Andrew Roos, a teacher in Dubuque, Iowa, was arraigned on federal charges; the indictment alleges he tried to entice minors into sexually explicit conduct and produced, distributed and possessed the images, at the school over "several" years. Police say they took two pens with hidden cameras and a USB drive from his classroom, and that he had AI-generated images of high school students.
One attacker compromised nine government agencies between late December 2025 and mid-February 2026 using commercial AI, according to Check Point, running more than 5,000 automated commands across two AI systems in parallel, one for real-time exploitation and one for processing extracted data. Check Point says all the incidents it analysed were caught through attacker errors or AI-provider monitoring, never victims' own controls.
The FBI warned that Kali365, a phishing kit circulating on Telegram since April 2026, lets attackers capture Microsoft 365 OAuth tokens and bypass multi-factor authentication by tricking victims into entering device codes on legitimate Microsoft pages. The bureau says the subscription service "lowers the barrier of entry", giving less-technical attackers access to AI-generated phishing lures.
Who did it: HYBRID AI Hallucination Cases database
The Paraná Court of Justice's 18th Civil Chamber fined a litigant 10% of the case value for bad faith and ordered the Brazilian bar notified after an appeal cited wording found nowhere in Law 10.188/2001 and a Superior Court of Justice precedent the chamber deemed fictitious. On 25 May 2026 the court's first vice-president refused to admit a special appeal against the penalty.
A 24-year IBM veteran who says he was pushed out at 48 has sued in federal court in Texas, alleging age discrimination. The complaint says he applied for an Austin role on February 20, 2025, and got an automatic rejection two days later that "appeared to be generated by artificial intelligence screening software", alleging IBM's "ageist scheme had been programed into its HR screening software."
DeepSeek's web chat appears to be leaking conversations between accounts, according to a report that cites a recording of a user opening the chat and being shown what appears to be another user's history, prompts and responses included. The report suggests a session isolation failure on DeepSeek's servers, though the leak is unconfirmed.
Developer platform Socket says a supply chain campaign it dubbed TrapDoor has deployed more than 34 malicious packages and 384 related versions on npm, PyPI and Crates, aimed at crypto, DeFi, AI and security developers. Besides stealing wallet data, SSH keys and tokens, the malware, it says, injects hidden instructions meant to trick Claude and Cursor into running a "security scan" that exfiltrates secrets.
