Tech News Weekly 431: iPhone Hacking Tools Go Public

Summary

Tech News Weekly Episode 431: iPhone Hacking Tools Go Public

Host: Micah Sargent
Guest: Abrar Al-Heeti
Date: April 2, 2026

---

Episode Overview

This episode dives into some of the hottest and most pressing topics in tech:

• Meta’s skirmish with the MPAA over content ratings for teens on Instagram
• A major code leak from Anthropic revealing the future of Claude’s AI coding assistant
• The alarming public release of the “Dark Sword” iPhone hacking toolkit
• Fresh legal verdicts holding Meta and YouTube accountable for harm to children on their platforms
  The conversation is dynamic, insightful, and laced with both humor and deep concern for tech’s real-world impact.

---

Key Discussion Points and Insights

1. Meta vs. MPAA: The Battle Over Teen Content Ratings

[01:48 – 12:07]

• Background:
  Meta had begun using references to the PG-13 movie rating to describe what teens might encounter on Instagram. The move was a response to longstanding concerns about online safety for teens.
• MPAA Pushback:
  The Motion Picture Association sent a cease and desist, arguing that Meta’s use of “PG-13” could mislead parents and infringed on their trademark.
  • Quote - Abrar (03:50): “It just kind of continues to highlight this tricky path of, of how much does Meta need to do to keep teens safe. And is this the right path?”
• Resolution:
  Meta and the MPAA struck an agreement: Meta will scale back PG-13 references and clarify that the MPAA wasn’t involved in any ratings used.
• Host and Guest Reflection:
  • Micah (06:58): “It was wild to me… I was shocked that they had not asked in the first place about this. That kind of blew my mind a little bit.”
  • Abrar (09:06): Expressed doubts about the effectiveness of Instagram’s safety tools, noting that reporting mechanisms often fail—even for adults.
• Deeper Issues Raised:
  • Many efforts in online safety can feel like “bare minimum” box-checking rather than substantive change.
  • The conversation highlighted social media’s chronic moderation failures: “Are you actually listening to people when they say they feel uncomfortable with an exchange?” (09:06)
  • Mixed responses to halfway measures: “Why do it halfway or… a quarter of the way?” (11:20)

---

2. The Anthropic Claude Code Leak: A Look at AI’s Next Steps

[13:04 – 27:06]

• What Was Leaked:
  Over 4.5 million lines of source code surfaced, revealing a host of unreleased or experimental features for Claude’s coding assistant.
• Key Discoveries:
  • Kairos: An always-on agent—essentially a persistent, personalized AI coworker that maintains context across sessions and proactively surfaces things you need.
    • “It’s built around a file-based memory system that carries context across sessions… a personalized coding partner that actually learns how you work.” (15:22)
  • Auto Dream: The model “dreams” during idle time, consolidating and synthesizing information to refine its memory—paralleling theories about why humans dream.
    • Micah (18:09): “We know dreaming is important… sleep gives us the ability to store files sort of in longer term memory… So it’s no surprise they’re calling this Auto Dream.”
  • Ultra Plan: Enables powerful Opus-tier models to draft and execute extensive plans autonomously, for up to 30-minute sessions—a leap from simple prompt-and-response.
  • Other features: Voice mode, remote control via mobile (“Dispatch”), and Coordinator (an AI “boss” for orchestrating parallel tasks).
• Is the Leak Strategic or Accidental?
  • Micah (20:53): Doubts that this was a purposeful leak, citing competitive risk.
  • Abrar (21:14): “How much is Anthropic freaking out on a scale of 1 to 10? And it’s probably closer to 10.”
  • Some listeners suspect the “leak” is a marketing flex, but even so, Anthropic took rapid action to scrub the code from various platforms (26:42).
• Real-World AI Use:
  • Micah shares practical uses for AI’s research capabilities, like sourcing the best gluten-free sugar cookie recipes with aggregated web feedback (23:58).
  • Abrar’s reflection: Recognizes the broader, untapped potential for leveraging AI’s research strengths.

---

3. Dark Sword iPhone Hacking Toolkit Goes Public

[28:23 – 37:54]

• The Threat:
  Two highly advanced iPhone hacking tools—Karuna and Dark Sword—have surfaced online.
  • Karuna: Targets iOS 13–17
  • Dark Sword: Hits recent versions up to iOS 18.7, making many current devices vulnerable.
  • Quote - Micah: “Someone out there posted part of [Dark Sword’s] code on GitHub, making it easy for anyone to download and deploy… now essentially plug and play.” (31:19)
• Attack Mechanics:
  • “Watering hole” attacks exploit even legitimate websites; any site can be “poisoned” to infect unsuspecting devices (31:40).
  • Attacks steal everything from messages to crypto wallets and give hackers full control.
• Where Did These Tools Come From?
  • Traced to government hacking contractors, possibly L3Harris’s “Trenchant” group, but now proliferated into global cybercriminal markets.
    • “[These exploits] somehow made their way…into the hands of Russian spies, Chinese cybercriminals…” (34:05)
  • Historical context: NSA’s EternalBlue exploit led to the massive 2017 WannaCry ransomware outbreak.
• Why Is the Code Still Online?
  • GitHub says it retains the code for security research; only active malware campaigns warrant takedown.
    • Micah (36:24): “From a practical…objective standpoint, I get the idea…My problem is…I don’t think that what the council has said lines up with the actions.”
• Practical Protection:
  • Everyone should update their Apple devices to iOS 18.7.7 (or iOS 26), or turn on Lockdown Mode if they can’t update.
  • Abrar (33:41): “It freaks me out, and at the same time, I’m like, another one… it’s just another day.”

---

4. Big Legal Breakthroughs: Meta and YouTube in the Dock

[40:21 – 48:49]

• Two Landmark Trials:
  • New Mexico: Meta ordered to pay $375 million for enabling sexual exploitation of minors, with the court also seeking design changes to the apps.
  • California: Meta and YouTube found negligent in causing harm to a girl who became addicted to the platforms as a child. $6 million in damages awarded.
    • Key courtroom moment: Lawyer uses M&Ms to illustrate punitive damages; “Each piece of candy represented a billion dollars of the company’s value…” (43:21)
• Implications:
  • Juries are now willing to hold Big Tech accountable for the design—not just the content—of products that harm children.
  • A new legal theory sidesteps Section 230, targeting the addictive nature of platform design.
  • Precedents could impact thousands of similar cases nationwide.

---

Notable Quotes & Moments

• On Meta’s handling of the MPAA issue:
  • Micah: “The execution just absolutely fumbled the ball there.” (07:27)
• On reporting abuse to Instagram:
  • Abrar: “Instagram never agrees with me… hate speech is being spewed and… you don’t think it’s an issue.” (09:06)
• On the sheer power of the Dark Sword leak:
  • Micah: “The tools are trivially easy to execute… update your iPhone or your iPad.” (37:54)
• On legal accountability in social media:
  • Micah: “[Juries] are now willing to hold Big Tech accountable for the way their products are being shown to affect kids.” (41:00)
  • On M&M’s in court: “Each piece of candy represented a billion dollars of the company’s value. You can take out a handful and not make a difference.” (43:21)

---

Important Timestamps

• PG-13 Ratings Fiasco – The Meta and MPAA Clash: 01:48 – 12:07
• Anthropic Claude Code Leak Unpacked: 13:04 – 27:06
• Dark Sword iPhone Hacking Toolkit Goes Public: 28:23 – 37:54
• Meta and YouTube Face Court Over Harm to Kids: 40:21 – 48:49

---

Tone & Style

The discussion is fast-paced, tech-savvy, playful, yet deeply concerned about privacy, online safety, and accountability.
Quips about “grown-up Clippy” (16:44) and the sadness of digital threats becoming routine (33:41) add levity amid serious subject matter.

---

Further Resources

For follow-up, listeners are directed to show notes with links to TechCrunch, Ars Technica, and The New York Times reports, as well as privacy and update guides for securing Apple devices.

---

Summary

This episode delivers a compelling look inside the big stories driving tech news: the struggle for teen safety on social media, the exponential leap in AI coding assistants revealed by a massive leak, the ominous accessibility of iPhone hacking kits, and—perhaps most consequentially—a legal system waking up to the need for real accountability from the world’s biggest tech firms. Peppered with sharp insights and relatable anecdotes, Episode 431 is essential listening for anyone following the intersections of technology, privacy, and social impact.

Transcript

[A]

Coming up on Tech News Weekly, Abrar Al Heati is here. We talk about how Meta and the MPAA have come to an agreement about using movie ratings on the platform. Then I talk about that Claude code leak and all the stuff Anthropic has in the works. Before we discuss the very scary dark sword toolkit for hacking into modern iPhones. And Meta and YouTube facing big trials about the way that their platforms do or don't harm kids. All of that coming up on Tech News Weekly.

[B]

Podcasts you love from people you trust.

[A]

This is Twit. This is Tech News Weekly. Episode 431 with Abrar El Hiti and me, Micah Sargent. Recorded Thursday, April 2, 2026. IPhone hacking tools go public. Hello and welcome to Tech News Weekly, the show where every week we talk to and about the people making and breaking that tech news. I am your host, Micah Sargent, and I am joined this week by the wonderful Abrar Al Heati. Hello, Abrar.

[C]

Hello, friend. How are you?

[A]

I am exceptional. Thank you very much for that.

[C]

That's a great adjective.

[A]

Thank you. Thank you for people tuning into the show for the first time. Welcome. For those of you who are also welcome, we appreciate having you. This is the part of the show where we kick off with our stories of the week. These stories we find interesting and want to talk about. So that's what we're going to do here on the show. Abrar, could you tell us about your story of the week?

[C]

I would love to. So I'm going to talk about Meta and the Motion Picture association butting heads over how Meta runs its Instagram teen account. So first, let's take a step back to October real quick. So Meta rolled out an update to its teen accounts because, you know, obviously there's a lot of pushback about the health and safety of platforms like Instagram, which are very popular among teenagers. But what Meta had said at the time was in the same way that you might in a PG13 film, see some suggestive content or hear some strong language, that is essentially what Instagram teen accounts will be. So you'll, you'll get a little bit of kind of more adult oriented content, but it won't be as, as intense as for, you know, for people who aren't teenagers. And so they kept drawing this parallel and they kept bringing up PG13 movies and they kept, you know, it just seemed like a really good comparison point for Meta to say, hey, this is just like watching a PG13 film. So that means, you know, blocking suggestive and graphic content, strong language that's whether on an explore or feed or story. And then there's also a more strict limited content filter where you can. Parents can even have that even more scaled back if PG13 feels like a little bit too much because it varies. Some parents might be okay with a PG13 film for their teens, and some might not. How did the Motion Picture association respond? Not very well. They sent a true. Yeah, they were not about it. They sent a cease and desist letter to Meta, and they argued that using that label of PG13 could confuse parents and infringe its trademark. So I think a lot of companies with the heat that Meta faces, especially around teen safety and teen accounts on Instagram might not enjoy being lumped into this without their blessing. And surely the Motion Picture association felt that way. So this week, on Tuesday, it looks like Meta and the Motion Picture association came to an agreement. And so they have decided Meta has agreed to scale back those references to the PG13 film rating and also include a disclaimer that the Motion Picture association was not involved with those ratings. So I went and I looked at that page and right now, as far as I can tell, I mean, I don't know if this is the, I don't know if the update is coming later because I'm looking at the page and I still see lots of PG13 references and I don't see that disclaimer that the Motion Picture association is not involved. But this just came out like two days ago. This agreement just, you know, landed. So that's probably coming. But I, I was definitely amused when the Motion Picture association was like, absolutely not. Please don't involve us in this. And, and I think it just kind of continues to highlight this tricky path of, of how much does matter need to do to keep teens safe. And is this the right path? And of course, Metta was referencing surveys that done with parents and, you know, more than 90% of them were like, this is a great idea. This seems like a good fix. But, you know, it. I don't, I don't know if that, you know, remains to be true as this has rolled out. I don't know if it's fixed anything. I don't really talk to teens on Instagram, so I don't have a direct source into that. But, but I'd love to know what you think about kind of just this general effort. And one other thing is, you know, they always talk about age, age, predict technology as being kind of the next, the next step to ensuring that people are seeing what they need to be seeing. Depending on how old they are. And that's technology that still I feel like is rocky at best and also potentially invasive. So it's just. It's all very tricky. But yeah, I'd love to hear your thoughts on the PG13 comparison and anything you think about the Motion Picture Association's response.

[A]

Yeah. So firstly, I will say back before this news originally was released, Meta did reach out and offer a briefing. And I attended this briefing and learned about the Motion Picture choice here, that they would start putting these content labels. Here's the thing about it. I remember when this happened and then I remember when it was announced and then I remember when the MPAA responded. Yeah. And the way that I felt in that moment was so annoyed with myself because in all of the questions I asked, I never thought to ask, does the Motion Picture association of America know about this?

[C]

Right.

[A]

Because for me, that was just a given like, that I didn't see this. Right. Like, you would just not expect a company would go forth with something without sort of like clearing it with that. That was wild to me.

[C]

Yes.

[A]

So I think the. The concept of. Of coming up with this new way of doing things without consulting PAA fully or whatever.

[C]

Yeah.

[A]

Is wild. Now, that said, I do think that if the company had reached out and asked for permission to do this and maybe even what went as far as to work with the MPAA to dial in, what made sense, that could have been a good thing. I think that it is helpful and it is something that's been in our popular culture for long enough that it becomes simpler to understand what these different ratings might mean. So the concept, I think, is a great concept. The execution just absolutely fumbled the ball there. And honestly, again, I was shocked that they had not asked in the first place about this. That kind of blew my mind a little bit. You know, all of this, all these attempts at making social media, if not safer, more controlled and more sort of easy for a parent to move their child through the process. I think, like, that's. I celebrate that. But so often it feels like it is a. So often it feels like an attempt to just do the bare minimum.

[C]

Yeah, totally. Absolutely. I feel like the other piece of this is that personally, what I have also experienced on Instagram, and I'm obviously not a teenager, but in general that the safety elements, whenever I try to report something on Instagram, whether it's harassment or just anything that I feel like I'd rather not have that comment on a post. Instagram never agrees with me. It's always like, no we didn't find any issues with this. And so I'm like, so you clearly people are saying things that should not be, like, hate speech is being spewed and this. You don't think it's an issue. That makes me think about teen accounts where I'm like, okay, you say you're protecting people from things, but you know, there's, there's a lot of vitriol on, on social media beyond just any suggestive or graphic content that you might see on your Explore page. But what are those interactions look like? And are you actually flagging these things and, and making people feel safe? Because Instagram can be very hateful place. And I think that's something that maybe isn't addressed as much in these things, where it's like, not just about the content that you see or don't see, but what do those interactions look like? And are you actually listening to people when they say they feel uncomfortable with an exchange?

[A]

Wow. Yeah, that's. The fact that you have had issues being able to go through with this process is really upsetting that. Clearly, if the company doesn't put its money where its mouth is and doesn't sort of follow through with this promise, then that's going to be an issue. And like, I'm not surprised then to, to hear this ongoing argument, this ongoing discussion about the company's perhaps inability to, to protect the people on its platform, you know, with, with this agreement, this idea that it's substantially reducing references. Right.

[C]

Yeah.

[A]

It's kind of weird. Yeah. The idea that it doesn't have to completely get rid of them.

[C]

I agree. Yeah.

[A]

It's. It's like, why do it halfway or exactly, you know, a quarter of the way or what? It's just strange. It's very strange.

[C]

So it feels like one of those compromises where nobody actually ends up winning because it's like, well, the parents will probably be upset that their teens are still exposed to certain things, and the teens would be like, well, why am I just getting a little taste of this? Like, what. What is going on here? And so, you know, they'll always say is, we're refin this, we're going to keep working on it and, you know, making it, making it better. But it is a very strange in between. And I am just so curious how, how this will evolve and how people will continue to respond without those. You know, at least the Motion Picture association is thrilled to not be involved in this. But. But, yeah, we'll see what happens.

[A]

All right, let's take a quick break so I can tell you about Simply CX bringing you this episode of Tech News Weekly. When you think about the companies that are actually winning in tech, what do they have in common? Hmm, sure, great products, but more often than not, it comes down to how they make customers feel, how they make me feel, and how seamlessly everything works. Customer experience is the ultimate strategy to scale companies, and that's why Microsoft launched a new podcast called SimplyCX and why we recommend listening to it. Hosted by Nicole McKinley, Microsoft's global customer experience leader, SimplyCX features real, no fluff conversations with executives from companies like CarMax, TD bank and T Mobile, exploring the innovations shaping CX, breaking down how they're using AI data and smart design to completely reimagine how they connect with customers. If you're someone who pays attention to where tech is headed and how it's changing what customers actually expect, Simply CX is the show for you. The conversations are practical, they move fast, and you'll walk away with ideas you can actually do something with. New episodes drop every other Tuesday. Find Simply CX wherever you get your podcasts and follow host Nicole McKinley on LinkedIn to keep the conversation going. Thank you to SimplyCX for sponsoring this week's episode of Tech News Weekly. All right, we are back from the break, joined by Abrar Alheti, and we continue A surprise leak of Anthropic's Claude Code Source Code is giving the tech world a peek behind the curtain, and what's in there is fascinating writing for Ars Technica. Kyle Orland digs through the more than 4,512,000 lines of code and 2,000 plus files that were exposed, uncovering references to disabled, hidden and inactive features that paint a picture of where Anthropic may be headed next. Now we're talking about persistent background agents, an AI dream system for memory consolidation, a stealth mode for open source contributions, and yes, a virtual assistant named Buddy that looks like ASCII art with a tiny hat. It's a roadmap Anthropic probably didn't intend to share just yet, and it ra some genuinely interesting questions about the future of AI powered coding tools. Let's talk about what was uncovered in this leak. So the first thing is Kairos. This always on agent. It seems to be the one that's getting the most attention from folks. It's a persistent tool that's designed to keep running in the background even after you close Claude Code. Kairos would use periodic sort of tick prompts to check whether new actions are needed and it includes a proactive flag for surfacing things the user didn't ask for but might need to see. So you can think of it less as a coding assistant and more as a persistent AI coworker that's kind of checking in on the project and going, oh, you know, maybe you didn't ask about this, but I see that there's something wrong here. It's built around a file based memory system that carries context across sessions. A prompt hidden behind a disabled flag in the code says the system is designed to have a complete picture of who the user is, how they'd like to collaborate with you, what behaviors to avoid or repeat, and the context behind the work the user gives you. So think about it. It's not just kind of autocomplete, but a personalized coding partner that actually learns how you work. Now, we've seen a kind of a shift right from these AI companies where they're really going all in on coding. In fact, OpenAI closed down. Sora stopped with Sora, the tool for video creation that was sort of part social media, part video. And the Disney deal fell through and OpenAI then reportedly shifted its focus to focus on coding. We've seen Anthropic really take the lead on this. And of course Google with its Gemini tools doing much of the same, many different development environments, adding coding. And so I'm not surprised to see these innovations coming to, coming to sort of a focus on how they can be used in AI. But thinking about this, always on proactive tool, I'd love to see it for me, outside of coding, I would love to see this tool being used as a way to keep an eye on the work that I'm doing and offer suggestions like, it's a modern Clippy of code.

[C]

I was just thinking Clippy, that's the worst thing in the entire time. Clippy's grown up, man. Like, here we are.

[A]

Look at you, little buddy. Well, actually you're not a little buddy anymore. You're a grown man now.

[C]

Pretty powerful buddy.

[A]

Yeah, yeah. A grown, A grown paperclip. Now. What does a paperclip grow into?

[C]

Yeah, maybe you just could drop the Y. Just clip with like a capital clip.

[A]

Oh my God, yes. Oh, and it's still two P's. I love that C, L, I P P. Clip. What's up? Clip. Exactly.

[C]

That's a great ring to it. I'm surprised Melan's jumped on this. Microsoft. Come on, man.

[A]

Yeah, yeah, come on. He wears sunglasses now. He's clipped,

[C]

drives a Rolls Royce, man.

[A]

That thing Is, whoa, wow, I want to meet this guy. There's also another part of Kairos that is, I think, interesting. It's called Auto Dream and it's a fascinating thing. The name really does sort of match what it does when a user goes needle or tells Claude code to sleep. At the end of a session, the system enters a quote reflective pass over your memory files. And what we believe about humans and their, the, the. We really don't know for sure why we dream. We know that dreaming is important. I have to be careful because I will talk for 45 minutes about sleep science.

[C]

Oh, I love that next episode, man. Let's do it.

[A]

Yeah, exactly. So I'm gonna to quickly summarize this. We don't quite know why we dream, but we know dreaming is important because we know that our body fights to, our brain fights to keep us in REM sleep even when we could otherwise wake up. And so things like when you are in a dream and you're hearing an alarm in your dream or a cat meowing in your dream and you start dreaming about that when it's happening in real life, your body is trying, your brain is trying to keep you asleep instead of letting you wake up to that alarm or wake up to that cat meowing trying to get in. And so we have a belief that REM sleep is so important that our brains do what it can to keep us in it. So fascinating. While we sleep and dream, the thought is that we are consolidating things. We do kind of believe that sleep gives us the ability to store files sort of in longer term memory and kind of break down the information and the knowledge that we have. So it's no surprise that they're calling this Auto Dream whenever it comes to this because it's similar to what humans in theory do. The Claude code scans the day's transcripts for new information worth keeping, consolidates it to avoid duplicates and contradictions, and then proves prunes anything that's become outdated or verbose. The prompt also instructs the system to watch for existing memories that drifted. So this is an issue where users maybe tried to bolt memory systems onto their AI setups and it just gets filled with a bunch of nonsense or sort of gets pushed. It's like you're missing the point. You're missing the point. So you synthesize what you've learned recently into durable, well organized memory so that future sessions can orient things quickly. Maintaining useful, accurate context over time is difficult. And so that in particular is something that the company is trying to focus on now, these tools. Obviously, there's always new innovations coming out and people are trying to figure out what companies are doing next. There's been some belief that, ooh, what if claw. What if Anthropic did this on purpose? I disagree. I don't believe that the company did that because it is dangerous to put your plan out there before you've completed your plan. Right. Like that makes sense.

[C]

Totally. Especially in such a competitive landscape. I mean, the whole time I've just been thinking, how much is Anthropic freaking out on a scale of 1 to 10? And it's probably closer to the 10. I can't imagine any company in the AI space saying, hey, let's just like leak this and. And other people can take notes from here. Is it so, so, so competitive? Yeah, I agree with you there.

[A]

Yeah. And then a few more features outside of the sort of those main ones. The leaked code references something called Ultra Plan, which is a feature that would let OPUS level CLAUDE models. So that means for people who aren't familiar with all of this, there are different AI models that are less or more powerful. Opus is the more powerful model from Anthropic from Claude, and it would let them draft advanced plans that you can edit and approve. These will run for 10 to 30 minutes at a time. So that means where before. It's sort of like a prompt and response. This is something that can keep working in the background for a really long period of time. I have. Well, actually, no, we'll come back to that because I'm curious if you've used this tool yet. So some more tool or some more potential features. Voice mode, where you can talk to some AI systems. This would let you talk to Claude Code Bridge, which expands Anthropic's existing dispatch tool. Dispatch is the tool that lets you use your phone to ask the computer or the PC version or Mac version of CLAUDE to do stuff. And so it's just, just. It's basically remote sessions that you can control from a browser or mobile device. And then Coordinator, which is a tool for spawning and orchestrating software engineering tasks across multiple parallel workers communicating via websockets. What it means basically that you have an AI boss for all of your other AI tools that you're doing now. What I wanted to ask you. The Ultra Plan talks about running for 10 to 30 minutes at a time. One of my favorite features across all of the main AI tools is the sort of Research mode or Deep research or deep whatever. And basically what you can do is say, hey, I want you to go out on the web and look for this, that or the other. And the AI system will find a bunch of different sources, read a bunch of different sources, combine all that information and synthesize it for you. So one of the things that I did recently was ask it to look online and find the. This was around the holidays. Find the best gluten free sugar cookie that would hold, would retain its shape. Because that's been my problem with the gluten free version is that they don't retain their shape as well.

[C]

Yeah.

[A]

And so what I had it do was look for the best recipe that retains its shape, but also look at what people are saying and find out if there are any sort of tips or tricks that would make it so that you know you've got a tried and true recipe. So it kind of built its own recipe. It went out and looked across Reddit and you know, all over the place and then combined all that. I love that sort of tool. I was curious if you've ever made use of like the deep research or anything like that.

[C]

Okay. Listening to you, I'm realizing I'm deeply underutilizing these AI tools because, you know, I feel like a lot of times we think, I don't need this, I don't need that. But that is something that like, is actually a very useful thing, whether you're looking for cookies or any type of information, especially if it's just kind of aggregating it and giving it to you rather than just kind of generating something that doesn't make any sense. So that is very, very cool. I think that's something that I actually have to dip my toes in because that should. Sounds amazing.

[A]

Yeah, yeah, it's, it's. I mean, that's the thing is you can use it for so much. I needed my first place that I go anytime I need a product recommendation is Wirecutter. Yeah, Wirecutter didn't have the category I was looking for. So I set the task like, what do people say is the best blank? And with Claude, it'll typically have some follow up questions to help kind of narrow things down. And then yeah, you're like, you're sending a little, a little pal out into the world to collect all of that research for you and put something together. So I found that an indispensable tool for all sorts of stuff. And what I like about it too is that it's based in. I find that those tools are more based in reality because they're basing their answers on actual Stuff on the web as opposed to just their own knowledge and understanding.

[C]

Right. Not just building something, but like actually aggregating from those sources. That is right.

[A]

Correct.

[C]

Yeah, I support this.

[A]

Yeah. One thing I'll say one of our, our listeners said in the chat that they believe that this is a, a sort of leak from Claude or from Anthropic, saying I don't feel like there has been anything that magical revealed. It's kind of obvious how this would have to work. So I think they just want people talking about them more than open AI. And the special SA is still in the servers. I think that's a fair take.

[C]

It can be seen as a flex.

[A]

Yeah, yeah, yeah, exactly. It's a bit of a flex. And then sometimes it like some of the features that they're talking about is a little bit catching up. So those especially, I could see Claw or Anthropic choosing to say, don't worry, we're getting voice mode soon, we're working on it.

[C]

Right.

[A]

But then I'm just like, why not just say it?

[C]

Yeah.

[A]

Instead of doing a weird leak about

[C]

it, but we may never know.

[A]

Yeah, yeah, exactly. That's the other thing too is that we saw Anthropic working to have the code pulled from all of the places where it's been published. So I don't know, I'm of two minds about it for sure.

[C]

Could go either way. Absolutely.

[A]

Exactly. That is the second story of the week. Abrar's gonna stick around for our next one and then we'll say goodbye. But I wanna take a quick break to tell you about our next sponsor. This episode of Tech News Weekly brought to you by Zscaler, which the world's largest cloud security platform. The potential rewards of AI are at this point too great to ignore, but honestly, so are the risks. Loss of sensitive data and attacks against enterprise managed AI. Generative AI increases opportunities for threat actors, helping them to rapidly create phishing lures, write malicious code and automate data extraction. There were 1.3 million instances of Social Security numbers leaked to AI applications. ChatGPT and Microsoft. Copilot saw nearly 3.2 million data violations. It's time for a modern approach with Zscaler's Zero Trust plus AI. It will remove your attack surface, it will secure your data everywhere, it will safeguard your use of public and private AI, and it will protect you against ransomware and AI powered phishing attacks. Check out what Siva, the director of Security and Infrastructure at zora, says about using Zone.

[D]

AI provides tremendous opportunities, but it also brings tremendous security concern when it comes to data privacy and data security. The benefit of Zscaler with ZIA rolled out for us right now is giving us the insights of how our employees are using various gen AI tools so ability to monitor the activity, make sure that what we consider confidential and sensitive information according to companies data classification does not get fed into the public LLM models, et cetera.

[A]

With zero Trust plus AI, you can thrive in the AI era, stay ahead of the competition and remain resilient even as threats and risks evolve. Learn [e-mail] Security that's Zscaler.com Security thank you Zscaler, for sponsoring this week's episode of Tech News Weekly. All right, back from the break, as I mentioned, joined this week by Abrar Alheti and this next story. It's a little scary. Update your phones, everybody. A powerful set of iPhone hacking tools called Dark Sword has leaked online, and it's a big deal. Security researchers have uncovered a series of cyber attacks targeting Apple customers around the world using two advanced toolkits, Karuna and Dark Sword, that have been used by both government spies and cybercriminals to steal data from people's iPhones and iPads. The Dark Sword tools were published on GitHub, making them available to essentially anyone, and they're capable of hacking devices running iOS versions as recent as 18.7. Apple has since rushed out a patch for older devices, but with nearly 1 in 3 iPhone and iPad users still not running the latest software, potentially hundreds of millions of devices remain at risk. Lorenzo Franceschi Bikiari and Zach Whitaker have been reporting on this over at TechCrunch, and of course we'll include links in the show notes to these stories. But but let's kind of kick off by talking about Karuna and Dark Sword. These are two separate advanced hacking toolkits, and they each contain a range of exploits, all needed to break into iPhones and iPads and steal a person's data. You could steal messages, browser history, location data, and if you have a crypto wallet, it's possible that cryptocurrency could be stolen as well. Security researchers say Karuna's exploit targets devices running iOS 13 through 17 and then dark Sword. Why it's getting more attention and sort of making the headlines is because it does target recent versions 18.4 through 18.7. Keep in mind, 18.7 was just released in September of last year. So again, more people are on that. That more immediate threat to the general public is Dark Sword, and that's also because someone out there posted part of its code on GitHub, making it easy for anyone to download and deploy. The principal researcher at mobile security firm lookout told TechCrunch that Dark Sword is now essentially plug and play. Researchers posting on X have already tested the leaked tools by hacking into their own Apple devices running vulnerable software. People, I think a lot of times don't know how these tools work. They just hear, oh, there's something out there that can break into my iPhone. I find this fascinating. It's called a watering hole attack, which means that it's indiscriminate. You know, it'll affect anyone who comes, comes around it. Victims can be hacked simply by visiting a website that's hosting the malicious code, including legitimate websites that have been compromised by attackers. Once a device is infected, the exploits chain together multiple iOS vulnerabilities, which give hackers full control of the target's device, allowing them to siphon private data and upload it to a server. They control these hacking tools written in HTML and JavaScript, so they're easy for anyone to configure and host. And TechCrunch confirmed that they've seen the tools, but declines to link to the GitHub repository, given the potential for misuse. I am curious, have you ever had to do these exploits, do the hacking tool, does it ever cross your mind? Does it ever freak you out?

[C]

It freaks me out, and at the same time, I'm like, another one. It's just like, it's like, okay, the sun is shining. Like, at this point, it's like, it's just another day. And it's actually sad that that's the reality of, like, okay, here's another vulnerability. But when it's this widespread, I mean, you mentioned the fact that a lot of people have iOS 18 because, you know, it takes a while for people to upgrade to the latest software. And some people might not be excited about Liquid Glass. I promise you guys, it's not bad. Update iOS 26, it's worth it. But, but, yeah, when something is so, so widespread and when there's nothing that you could necessarily be doing wrong, to be a victim of this is. It's, it's not like clicking on a spammy text that you're getting. This is just visiting a website that's been compromised. And that's, that's what makes it so scary. So it's like, yeah, I, I think about it, I see these headlines, I cringe at the reality. And then I'm like, well, what are we going to do about it. And it's kind of like, it's just like a sad response, but it's like genuinely, what, what answer is there to, to this reality where, you know, people can just Post this on GitHub and anyone can have access to it.

[A]

Yeah, yeah. I mean that. You are dead on with that. It is, it's frustrating because what do you do? Right? And especially if these tools can be placed on, placed on sites that someone visits. You know, just like a regular site that someone visits. If you don't know, then you don't know until you know. And when you know, it's too late.

[C]

Yep, exactly.

[A]

And yeah, that's very frustrating. Now we do believe that at least part of one of the tools were originally developed by Trenchant, which is a hacking and spyware unit within the US defense contractor L3Harris. So we understand that this is a company that sells exploits to the US Government and its closest allies. Kaspersky also linked two of the exploits in Karuna to Operation Triangulation, which is a sophisticated and what we believe to be government led cyber attack carried out against Russian iPhone users. Somehow these exploits made their way from Trenchant into the hands of Russian spies, Chinese cybercriminals. It could be through intermediaries in the underground exploit market. And honestly, we've seen this before. These powerful hacking tools are developed under tight security restrictions. They're developed with lots of resources at play because they're government backed. But then unfortunately they make their way out into the wild. The most notable precedent was in 2017 when an NSA developed exploit for remotely breaking into Windows computers leaked online and then was used in the WannaCry ransomware attack which hit hundreds of thousands of computers worldwide. We don't know as much with Dark Sword. Researchers have observed attacks targeting users in China, Malaysia, Turkey, Saudi Arabia and Ukraine, but it's unclear who originally developed it, how it ended up with different hacking groups or or who ultimately leaked it online. Now one question you might also had is why is GitHub keeping the code up? GitHub told TechCrunch that it has not taken down the leaked Dark Sword code and intends to preserve it for security research. Online safety counsel Jesse Gurachi explained that the platform's policies prohibit posting content that directly supports unlawful activity accusations excuse me, supports unlawful active attacker malware campaigns, but added that they do not prohibit posting source code that could be used to develop malware or exploits, as the publication and distribution of such source code has educational value and provides a net benefits to the security community.

[C]

What a fascinating take huh.

[A]

Yeah, I'm trying. So here's the thing. From a practical sort of logical sort of objective standpoint, I get the idea of wanting to have tools available or wanting to have this code available to security researchers. My problem is I don't think that what the council has said lines up with the actions. It says the policies prohibit posting content that directly supports unlawful active attacks, hack or malware campaigns.

[C]

Yeah, ding, ding, ding.

[A]

Yeah, yeah. Huh. But then says it's okay if the code could be used to develop malware or exploits. What? They do not prohibit posting source code that could be used to develop malware exploits. But we've seen this being used. So anyway, yeah, my point is, I don't see why this code is still up there, but it is. What can we do? Bottom line is straightforward. Update your iPhone or your iPad. If you're running anything older than iOS 18.7.7 or 26, your device is potentially vulnerable to attacks that are now. And this is the big point, trivially easy to execute if you can't update or if you don't want to. Okay, turn on lockdown mode. Turn on lockdown mode.

[C]

Just stop using your phone. It's fine.

[A]

Yeah, yeah, yeah. Put it away. Put it in lockdown mode. That means put it in a safe and forget about it. No, if you have automatic updates enabled, then you should receive the patch without needing to do anything. But hey, go into settings, go into general, go into software update, let that thing load and get that update quick as possible. That's how I feel. Abrar, thank you so much for being here with us today. It's always a pleasure to get to chat with you. I appreciate your stories of the week, week and your time. If people would like to follow you online and check out all the great work you're doing, where should they go to do so?

[C]

I am on Instagram at Abrar Alheiti. No spaces, no dashes. Also on Twitter, alheiti_3 and you can find all my stories on cnet.com and thank you Maika so much. Always a pleasure.

[A]

Always a pleasure. Bye bye.

[C]

Take care.

[A]

All righty, folks, we're going to take another quick little break, but then we'll be back. I want to tell you about Club Twit at Twit TV Club Twit. When you head to the club at that URL or using the QR code in the top corner there, you can become a member of the club. $10 a month to become a member of the club. We also have yearly plans joining the club gets you access to every single one of our shows ad free. Just the content. You also gain access to our special feeds. We've got a feed that is all about our behind the scenes moments, so perhaps there was one of those today for Tech News Weekly as we kicked off the show. You also have a feed that has our live coverage of daily tech news events and a feed that has our special club Twitch shows like My Crafting Corner, Stacy's Book Club plus so much more. If that's not enough, well there's also that warm fuzzy feeling knowing that you're helping to support the work we do here on the network. But there's also a special invite that you will be provided to our members only Discord Server A fun place to go to chat with your fellow Club Twit members and those of us here at TWiT. If all of that sounds good to you, TWiT TV Club TWiT to check out. We would love, love love to have you in the club. So be sure to head there Want

[B]

to make the most of your tax refund file with TurboTax on intuit credit Karma. They help you get your biggest refund and then we help you do more with it with a personalized plan designed to help you hit your money goals. Start filing today in the Credit Karma app.

[A]

All righty folks, back from the break and I'm rounding things out with a quick little story of the week. We k off the show talking about Meta and its MPAA ratings. Meta has had quite a time in the past week. It may have just become a turning point for social media accountability. We've talked in the past about the sort of big tobacco moment for social media, and that continues on. In the span of two days, juries in New Mexico and California delivered back to back verdicts against Meta. And in that California case, it was also against YouTube over the harm their platforms caused to young users. Cecilia Kang and Eli Tan reported on both cases for the New York Times, and these two pieces together paint a picture of an industry that is for the first time facing real legal consequences for how its products are designed. The New Mexico jury ordered Meta to pay $375 million for misleading consumers about platform safety and enabling sexual exploitation of minors. One day later, a Los Angeles jury found Both Meta and YouTube negligent in a bellwether social media addiction trial, awarding $6 million in damages to a young woman who says she became hooked on the platforms as a child. The dollar amounts are different, 375 million versus 6 million but the implications, frankly, similar juries are now willing to hold Big Tech account accountable for the way their products are being shown to affect kids. When it came to the New Mexico verdict, this was on March 24th. It found that Meta had violated New Mexico's consumer protection laws, doing that by misleading users about the safety of its platforms. The state's attorney general filed the suit in 2023, arguing that Meta's lax safety protocols allowed sexual predators to contact minors on Instagram. And now, in order to build this case out, these investigators posed as underage users to lure online predators showing these real instances of solicitation. It described Instagram as a breeding ground for sexual exploitation. And the six week trial featured testimony from teachers, from investigators, from whistleblowers who spoke about safety concerns on Meta's platform. Again, Meta ended up having to pay through or the jury has ordered Meta to pay. Excuse me. The judge would have ordered meta to pay $375 million in damages. He said that they would actually be asking the judge for additional financial penalties. And that is scheduled to start May 4, where he plans to push the court to force actual design changes to Meta's app. So this is about more than just money. They want to. Well, I mean, ultimately is it, but they want to also get Meta to, to change the way that its apps are designed. Meta, of course, said it would absolutely be appealing, saying we will continue to defend ourselves vigorously and we remain confident in our record of protecting teens online. As far as the California case goes, again, this was focused on one person. Arguably, this is the more consequential case because of the legal theory that it tests. The personal injury trial is the first of its kind to go before a jury and expected to influence the outcome of thousands of similar lawsuits that are pending across the country. That's the big thing. You know what we talk about when we come to legal rulings, it's precedence and the precedence is being set. The plaintiff, identified in court by her initials, filed suit in 2023 against Meta, against Snap, against YouTube and against TikTok, said she began using YouTube at age 6 and Instagram at age 9 and claimed the platform caused personal injury, including body dysmorphia and thoughts of self harm. TikTok and Snap both settled before the trial for undisclosed terms. So it was just meta and YouTube that were there in the case and continue to remain as defendants. This is the thing where we looked at the legal playbook of big tobacco, arguing that these companies created addictive products that harm, harmed users. And there's also the key legal strategy, which is about product design, not product content. So that way, Section 230, which would have shielded the companies, was not part of the process. Because of section 230, these platforms are not responsible. Right. For the content that's on there. So they had to send, say, you know what? We're not looking at the content. We're looking at the way you set up this stuff in the first place to make it more addictive. This is just the start, of course. I want to mention something that I thought was kind of interesting. On March 25, the jury found both companies liable. Right. All but two jurors determined that Meta and YouTube were negligent in designing their platforms and that their products harmed the young individual. Meta was assigned 70% of responsibility for the harm. YouTube was responsible for 30%. The compensatory damages came to $3 million. Then came the punitive damages phase. And here we go. This is one of the more memorable courtroom moments. Lanier, who is one of the. The lawyers, held up a jar of M and Ms, saying, each piece of candy represented a billion dollars of the company's value. You can take out a handful and not make a difference. Difference. You can take out two handfuls and not make a difference. YouTube's lawyer took a different approach, apologizing directly to the young woman, saying, we are sorry for the things you have suffered. We at YouTube truly hope there have been things at YouTube that have enriched your life and allowed you to express yourself. The other lawyer responded, saying, a lawyer apology is not the same as accountability. Cracked the shell off of a single blue and Eminem with his teeth and said, this is like $200 million. They do not want to feel the pain for what they did. So that I think there's a lot of drama, which I think is really fascinating. But there's more to go, more to understand, more to figure out as the company continues, as these companies continue to defend themselves, but as we continue to look at the effects that social media has on, frankly, anyone, but in particular our youth and whether the argument holds weight that these tools, these tools, these networks, these platforms are damaging to anyone and in particular, kids. Folks, that is going to bring us to the end of this episode of Tech News Weekly. I want to thank you so much for tuning in this week. It's always a pleasure to get to bring you this show. Show. If you'd like to subscribe to the show, if you're not, you can head to Twitter TV TNW to subscribe to the show. Audio, video formats, you can also follow me online ikasargent on many social media network or head to Chihuahua Coffee, that's C h I H u a h u a Coffee where I've got links to the places I'm most active online. Be sure to check out my other shows that'll publish today, iOS today and hands On Apple. And of course you can check out my show Hands on Tech, which publishes every Sunday. We will be recording new episodes at. Yeah, we'll be recording new episodes for the month of April, so be sure to tune in then. Thank you so much. And we'll catch you again next week for another episode of Tech News Weekly.