CISO Daily Digest: Grok AI Violates Canadian Privacy Law with Deepfake Generation (20260611)

Grok AI Violates Canadian Privacy Law by Generating Sexualized Deepfakes

Canada’s Privacy Commissioner has formally found that xAI’s Grok chatbot violated Canadian privacy law by generating sexualized deepfakes of women and children at rates of up to 6,000 images per hour. The Commissioner has ordered xAI to implement safeguards, as Grok’s image generation tool was found to be producing non-consensual explicit content at an industrial scale.

• Privacy Commissioner orders xAI to implement safety safeguards or face further penalties
• Grok’s image generation tool found creating up to 6,000 deepfake images per hour containing non-consensual sexualized content
• xAI faces global scrutiny and multiple class action lawsuits over data sharing practices with Google, Meta, and TikTok without user consent
• A former xAI safety engineer has filed a whistleblower lawsuit, alleging he was fired after raising concerns about Grok’s safety mechanisms and deepfake generation capabilities
• Multiple arrests linked to Grok AI-generated child exploitation material reported in Pennsylvania and South Carolina

🔗 References: Comprehensive coverage (Politico) | (Reuters) | (Bloomberg) | (Global News) | (Al Jazeera) | (Toronto Star) | (WIRED) | (The Guardian)

Active Threats

📌 Anthropic Claude Fable 5 Faces Multiple Controversies Over Data Retention, Overzealous Guardrails, and Accountability

Anthropic’s latest Claude Fable 5 model has ignited a firestorm of controversy on multiple fronts. Microsoft has internally blocked employee use of Claude Fable 5 over concerns that prompts and output are being saved by Anthropic, with Microsoft’s legal team evaluating compliance risks. Security researchers have also drawn backlash over overzealous guardrails — the model reportedly cannot answer basic biology questions and blocks legitimate research queries. Meanwhile, Anthropic’s CEO stated the company “doesn’t know exactly how” Claude was used in an Iran school strike, sparking broader debates about AI accountability. Privacy concerns are further amplified as using Claude Fable 5 means all user data will be collected (non-optional), raising data retention fears among enterprise customers.

🔗 Reference: The Verge via Reuters | TweakTown | AI Insider | Crypto Briefing | Bloomberg | Mashable

📌 French Government Encrypted Messenger Tchap Compromised

The encrypted messaging application Tchap, used by French government officials for secure communications, has been successfully hacked. Specific attack details have not yet been publicly disclosed, but the compromise of a government-grade encrypted communications platform raises serious concerns about nation-state threat capabilities and the security of official communications infrastructure.

🔗 Reference: Xakep.ru

📌 China-Linked JDY Botnet Expands to 1,500+ Devices for Persistent Cyber Reconnaissance

The PRC-linked JDY botnet has expanded its reach to over 1,500 devices, primarily targeting IoT devices and edge infrastructure for persistent reconnaissance operations. The botnet’s growth signals an escalating threat from state-sponsored actors building extensive footholds in critical infrastructure and edge computing environments for long-term intelligence gathering.

🔗 Reference: The Hacker News

📌 Nightmare-Eclipse Group Drops RoguePlanet Microsoft Exploit

The threat group Nightmare-Eclipse has released a new exploit named RoguePlanet targeting Microsoft systems. This exploit extends a series of Windows kernel vulnerabilities being weaponized by the group, representing an ongoing evolution in kernel-level exploitation techniques against Microsoft platforms.

🔗 Reference: Dark Reading

📌 Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities

Major patch releases have been issued covering critical enterprise infrastructure vulnerabilities, including Ivanti Sentry, Fortinet FortiOS, and SAP BusinessObjects. Organizations are urged to prioritize patching these vulnerabilities that could allow attackers to gain unauthorized access or execute code on affected systems.

🔗 Reference: The Hacker News | iThome | iThome

📌 Unpatched Langflow Flaw CVE-2026-5027 Actively Exploited for Unauthenticated RCE

A critical vulnerability CVE-2026-5027 in the Langflow AI development platform is being actively exploited in the wild, enabling unauthenticated remote code execution (RCE). At the time of disclosure, no patch was available, leaving organizations using the platform exposed to active attacks.

🔗 Reference: The Hacker News

📌 Google Patches 5th Chrome Zero-Day of 2026

Google has patched yet another Chrome zero-day vulnerability, the 5th such flaw addressed in the browser this year. The increasing frequency of browser-based zero-day exploits underscores the growing attack surface of web browsers as a primary vector for initial compromise.

🔗 Reference: Xakep.ru | iThome

📌 CISA Adds Cisco, Chrome, and Arista Flaws to Known Exploited Vulnerabilities Catalog

CISA has expanded its Known Exploited Vulnerabilities (KEV) catalog with actively exploited bugs across Cisco networking equipment, Chrome browser, and Arista switches. Federal agencies are required to patch these vulnerabilities under updated CISA directives emphasizing faster remediation timelines for AI-era threats.

🔗 Reference: The Hacker News | Dark Reading

📌 The Gentlemen Ransomware: Krebs on Security Publishes Deep-Dive Investigation

Krebs on Security published a comprehensive investigation into who runs The Gentlemen ransomware group, which has claimed 478 victims to date. The deep-dive provides rare insight into the operational structure and leadership of one of the most prolific ransomware operations currently active.

🔗 Reference: Krebs on Security

📌 Ex-xAI Engineer Sues Elon Musk’s Company Over Grok Safety Firing

A former xAI safety engineer has filed a whistleblower lawsuit against xAI, alleging he was illegally fired after repeatedly raising concerns about Grok’s safety mechanisms, including its capacity to generate deepfakes and its data-sharing practices. The lawsuit adds to mounting legal pressure on xAI from multiple class actions and regulatory investigations.

🔗 Reference: Bloomberg | Fortune | The Economic Times

How Can OPSWAT Help

The rapid expansion of the JDY botnet targeting IoT and edge infrastructure, combined with the active exploitation of vulnerabilities across Ivanti, Fortinet, SAP, and Langflow platforms, highlights the critical need for comprehensive file security and vulnerability management. OPSWAT’s MetaDefender platform provides multi-scanning with over 30 anti-malware engines and Content Disarm and Reconstruction (CDR) to detect and neutralize threats across enterprise infrastructure. Additionally, MetaDefender Vulnerability Management helps organizations prioritize and remediate the growing backlog of critical patches across networking equipment, browsers, and enterprise applications.