Artificial Intelligence
OpenAI to honor robots.txt signal for AI training preferences
OpenAI announced it will respect a shared robots.txt signal that lets website operators indicate whether their content should be used for AI training. The signal provides a standardized way for sites to communicate preferences to participating AI providers, giving publishers more control over how their data is consumed by large language models. This move aligns with growing industry efforts to establish transparent data-use norms.
Why it matters: The robots.txt extension gives site owners a practical mechanism to opt out of AI training corpora without blocking human visitors or search crawlers. For developers and platform engineers, it signals a shift toward standardized data-governance signals that could simplify compliance and reduce legal friction when scraping or indexing web content at scale.
Source: Making it easier for websites to express AI training preferences
OpenAI expands ChatGPT violence-prevention safeguards and public safety reporting
OpenAI has published a new community safety report outlining steps to reduce the risk that ChatGPT produces violent content, including protections aimed specifically at teen users. The report describes earlier interventions when warning signs appear in a conversation, along with a new commitment to report credible threats of violence to public safety authorities.
Why it matters: These enhancements reflect growing industry focus on responsible AI deployment, particularly for widely used conversational models. Earlier interventions and public safety reporting could set precedents for transparency in AI content moderation. For developers and platform engineers integrating such models, understanding evolving safety architectures informs risk assessments and compliance planning.
Source: Community safety report and new protections for teens
DevOps
Cloudflare extends security services to private origins via Cloudflare One
Cloudflare has made its services for private origins generally available, allowing customers to place a proxied DNS record pointing to a private IP address. Cloudflare then routes traffic to the origin over an existing Cloudflare One connection, keeping the origin off the public Internet while applying web application firewall, bot management, rate limiting, caching, rewrite rules, and Workers. The capability launched in closed beta in June to address demand from teams running internal APIs, AI agent backends, MCP servers, and operational tools that need to accept external requests without exposing public IPs or opening firewall ports. Some features, including Argo Smart Routing and Dedicated CDN Egress IPs, remain unsupported.
Why it matters: This eliminates the need to expose private services directly to the Internet or run additional tunneling software to gain Cloudflare’s security and performance controls. Platform and security teams can now apply consistent WAF policies, bot mitigation, and caching to internal workloads that serve partners or AI agents, reducing operational complexity and closing a coverage gap where private applications previously lacked the same protections as public-facing ones.
Source: Cloudflare services for private origins is now generally available
Cybersecurity
CISA adds two Ivanti Connect Secure flaws to Known Exploited Vulnerabilities catalog
CISA has added two vulnerabilities in Ivanti Connect Secure to its Known Exploited Vulnerabilities catalog. CVE-2026-118527 lets a remote authenticated attacker upload attacker-controlled files to a predictable disk location. CVE-2026-111357 permits a local authenticated attacker to escalate privileges. CISA notes both can be chained together with a third vulnerability, CVE-2026-104935, potentially allowing an attacker to achieve deeper system access.
Why it matters: Inclusion in the CISA Known Exploited Vulnerabilities catalog indicates these flaws are being actively exploited in the wild. Ivanti Connect Secure is widely deployed for remote access, and the chainable nature of the vulnerabilities raises the risk of unauthorized file upload and privilege escalation, potentially leading to full system compromise. Security teams and administrators should evaluate their exposure and apply vendor mitigations promptly.
Source: Ivanti Connect Secure: CVE-2026-118527 added to CISA Known Exploited Vulnerabilities
DOJ flags privacy risks in potential sale of Character.AI chat data
The U.S. Department of Justice’s Executive Office for U.S. Trustees has warned that a consumer-privacy ombudsman should be appointed to advise a court on how data from Character.AI conversations could be sold and under what conditions. The statement highlights concerns that user-generated chat logs may be transferred without adequate safeguards.
Why it matters: If chat data from an AI service is sold without clear privacy rules, developers and platform operators could face regulatory scrutiny and loss of user trust. Security teams and data engineers must ensure that any data-sharing agreements include strong access controls and transparency measures to protect sensitive conversation content.
Source: DOJ raises privacy concerns over potential sale of Character.AI chats