — the switch.

Auto insurer AssuranceAmerica had files on nearly 7 million people stolen after attackers phished just one employee. (BleepingComputer) Why you care: one tricked employee, one login — that’s all it took. Multi-factor authentication (requiring a second step beyond a password, like a code or app prompt) belongs on every account with sensitive data, not just the ones that feel important.

A ransomware attack forced Coca-Cola to halt U.S. production at its Fairlife dairy brand. (BleepingComputer) Why you care: even a giant, well-resourced company can get knocked offline overnight — a reminder to ask key suppliers how they’d keep serving you if their systems went down.

Chrome is closing a loophole that let browser extensions collect more data than their stated purpose requires, with enforcement starting August 1. (Chrome for Developers) Why you care: it’s a good excuse to review the permissions on extensions you actually use — not just delete unused ones — and remove any that ask for more access than their job requires.

New privacy laws in Connecticut, Arkansas, and Utah took effect July 1, adding rules like a right to correct your data in Utah and stricter limits on collecting kids’ data in Arkansas. (Ice Miller) Why you care: if your website collects data from residents of those states, you may already have new obligations — worth a quick check with whoever handles your privacy policy.

Sources

Checked 2026-07-18 — all five items independently verified against primary and reputable secondary sources, with no unsafe or outdated advice.