Your AI chats are courtroom evidence, the EU calls ChatGPT a search engine, attackers poison AI memories, a private hospital pays 500k (a public one wouldn't), and why cyber isn't a campaign issue.
In this edition
- 01Your AI chats aren't private. They're already being used in court.
- 02The EU just classified ChatGPT as a search engine. The clock is ticking.
- 03AI agents remember now. Attackers have learned to poison what they remember.
- 04A hospital paid 500,000 euros for a breach. A public one wouldn't have.
- 05Cybersecurity shouldn't be a campaign issue. Here's what 100 public audits taught me.
Get the next GRC Brief in your inbox.
Subscribe to The GRC BriefYour AI chats aren't private. They're already being used in court.
You might tell a chatbot things you would not tell your closest friend. The Washington Post reported this week that those conversations are already turning up as evidence, citing chatbot logs used in twelve court cases over the past two years. The reason is simple and easy to forget: a conversation with ChatGPT or Claude carries none of the legal privilege that protects what you tell a lawyer or a doctor. Prosecutors and opposing counsel can subpoena it. OpenAI disclosed the contents of more than 80 user accounts in the second half of 2025, over four times the year before. And deleting does not save you: in the New York Times copyright case, a judge ordered OpenAI to preserve chat logs, including ones users had asked it to erase, overriding the deletion the company had promised under GDPR. Its own policy also lets reviewers refer conversations to police when they see a credible threat.
Source: Malwarebytes · via The Washington Post, 2 Sep 2026
My take
The instinct to treat a chatbot as a private confidant is exactly the trap. Strip the intimacy away and the truth is boring: ChatGPT is a cloud service run by a company that logs your inputs, retains them, and hands them over when a court, or its own policy, says so. It is closer to email than to a diary, and email has been discoverable for decades. The mistake is not using AI, it is forgetting what it is.
For your organisation this is not a personal-privacy footnote, it is a records problem you already own. Every one of those 1,200 unofficial AI apps I mentioned a couple of weeks ago is now a repository of discoverable business records, potentially subject to legal hold, and possibly sitting outside your retention and classification rules entirely. If a regulator or a litigant asked you to produce, or preserve, everything your staff have typed into AI tools, could you? Treat AI chats as what they legally are, corporate records on someone else's cloud, and govern them accordingly.
The EU just classified ChatGPT as a search engine. The clock is ticking.
On August 31 the European Commission formally designated ChatGPT a Very Large Online Search Engine under the Digital Services Act, alongside Reddit and Roblox as Very Large Online Platforms, each having declared more than 45 million monthly EU users. The label is the interesting part. The EU has decided to regulate an AI chatbot as a search engine, fitting a 2025 technology into a 2022 category, and with the label comes a serious compliance apparatus. By January 2027, these services must assess and mitigate the systemic risks their algorithms create, illegal content, harm to minors, effects on mental well-being, threats to fundamental rights, electoral integrity and public security, and open themselves to independent audits and researcher scrutiny. The whole apparatus targets the product's effect on society, not its security.
Source: European Commission · DSA designation, 31 Aug 2026
My take
The story everyone told this week is "big AI gets regulated," which is true and dull. The sharper detail is the category. Calling ChatGPT a search engine is the sound of regulation stretching a decade-old rulebook over something it was not written for, and it will not be the last time, because the alternative, a bespoke regime for every new kind of AI, moves far slower than the technology. Expect more of this awkward retrofitting, and expect the edges to be litigated.
The substance is not about their security, which is already better than almost any organisation's. It is about the product's effect on the people using it. A generative model now has to formally assess and mitigate how it spreads illegal content, harms minors, distorts elections and erodes mental health, with independent auditors and researchers about to get access to check the work. That is a new kind of demand, not is your system secure, but what is your system doing to the public. It is the first time a regulator has made a generative AI account for its effect on society rather than its uptime, and how ChatGPT answers by January is the real story, even if the obligation itself will never reach most organisations.
AI agents remember now. Attackers have learned to poison what they remember.
AI agents have started to remember. Unlike a chatbot that forgets when the window closes, an agent with long-term memory carries information from one session into the next, learning preferences and past outcomes to get better over time. Researchers, and now attackers, have found the catch. Memory poisoning plants false or malicious information into that stored memory, and because it persists, the agent recalls and acts on it days or weeks later. When the agent can also use tools, that can mean choosing a resource, following an instruction or taking an action an attacker planted. The vectors are mundane, a hidden note in an email, a code comment, a product description the agent reads and quietly files as a preference. This is not fringe: academic attacks report injection success rates above 90 percent, and OWASP added memory and context poisoning to its 2026 Agentic AI Top Ten. As the researchers put it, securing the prompt in front of the system is no longer enough, you now have to protect what it carries forward.
Source: The Conversation · AI agent memory poisoning, 3 Sep 2026
My take
This is a genuinely new box for your threat model, and it deserves one. For two years the AI attack surface was the prompt, the thing in front of the model. Memory moves the target behind it, into persistent state, and that changes the risk from a momentary trick into a durable implant. It is the same lesson as the passkey persistence attack I covered last month: the dangerous move is not the one that ends when the session does, it is the one that quietly stays.
So if you are deploying agents with memory, and after last week's numbers you probably are whether you decided to or not, the questions change. What can write to the agent's memory, and is any of it untrusted input like an email or a web page? Can you inspect, sanitise and roll back what it has stored? OWASP has already codified this as a top-ten agentic risk with named defences, so it is not speculative. And yes, the tools that detect poisoned memory are themselves AI, which is the loop we now live in, using AI to defend against AI, forever. That is not a paradox to resolve, it is just the job now.
A hospital paid 500,000 euros for a breach. A public one wouldn't have.
France's data protection authority fined the Hôpital privé de la Loire, a private hospital in the Ramsay Santé group, 500,000 euros after a 2025 breach exposed the records of more than 727,000 people, patients and their listed relatives. Read the failures the regulator found, because there is nothing exotic in them: external users, including visiting physicians, could log in with no VPN and no multi-factor authentication, a single compromised account could reach every patient's file, and there was no real-time monitoring, so the attacker roamed the system and exfiltrated data over several days unseen. These are not advanced-persistent-threat problems. They are the fundamentals, missing. And there is a quieter point in who paid: this was a private hospital. Under French law, the data protection authority cannot levy this kind of fine on a public body, only warnings and reprimands. A public hospital with identical holes would have faced no financial penalty at all.
Source: BleepingComputer · CNIL fine, Hôpital privé de la Loire, 3 Sep 2026
My take
Look at what actually failed, because it is the whole thesis of this newsletter in one sanction. No MFA. No VPN. No access segmentation. No monitoring. Not a zero-day, not a nation-state, just the boring controls that were never put in place, and 727,000 people paid for it. Every framework in the world would have flagged these. The gap was never knowing what to do. It was doing it.
Now the part that should bother anyone who cares about where the risk actually concentrates. The private hospital got a half-million-euro fine and a public shaming. A French public hospital, holding data at least as sensitive, faces no such fine by law, and the French state has not even transposed NIS2 for its own bodies. So the entities under the least enforcement pressure are often the ones holding the most sensitive citizen data, compelled, not given. That inversion is the bridge to the last item, and it is not only a French problem.
Cybersecurity shouldn't be a campaign issue. Here's what 100 public audits taught me.
To close, a piece of my own, and it is not only about France. As the French presidential campaign opens after a summer of public-sector breaches, the tax authority alone was hit three separate times, I argued that cybersecurity must not become a campaign marker. Not because it should be ignored, but because a differentiation marker invites each new administration to redraw the roadmap, and cyber roadmaps now run for nine years, post-quantum migration reaches to 2035, longer than two presidential terms. I draw on the roughly one hundred audits of public administrations I supervised in Wallonia between 2021 and 2024, where the pattern was clear: the audits got done, but a mayor cuts ribbons in front of a new sports hall, not in front of network segmentation, and when the sponsoring minister left, the reports lived on as PDFs. The argument holds for any country that runs elections.
Source: My full analysis · christophemazzola.fr
My take
I will keep this short because the argument is in the piece, but here is the core, and it applies wherever you vote. Cybersecurity has no real ideological divide. Nobody runs on weaker encryption or slower patching. So when it becomes a campaign marker, the only thing a candidate can add is a rebrand, a new agency, a redrawn scope, a re-announced budget, and every rebrand costs twelve to eighteen months of re-familiarisation against deadlines that do not move. AI is different, it has genuine divides worth debating. Defensive cyber does not.
What the public sector needs is not a doctrine per election, it is execution across them: multi-year funding that survives the annual budget fight, milestones reported publicly to parliament rather than buried in a committee, and ideally a cross-party commitment to a few dated deadlines nobody reopens. I have watched, in Wallonia, what happens without that sponsorship, good audits turning into shelved PDFs. The full argument, with the numbers, is linked. If you work anywhere near government, it is the read I would most want in your hands this week.