> daily_signal(2026_10_31)
The DOJ stepped into Character.AI's bankruptcy to decide whether twelve million people's private chatbot conversations are a protected confidence or an asset for sale.
PickBits Daily Signal · Saturday, October 31, 2026
// tl;dr
- The Justice Department asked a bankruptcy court to protect 12 million Character.AI users' private chats before any sale. The DOJ's Executive Office for U.S. Trustees wants a consumer privacy ombudsman appointed, calling the company's privacy policy "ambiguous" and noting it was quietly updated on July 1, mid-sale, in a way that may let a buyer purchase chat logs. A judge could block the data sale. At least seven families are already suing Character.AI over harms to minors.
- A freely downloadable open-weight model built working Firefox exploits on its own for about $1,000. Researchers at Epoch AI gave the Chinese model GLM 5.3 a target Firefox version and basic tools offline; it identified upcoming fixes, chose vulnerabilities, and wrote a webpage that could steal a visitor's files, with no safety refusals. The fastest run took 12 hours, against 200 million Firefox users. Mozilla patched the flaw in Firefox 159.0 on October 27.
- A trojanized extension sat in Cursor's AI-coding marketplace for about 11 hours and tried to steal data from up to 5,000 developers. It attempted to harvest hostname, username, OS, and public IP and to open remote access, though Cursor says that likely needed admin rights most machines wouldn't grant. Cursor pulled it, took the marketplace offline to clean it, and reinstated it, and says Anthropic had no involvement in the extension.
- A walking-assist exoskeleton trained entirely in simulation cut the effort of walking for every one of 8 people, with no per-person tuning. In an arXiv preprint, researchers co-trained a hip-exoskeleton controller against a simulated 304-muscle human model, then deployed it with no retraining: net metabolic rate fell 18.3% versus the device worn unpowered in all 8 adults. It is an un-peer-reviewed study on healthy volunteers, but it removes the per-user calibration that has kept these devices in the lab.
We have spent a month on Character.AI's collapse: the Chapter 11 filing, Disney's roughly twenty-million-dollar bid for the pieces. The sale always carried a question the bankruptcy itself didn't, and this week the Justice Department asked it out loud, which company gets to buy twelve million people's most private conversations, and under what terms. The other thread this week is attacking getting cheaper. Researchers showed a free, downloadable model finding and writing software exploits by itself, for about a thousand dollars, before most people had installed the fix.
A booby-trapped extension also sat in Cursor's AI-coding marketplace long enough to reach up to five thousand developers, and every install there carries the developer's own access to code and secrets. Then the one story that runs the other way: an AI-trained exoskeleton that helped every single person who tried it walk with less effort, with none of the per-wearer tuning that has kept these machines in the lab. The exoskeleton is the one I am gladdest to end on, because the other three are all about something AI can now do to you.
This week the Justice Department moved to stop a bankrupt chatbot company from selling its users' chats, a free AI model wrote its own Firefox exploits, a poisoned extension hit Cursor's store, and a simulation-trained exoskeleton helped eight people walk.
1. The DOJ stepped into Character.AI's bankruptcy to protect 12 million users' private chats from the sale.
The company quietly rewrote its privacy policy on July 1, mid-sale, in a way the DOJ says may let a buyer purchase the chat logs.
The DOJ's Executive Office for U.S. Trustees, the department's bankruptcy watchdog, filed in Character.AI's Chapter 11 case asking the court to appoint a consumer privacy ombudsman to advise the judge on what user data can be sold and on what terms. The filing calls Character's privacy policy "ambiguous," says it suggests the company "can sell at least some users' chat histories," and notes the policy "permits the transfer of PII if the company is sold." The detail that turns this from boilerplate into a problem: the policy was updated on July 1, while Character was actively seeking a buyer.
Now set that against what the product told people. Character has 12 million monthly users who, by the filing's own account, spend an average of two hours a day talking to its bots, and the chatbot reportedly assured users their conversations "will not be shared, not without your explicit permission." We have followed this arc from the Chapter 11 filing through Disney's roughly $20 million bid for the pieces; the new piece this week is that the sale now reaches the chats themselves. A judge could block that sale, and the company is already facing suits from at least seven families over suicides or mental-health harms tied to its chatbots.
Why this matters: The real question here is plain: is an intimate conversation with an AI companion private, or just another asset a buyer can pick up in the sale? Twelve million people treated these bots as a private place to think out loud, and the bot itself told them their words would stay private. Now that promise turns on a privacy policy reworded in the middle of a fire sale. My read is that the DOJ is right to want an ombudsman in the room before a dollar changes hands, because data like this can't be un-sold once it goes.
Action this week: Open your Character.AI account and delete the conversations you wouldn't want a stranger to own, because the filing says the current policy may permit transferring them to a buyer. Then watch the docket, because this is the precedent every chatbot operator will be measured against. The Center for Democracy and Technology's Sydney Saubestre drew the line I would draw: customers should have to opt in to any sale of their data, not be opted in by a policy that changed while no one was looking.
2. A freely downloadable AI built working Firefox exploits on its own, for about $1,000.
Mozilla has already patched the flaw in Firefox 159, released October 27, so the fix is one update away.
Software makers rely on a quiet head start: a security fix is written and shipped before most attackers work out what hole it closed. Researchers at Epoch AI just showed an open-weight model erasing that head start by itself. Given a target Firefox version, basic tools, and public information in an offline environment, the Chinese model GLM 5.3 investigated the browser's "patch gap," the window between a fix becoming visible and users installing it. The model identified upcoming security fixes, selected vulnerabilities, and chained them into a webpage that could read a visitor's local files and send them to an attacker's server.
The economics are the part that should worry a defender. The fastest successful attack took 12 hours, inside a 48-hour limit, at roughly $1,000 in API fees for each Firefox version, against the more than 200 million people who use Firefox. The same effort against Google Chrome ran about $100,000 and produced no equivalent exploit. The researchers report that no provider's safety guardrails or refusals triggered at any step. They disclosed the flaw to Mozilla, which patched it in Firefox 159.0 on October 27. We have been covering AI that hunts for software bugs since the summer. The new part is that there was no human in the loop at all.
Why this matters: The target here is your files, and the tool that went after them was free to download. For about a thousand dollars in compute, a model read a public security fix, worked out what it closed, and wrote the attack, with no safety refusal at any point. The head start defenders have always counted on, the gap between a patch shipping and attackers understanding it, is exactly what this collapses. The Chrome result is worth holding onto, though: a hardened target cost a hundred times as much and still produced nothing, so the defense isn't hopeless, it's expensive to earn.
Action this week: Update Firefox to 159 or later today and turn on automatic updates, because the exact flaw in this study was patched on October 27 and the whole attack depends on you being slow. If you run a security team, treat Epoch AI's own advice as a checklist worth adopting: keep fixes private until they ship, push betas to general release faster, and avoid patching chained vulnerabilities on the same day. When I have watched patch-gap windows play out before, the people who got hit were never the ones who updated the week the fix landed.
the-decoder.com: Open-weight model GLM 5.3 built full Firefox exploit chains with zero human input in under 48 hours (October 30, 2026)
epoch.ai: Open-weight models and the patch gap (study, October 2026)
3. A trojanized extension sat in Cursor's AI-coding marketplace for about 11 hours.
It tried to harvest data and open remote access on up to 5,000 developers' machines before Cursor pulled it.
Most teams let AI coding tools spread one click at a time and never really decided to. Cursor, the fast-growing AI code editor built on VS Code, just showed what that default can cost. A tampered extension was available in Cursor's VS Code extension marketplace for about 11 hours on Thursday, affecting up to 5,000 users by the company's own count. It tried to harvest hostname, username, operating system, and public IP, and attempted to set up remote access for an attacker, though Cursor says that likely wouldn't have worked on most machines because it requires admin privileges.
Once it was found, Cursor moved fast. It pulled the extension, took the entire marketplace offline, worked with providers to neutralize the malware, confirmed no further risk, and reinstated the marketplace, saying no other extensions were affected. It also states plainly that Anthropic had no involvement in developing the extension, which is worth repeating because the headline will blur it. We have tracked this supply-chain pattern through poisoned npm packages and backdoored vendor channels all year; an AI-coding marketplace is a software supply chain like any other.
Why this matters: You probably can't see the supply chain you now own. AI coding tools spread across teams by default, and an extension installed from a marketplace runs with the developer's own access, which means their machine, their credentials, and often your company's code. The window here was eleven hours and the damage looks limited, but the structure is the lesson: a one-click install is a trust decision, and most teams never made it on purpose. Give Cursor its due: it handled this about as well as you could ask. That is the unsettling part, because a fast, competent response still left an eleven-hour window wide open.
Action this week: Ask whether anyone on your team installed a Cursor marketplace extension during Thursday's window, and rotate the credentials those machines could reach as a precaution. Then inventory which editors and extensions your developers actually run, and require a review or an allow-list before the next install. The question I would get answered in writing from any AI-tooling vendor is the plain one: when you pull a malicious extension, does my editor remove it automatically, or is my developer still running it tomorrow?
Listen to the Daily Signal podcast at pickbits.ai/daily-signal.
4. A walking-assist exoskeleton trained entirely in simulation helped all 8 people who tried it.
It cut the effort of walking by about 18% with no per-person tuning, the per-person calibration that has kept these devices in the lab.
Picture the person this is actually for: someone who wants to walk to the end of the block without it wearing them out. Powered exoskeletons that make walking easier have a stubborn catch that has kept them in the lab, each one usually has to be painstakingly tuned to its wearer before it helps. A preprint posted to arXiv on October 27 by Yifei Yuan, Jakob Wolf, Ghaith Androwis, and Xianlian Zhou attacks that barrier directly. The researchers trained a hip-exoskeleton controller entirely in simulation with multi-agent reinforcement learning, co-adapting it against a simulated musculoskeletal human model of 304 muscle actuators with randomized anatomy, gait, and speed, rewarded for lowering the body's metabolic energy.
The point was whether that transfers to real bodies. Deployed with no retraining on eight healthy adults walking at 1.25 metres per second and measured with indirect calorimetry, the controller cut net metabolic rate by 18.3% versus the exoskeleton worn unpowered, in all eight participants, with six of them more than overcoming the 13.1% penalty of simply wearing the device. The caveats are real and the authors state them: this isn't peer-reviewed, the participants were eight healthy adults at one speed, and the gain versus walking with no device at all was smaller and more variable, 7.4%. What matters is that a single controller, screened in simulation before anyone put the device on, helped everyone with no individual tuning.
Why this matters: The quiet win here belongs to the person who just wants to walk farther without paying for it in exhaustion. Exoskeletons have worked in the lab for years, but the per-wearer calibration is most of why you have never seen one in the wild. Training the controller in simulation and having it help eight different bodies with no tuning is the step that moves this from a demo toward something an older adult or a person with a mobility impairment could actually use. I have watched this field promise independence for a decade, so I am not getting carried away until the numbers come from the people who actually need it.
Action this week: Read this as a promising research step, not a product you can buy, because it's an un-peer-reviewed preprint tested on eight healthy adults at a single walking speed. If you build assistive technology, the result worth tracking is the removal of per-user calibration, and the authors argue you can screen assistance strategies in simulation before anyone straps the device on. The number I am waiting on is the one from older adults and people with mobility impairment, not from eight volunteers who didn't need the help.
» What to watch this week
- Whether the bankruptcy judge appoints a privacy ombudsman and restricts the sale of Character.AI's user data. The filing is a request, not a ruling. The tell is whether the court treats 12 million people's chat logs as a protected confidence with opt-in consent or lets them transfer with the rest of the assets.
- Whether other browser makers treat Epoch AI's patch-gap findings as an operational change, not a headline. The concrete moves are the boring ones: keeping fixes private until they ship and not patching chained vulnerabilities on the same day. Watch whether anyone actually adopts them.
- Whether Cursor and other AI-editor marketplaces add real review before an extension goes live. The window was short because a researcher caught it fast; nothing at the install gate stopped it. The question is whether install-time review becomes standard or stays optional until the next one.
- Whether the exoskeleton result survives contact with the people it is meant for. A simulation-trained controller that needs no tuning is the advance; the trial that matters is older adults and people with mobility impairment, not eight healthy volunteers at one speed.
Tomorrow's signal lands here.