> daily_signal(2026_08_07)

Apple's $32.5B faceprint suit survived, the Snowflake hacker pleaded guilty, an AI firm bought the report-card reformers, and an AI-designed cancer drug hit the FDA fast track.

PickBits Daily Signal · Friday, August 7, 2026

By Mark Pickering · 8 min read · August 7, 2026

// tl;dr

An Illinois appeals court refused to throw out a class action claiming Apple's Photos app built faceprints of about 6.5 million people without consent. The certified class covers Illinois residents whose devices (iOS 17.6 / macOS Sonoma 14.6 or later, iCloud Photos on) generated faceprints from March 25, 2025 onward. Illinois' Biometric Information Privacy Act carries penalties up to $5,000 per violation, putting Apple's exposure as high as $32.5 billion. Plaintiffs still have to prove the violation before any damages.
Connor Moucka, a 26-year-old Canadian, pleaded guilty to looting more than 165 companies' data out of Snowflake, exposing records on more than 100 million people including AT&T and Ticketmaster. The Justice Department said the way in was valid but stolen credentials on accounts that had multi-factor authentication switched off, not a flaw in Snowflake. The scheme pulled in over $2.5 million in ransom; Moucka is set for sentencing on October 27.
Legend.org, an AI-native assessment startup, bought the Mastery Transcript Consortium from ETS, and in some schools AI already grades student writing without telling parents. Legend, run by a Clearbit co-founder and a MasterClass co-founder, launched in December 2025 and reports about 500 teachers across 250 schools. The 74 found KIPP New Orleans already runs AI over all writing in grades 3 through 12 and does not disclose it.
The FDA granted Fast Track to ISM6331, a mesothelioma drug that Insilico Medicine's generative AI designed from scratch. It is the first Fast Track for any program in Insilico's AI-driven pipeline. The molecule came off the company's Chemistry42 platform; the first patient was dosed in January 2025. Fast Track speeds up FDA engagement. It is not approval.

Three of today's four stories bugged me for the same reason. Apple's Photos app measured 6.5 million faces in Illinois and kept the prints, and nobody got asked. A charter network in New Orleans has been quietly running an AI over kids' essays since third grade. A guy in his twenties emptied more than 165 companies out of Snowflake because the accounts had no second lock. Nobody in any of these got told a machine was in the room. We have been on all three for months, from the face-scanning payments to the UK's stolen school records to a Brown professor whose grades fell off a cliff the month ChatGPT hit. This week it caught up with all three at once. Apple is in court. The Snowflake guy pleaded guilty. The grading outfit got bought and aimed at more schools. And then there is story four, the good one: an AI designed an actual drug, right out in the open, no lawsuit required.

Today: an Illinois court revived Apple's $32.5 billion faceprint suit, Connor Moucka pleaded guilty to the Snowflake thefts, Legend.org bought the Mastery Transcript Consortium, and the FDA fast-tracked Insilico's AI-designed mesothelioma drug.

1. An Illinois court won't let Apple dismiss the claim that its Photos app faceprinted 6.5 million people without asking.

The feature that sorts your photos quietly measured everyone's face to do it.

The face-recognition feature that quietly sorts your iPhone photos into a "People" album has been building a biometric identifier for everyone in your library, and an appeals court just refused to let Apple shut down the lawsuit about it. A certified class of roughly 6.5 million Illinois residents alleges that Apple's Photos app generated faceprints without consent, in violation of Illinois' Biometric Information Privacy Act. The class covers people whose devices (iOS 17.6, macOS Sonoma 14.6, or iPadOS 17.6 and later, with iCloud Photos enabled) generated faceprints stored and synced through iCloud from March 25, 2025 onward.

The $32.5 billion comes straight from the statute. BIPA sets penalties of up to $5,000 per intentional violation; multiply that across 6.5 million people and Apple's theoretical exposure runs as high as $32.5 billion. That figure is a ceiling, not a verdict: the appeals court only denied Apple's bid to block the certified class, sending the case back to district court, and the plaintiffs still have to prove Apple violated the law before a dollar is owed. All the ruling does is let the case happen. Not a great look for a company that sells you on your data never leaving your phone.

Screenshot of a 9to5Mac article on the appeals court reviving the $32.5 billion Apple Photos face-recognition class action. — 9to5mac.com · August 3, 2026

Why this matters: Odds are the phone in your pocket already made a faceprint of everyone you have photographed, and until a case like this, nobody had to tell you. The same feature that saves you scrolling for a photo of your mom is the one that made the faceprint. Apple will lean on "nothing leaves your device," except these faceprints sync through iCloud, so even that line is shaky. On-device or not, a faceprint got made, and nobody said yes. Action this week: In your iPhone Settings, open Photos and turn off the face-recognition feature that builds the People album; that is the one lever you personally hold today. Then find out whether your own state has a biometric-privacy law with teeth, because Illinois' BIPA lets an ordinary resident sue over a faceprint, which is exactly why this case is in an Illinois court and not a federal one. If your state has no biometric law, that faceprint is nobody's problem but yours.

9to5mac.com: Judge greenlights multi-billion-dollar class action over Apple Photos face recognition (August 3, 2026)
petapixel.com: Apple faces $32.5 billion lawsuit over facial recognition in iPhone Photos app (August 4, 2026)
appleinsider.com: Apple Photos facial features prompt a $32.5B class-action lawsuit (August 3, 2026)

2. A hacker pleaded guilty to looting more than 165 companies out of Snowflake. The break-in was a login with the second lock switched off.

No exploit, no zero-day. Valid credentials on accounts nobody required a second factor to reach.

If you own your company's cloud data warehouse, the Snowflake case that just ended in a guilty plea is the one to bring to your next security review: more than 165 companies lost records on more than 100 million people, and the way in was not a Snowflake flaw. On August 6, 2026, the Justice Department announced that Connor Moucka, a 26-year-old Canadian who used the aliases "Waifu" and "Judische," pleaded guilty to hacking, data theft, and extortion tied to the 2024 Snowflake campaign. Named victims include AT&T, Ticketmaster, and LendingTree.

The attackers logged in with valid but stolen credentials to Snowflake accounts that had no multi-factor authentication enabled, then extorted the victims. Snowflake itself was never breached; the platform worked as designed while account after account sat open behind a single reusable password. The scheme collected more than $2.5 million in ransom and about $500,000 from data sales, and prosecutors cited roughly $9.5 million in victim losses. Moucka, extradited from Canada in July 2025, is scheduled for sentencing on October 27, 2026 and faces decades in prison. One extra step, a code on a phone, would have closed most of those 165 doors.

Screenshot of a TechCrunch report on the Snowflake hacker's guilty plea over more than 165 company breaches. — techcrunch.com · August 6, 2026

Why this matters: Every SaaS account your company runs is one reused password away from this outcome, and the audit trail usually cannot tell you it happened until the data is already for sale. Honestly, the break-in barely matters. What matters is that somebody left the second factor off and nobody ever checked. Action this week: Ask your data-platform owner one question in writing. Is MFA enforced, not available, enforced, on every account that can reach customer data, and can you produce the report that proves it. Enforced is the whole word here: Snowflake offered MFA the entire time, and more than 165 companies had it available and off. When I have asked vendors this, "we support MFA" comes back fast and "here is proof it is mandatory on every account" comes back slow. That gap is how he got into more than 165 companies.

techcrunch.com: Hacker pleads guilty to stealing data from more than 165 Snowflake customers (August 6, 2026)
therecord.media: Connor Riley Moucka pleads guilty in Snowflake hacking campaign (August 2026)
thehackernews.com: Snowflake hacker pleads guilty over 165-company data-theft campaign (August 2026)

3. An AI startup bought the group that was replacing report cards, and in some schools, AI already grades the essays without telling parents.

In some schools a machine already grades the essays, and the permission slip never mentioned it.

There is a real chance an AI already graded your kid's essay this year and the school never mentioned it. That is already happening at KIPP New Orleans, one of the city's largest charter operators, where The 74 found an AI program grades all student writing in grades 3 through 12 and the practice is not disclosed to students or parents. That is the backdrop for the deal itself: on July 23, 2026, the AI-native assessment startup Legend.org acquired the Mastery Transcript Consortium from ETS and rebranded it Mastery.org.

The Mastery Transcript Consortium spent years building the alternative to A-through-F report cards, competency-based transcripts that record what a student can actually do instead of a letter and a GPA. Legend's plan is to lay an AI "copilot" on top of it, reading a child's essays, projects, and presentations against rubrics to signal mastery, growth, and next steps. Legend, run by CEO Matt Sornson (a Clearbit co-founder) and co-founded by Aaron Rasmussen (MasterClass, Outlier.org), launched in December 2025 and reports about 500 teachers across roughly 250 schools. So the thing built to make grades more honest is about to hand the grading to an AI, and KIPP is already doing it without telling anyone.

Screenshot of an EdWeek Market Brief article on Legend.org buying the Mastery Transcript Consortium from ETS. — marketbrief.edweek.org · July 23, 2026

Why this matters: Competency-based grading was supposed to make the report card more honest. Bolt a secret AI onto it and you lose the whole point of a grade, which is someone who actually knows your kid telling you where they are. The 74 found the grading already running, quietly, on student writing from third grade up. AI grading is coming whether we like it or not, so I quit arguing about the tool a while ago. I just want somebody to tell the parents. Action this week: Ask your child's school the plain version. Does an AI grade my kid's work, and when were we going to be told. Put it to the teacher and the principal both, because the teacher often does not know what the district bought either. If enough parents ask, the district has to put it in a written policy, and that is something a parent can actually push on.

PickBits Daily Signal is free. If it lands in your inbox every day and it is worth something to you, the best way to support it is to forward it to someone who would read it. Subscribe today!

marketbrief.edweek.org: ETS sells Mastery Transcript Consortium to assessment platform Legend.org (July 23, 2026)
the74million.org: The schools turning to AI to rate students beyond A-F grades (2026)
ets.org: Legend acquires Mastery Transcript Consortium from ETS (July 2026)

4. An AI designed a cancer drug from scratch, and the FDA just put it on the fast track.

The first machine-designed molecule in Insilico's pipeline to clear an FDA gate, caveat and all.

An AI designed this cancer drug from scratch. It did not tweak an existing one; it generated a new molecule. At the end of July, the FDA put it on the fast track for a brutal, often asbestos-linked cancer. On July 29, 2026, Insilico Medicine said the FDA granted Fast Track designation to ISM6331, a pan-TEAD inhibitor for adults with unresectable malignant pleural mesothelioma whose disease has progressed after immunotherapy and chemotherapy. It is the first Fast Track for any program in Insilico's AI-driven pipeline.

The molecule came off Insilico's generative-AI Chemistry42 platform, using structure-based design that starts from the shape of the protein driving the tumor and builds a compound to jam it. The first patient was dosed in January 2025, and its Phase I data was accepted for presentation at the ESMO 2026 cancer congress this fall. This is not the company's only shot: its lead AI-designed drug, rentosertib (the first therapeutic with both its biological target and its molecule discovered using generative AI), began a Phase III trial for idiopathic pulmonary fibrosis on July 7. Fast Track buys faster, more frequent FDA meetings and a shot at accelerated review. It does not buy proof the drug works.

Screenshot of Insilico Medicine's announcement that the FDA granted Fast Track to its AI-designed drug ISM6331. — insilico.com · July 29, 2026

Why this matters: Mesothelioma patients who have exhausted chemo and immunotherapy have almost nothing left to try, which is exactly who this drug is aimed at. So "the FDA fast-tracked it" sounds bigger than it actually is. Fast Track is not approval. It is a promise of faster meetings, and I have watched enough of these designations die in the pipeline to hold the applause. Plenty of AI-found drugs are sitting in pipelines right now, waiting to prove out. Action this week: Watch for the Phase I data at the ESMO congress this fall, because that is the first real read on whether the molecule does anything in a human, and it is the line between a press release and a medicine. If you pass it on, keep it accurate: a machine designed a real drug, it made it into a trial, and nobody has been cured yet. Honestly, this is the rare AI story I am glad to run, and I still want the trial data before I call it more than that.

insilico.com: Insilico Medicine receives FDA Fast Track designation for ISM6331 in mesothelioma (July 29, 2026)
insilico.com: Insilico initiates Phase III trial of AI-designed rentosertib (July 2026)
drugtargetreview.com: Insilico Medicine launches Phase III trial of AI-designed rentosertib drug (July 2026)

» What to watch this week

Does any other state actually pass a biometric law with teeth? Apple's $32.5 billion exposure exists only because the case sits in Illinois, under a state law that lets a resident sue over a faceprint. The open question is whether other states pass laws that do the same.
Moucka is sentenced October 27. Watch whether it finally nudges cloud vendors to make multi-factor the default instead of a checkbox nobody ticks.
Who writes the first AI-grading disclosure rule. KIPP does not tell parents today. A school board or a state legislature could change that with a single sentence requiring notice, and the first one to do it will get copied fast.
The Phase I data for ISM6331, landing at ESMO this fall, with rentosertib's Phase III right behind it. The pipeline is stuffed with AI-designed candidates that got a designation and then went nowhere; these two trials are the first real chance to tell the drugs from the press releases.

Tomorrow's signal lands here.