OpenAI Faces Lawsuits, Anthropic Warns of AI Worms as Google Patches 37 Chrome Flaws

Malwarebytes Labs published a weekly security review covering events from October 12 to October 18, 2026. The report lists topics including software vulnerabilities, artificial intelligence risks and data privacy breaches. Organisations relying on mainstream software and AI tools are mentioned in the context of these reported events.

Root cause

The report lists several security issues. Google fixed 37 security flaws in its Chrome browser, including seven critical bugs. A Windows flaw was noted as already under attack. Other issues include data exposure in the Eiliko robot companion and sensitive data sharing by Grindr users through ad auctions without valid consent.

Attack path

The source lists various threat vectors. Scammers use “spray and pray” job applications. Fake Calendly pages impersonating Meta Careers steal Facebook and Google logins. The FTC alleges a sextortion “help” firm took $60 million from victims. Anthropic warns AI worms could spread across smart devices. Police received a fake murder tip from Anthropic’s Claude AI.

Affected versions

• Google Chrome users with outdated versions are vulnerable to seven critical bugs.
• Windows users face risks from a flaw already under active attack.
• Grindr users experienced sensitive data sharing through ad auctions without valid consent.

Mitigation

• Update Google Chrome to the latest version to patch critical vulnerabilities.
• Install Windows updates immediately to address the actively exploited flaw.
• Verify the authenticity of job offers and career pages before sharing credentials.
• Review privacy settings on dating and social applications to limit data exposure.

What it means for organisations

Teams usually need to assess whether their current software inventory includes the affected Chrome and Windows versions. Check whether third-party vendors using AI tools have adequate safeguards against data leakage or autonomous worm propagation. Verify that employee training covers the latest social engineering tactics, such as fake career pages. Ensure incident response plans account for rapid credential theft and data auction scenarios. Communicate risks to legal and compliance teams regarding privacy violations.

Background: Social engineering

Isolate the affected device immediately to stop data exfiltration. Change all credentials from a clean device, not the compromised one. Notify your security team and preserve logs. Review access patterns for anomalies. Implement multi-factor authentication to prevent recurrence. Document every action for forensic analysis.

Read the full guide: Social Engineering Response: Containment and Recovery Steps

What to do and how to stay safe: Google Chrome

• Verify that all corporate browsers are updated to the latest stable release.
• Monitor network traffic for unusual device-to-device communication patterns indicative of AI worms.
• Train staff to recognise impersonation attempts in recruitment and scheduling links.
• Audit third-party data sharing agreements for consent compliance and privacy risks.

General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which browser vulnerabilities were patched in October 2026?

Google fixed 37 security flaws in Chrome, including seven critical bugs, according to Malwarebytes Labs.

Are AI worms currently spreading across smart devices?

Anthropic warns that AI worms could spread across smart devices, but no active outbreak is confirmed in the report.

How much money did the sextortion firm allegedly take?

The FTC alleges the sextortion “help” firm took $60 million from victims, as reported by Malwarebytes Labs.