Old security flaws plus cheap AI equals new exposure
A Princeton researcher showed a known flaw in Georgia's ballot scanners, still unpatched in places, lets someone with public records and cheap AI tools work out the order ballots were cast in. Commenters noted that this reveals whether your neighbor voted, not how. ASOS app users got push notifications apparently sent by hackers, with a ransom note addressed to the data protection officer and customers just CC'd. People guessed it touched Snowflake or something broader. DEDA, a toolkit for extracting and removing printer tracking dots, also resurfaced, and the dots were used in 2025 to unmask a Pokemon card forgery ring.
The pattern: the exploit is rarely new. What changed is that the cost of connecting scattered data, public records, hidden metadata, third-party platforms, has collapsed. Weak links that were safe through obscurity are now cheap to chain.
The nuance is on the defender side. A 2025 forgery bust shows tracking can serve good ends too. The tool is neutral, the policy around it is not.
So what?
Audit what leaks through your metadata, logs, and third-party integrations, not just your front door. Assume an attacker can now afford to correlate everything you have exposed, and plan your breach communication before you need it.