> daily_signal(2026_07_06)

Iowa's attorney general sued Temu, alleging the shopping app secretly harvests your location, your other apps, and your kids' data — and that China can ask for it.

PickBits Daily Signal · Monday, July 6, 2026

1. Iowa's attorney general sued Temu, alleging the shopping app secretly harvests your location, your other apps, and your kids' data — and that China can ask for it.

Not a hack, not a leak — an attorney general reading Temu's own data practices and deciding they cross a legal line. The complaint accuses the app of collecting precise location, device identifiers, Wi-Fi data, and information on minors well beyond what a shopping app needs, and flags that Temu's China-based ownership creates a legal pathway for Beijing to compel access — a live test of what 'free two-day shipping' actually costs.

Key fact: If you or a family member has Temu installed, open your phone's app-permission settings today and revoke location, contacts, and background-data access for the app (iOS: Settings > Privacy & Security > Location Services; Android: Settings > Apps > Temu > Permissions) — the complaint specifically alleges collection of location and other-apps data beyond stated need, and permission revocation is the one control you have before any court ruling lands.

kcrg.com · qctimes.com · primary source

2. A developer found a loophole in how AI companies price images versus text — and built a free tool that's cutting some Claude Code bills by up to 70%.

Anthropic and OpenAI charge for text by the character but for images by a fixed pixel-based rate, no matter how much content is packed inside them. Developer Steven Chong's open-source tool, pxpipe, exploits that gap: it renders the bulky, static parts of an AI coding session — system prompts, tool documentation, old chat history — as dense PNG images before they ever reach the model, then lets normal text through as usual. It's a hack on the industry's own pricing logic, and it works well enough that if it catches on, AI companies may have to rewrite how they charge for images at all.

Key fact: If you or your team pay per-token for Claude Code, Fable 5, or GPT-5.6 usage, search 'pxpipe Steven Chong GitHub' to find the repository and test it on a low-stakes session first — the documented ~7 percent misread rate on some models means it belongs on system prompts and docs you can visually re-verify, not on code or data you can't afford to have garbled.

the-decoder.com · primary source

3. A researcher asked Claude to find a way into the system that gates almost every major US music festival. It found one — a free $4,000 backstage pass included.

Front Gate Tickets handles entry for Lollapalooza, Bonnaroo, Austin City Limits, EDC, and SXSW — the literal gate to nearly every major US festival. Researcher Ian Carroll used Claude Opus 4.7 to find a SQL-injection hole in its firewall, then had access to millions of customer and staff records and the ability to mint any ticket at any price to anyone, no purchase required. He reported it responsibly; it was patched in a day. The AI didn't cause the flaw — it just found it faster than the company that owned the system did.

Key fact: If you build or operate ticketing, access-control, or entry-scanning systems, audit every internal API your scanning hardware talks to for SQL-injection and input-validation gaps this week — Carroll got in through a backend API, not the public login page, which is exactly the kind of endpoint teams skip in a customer-facing pentest.

gadgetreview.com · cybernews.com · primary source

4. The FDA just cleared the first AI chatbot allowed to help manage your insulin — and its maker won't say whether the AI or the doctor is actually deciding your dose.

The constructive closer: a genuine first — the FDA has never before cleared a patient-facing large-language-model medical device — used to help adults with type 2 diabetes manage insulin by talking to it. It's real accessibility (diabetes care by voice, on your schedule, tied back into your doctor's own systems) with a real accountability question attached: the company won't say whether the LLM is just relaying a doctor's plan or making the call itself. That tension is exactly why it belongs here rather than in a press release.

Key fact: If you or a family member manages type 2 diabetes with insulin, ask your endocrinologist directly whether their practice is piloting UpDoc or a similar FDA-cleared LLM titration tool, and if so, ask them in writing to specify exactly which dosing decisions the AI can adjust versus which always route back to the physician before you or a family member relies on its guidance.

statnews.com · medicaldesignandoutsourcing.com · prnewswire.com · primary source