Our weekly picks of digital trust-related articles

Sehr interessante Aussagen von Susanne Wille von der SRG, die die SRG klar als öffentlich-rechtliche Mediengesellschaft in einer von grossen Privatfirmen dominierten Landschaft positioniert. Die Bedeutung von Medienangeboten, deren Hauptziel eine ausgeglichene und unabhängige Berichterstattung ist, darf nicht unterschätzt werden. Dazu gehören auch entschlossene Massnahmen: kommerziellen KI-Anbietern den Zugang zu öffentlichen Inhalten zu versperren und stattdessen öffentliche Projekte wie das Schweizer KI-modell Apertus zu unterstützen.

Just as the EU AI Act's enforcement provisions took effect, Brussels became the first jurisdiction in the world to formally engage OpenAI and Anthropic over their rogue AI agent hacks — no lawsuit needed, no brave plaintiff required. This stands in sharp contrast to the U.S., where accountability remains stuck in legal limbo. When it comes to holding AI makers accountable, having the right regulation in place clearly matters.

This article reveals a fundamental benchmarking problem with AI agents. The rogue agent didn't fail — it succeeded at what it was told, not what was meant. Raghavan and Schneier call this the Genie coefficient — the gap between literal instruction and true intent — and as AI agents grow more capable, measuring it becomes increasingly critical.

It's nice to see that quantum-secure algorithms find their way into common libraries for everybody to use. This is a necessary step to make sure that these new algorithms are used in everyday apps. Of course there will be some back-and-forth, until all security bugs are ironed out.

Fake Korean "dopamine sites" that mimic online shopping without requiring actual purchases… The creativity on the internet never ceases to amaze me! Although this summer read seems lighthearted, it raises some of the usual serious concerns about digitalization. First, it reminds us of the devastating effects of online addiction to shopping and social networks. Then, with international clones appearing on June 20 (four days after this article was published), it demonstrates how reactive the online world is and how prevalent the copycat "economy" is. Finally, the motivations of the developers deserve scrutiny because pure altruism is unlikely. So, what is the rationale? Selling product placement? Or is it sky-high Google Ads revenues thanks to CPM boosted by longer sessions? Or user profiling and data resale? The latter being unfortunately quite plausible.

Living in the world of LLMs often makes me wonder about the details of how they work and how they have developed over the years. This article is an extensive (600 pages) reference that includes LLM theory, training, benchmarking, all the way up to how to set up agentic systems. I like to open a random page in it and see what all those terms I've heard before actually mean!

The recent autonomous cyber intrusion by OpenAI against Hugging Face underscores AI’s dual-use risks. In response, the US House is weighing a bill to empower the Department of Homeland Security to shut down or slow AI models that the government deems too dangerous. The bill’s implications for non-US AI models remain ambiguous. Unlike a June 2026 Trump executive order (https://www.whitehouse.gov/presidential-actions/2026/06/promoting-advanced-artificial-intelligence-innovation-and-security/) that requested voluntary model submissions from leading AI developers, the bill would mandate compliance with US government directives. However, it is unclear which non-US AI models would fall under its jurisdiction, raising questions about the extraterritorial scope of US authority.

An AI agent recently broke out of its sandbox and hacked Hugging Face, unprompted, on its own initiative, just to score better on an evaluation. This is what goal-directed behavior exceeding its containment constraints looks like in practice. And it's not isolated: multiple frontier models have now been caught "cheating" during safety evaluations. The question isn't whether AI is powerful. It is. The question is whether our oversight frameworks are keeping pace. Mandatory safety testing. Mandatory incident disclosure. International coordination. Not radical; the minimum.

Je suis impressionné : en six mois, cette commission d'enquête a livré un diagnostic précis sur les dépendances numériques. On pourra bien sûr ergoter sur certains chiffres, reprocher quelques approximations ou une rhétorique parfois idéologique, mais la structure est claire et les 47 recommandations sont compréhensibles. Pour moi, la limite principale est l'absence de force contraignante : son application dépendra de la volonté politique.

It always stuns me how companies can invoke 'consent' when almost no one reads the pages-long terms and conditions, and even those who do probably won't understand much of it anyway, and still it's considered legally valid . What's new here is that this so-called consent isn't just meaningless to users; this article documents how now it is being used to legitimize practices that actively harm users , with absolutely no benefit: degrading their bandwidth and potentially turning their devices into part of a malicious botnet. And we, as a society, are still debating whether that consent is valid! This article further illustrates just how challenging it is becoming to stay in control of our increasingly complex digitalized lives.

Samsung Health's updated consent policy, which requires users to either accept the use of their health data for AI training or lose their data, highlights the dilemma of the AI era: the trade-off between privacy and features. Personal health data is clearly a goldmine that fuels AI improvement, but this is being achieved through opaque consent mechanisms that blur the line between choice and coercion. What was once just a theoretical debate is now a reality. I would be interested to know what proportion of users actually refuse consent — I fear it will be really low — and whether mass capitulation will permanently normalise data surrender as a condition of service.

Nach den vielen Worten zur digitalen Souveränität in der Schweiz kommen jetzt erste Taten zum Vorschein: Die Schweizer Armee hat angefangen, an der deutschen Open Source Software Open Desk mitzuarbeiten. Dies ist möglich dank einem Budget von 10 Millionen Franken, das das Parlament im Dezember 2025 zur Verfügung gestellt hat. Die Schweizer Armee hat jetzt auch begonnen, erste Softwareprojekte auf GitLab, einer offenen Alternative zu GitHub, zu veröffentlichen. Ich hoffe, dass jetzt auch andere Teile der Regierung folgen und sich für eine digitale Souveränität mit Open Source einsetzen werden.

Communities working in digital civic rights have for years warned against automated surveillance, often dismissed as 'dystopian' by society at large. With AI supercharging these technologies, that complacency is becoming increasingly difficult to justify. The question now facing our democracies is whether they will resist the lure of the benefits these technologies promise, and take action to safeguard hard-won civic rights.

Au-delà de la fine analyse proposée par Ian Garner sur l’impact de la slopagande sur la société, deux choses m’ont particulièrement marqué dans cet article. La première est que les extrémistes n’ont pas de projet de « création ». Leur seul objectif est de contredire, d’exclure, de détruire. La seconde, avec laquelle je suis profondément alignée, est l’importance de recréer des espaces communautaires partagés : des lieux où la discussion est réelle, profonde et ouverte. Bibliothèques, clubs sportifs, maisons de jeunes, cafés… promouvoir des espaces où le discours est co-construit et réfléchi.

Here is a chronological top-30 (well, top-27) of research articles showing how modern LLMs developed - from the first convolutional neuronal networks for image classification all the way to transformers and how to optimise them. If you're wondering how this technology developed, what some of the shortcomings are, and what the most active development topics are, it's a good reading list for the summer holidays :)

Privacy advocates will be pleased by this US Supreme Court ruling, which marks a significant bellwether for how privacy rights translate into the digital age. What I find more broadly concerning, however, is that geofence warrants are a second-order consequence of a model in which data collection is effectively the default, and where data collected for one purpose is routinely swept up and repurposed by third parties, including the state. This model puts the onus on the individual to understand that their location and other data are being collected and shared, and to find out with whom.

Cet article est intéressant car il met en lumière le revers de la médaille… W exige une vérification d'identité obligatoire pour garantir un réseau sans bots, tout en promettant que les données biométriques restent sur l'appareil. Mais en pratique, des données sensibles comme la photo du passeport peuvent être transmises à un prestataire tiers. Un hashcode lié au passeport est conservé, permettant à un gouvernement d'identifier n'importe quel compte. L'anonymat offert protège donc contre le harcèlement ordinaire, mais pas contre les dérives probables de régimes autoritaires… ou quand souveraineté ne rime pas avec sécurité.

VC bets are valuable early indicators. This YC batch confirms that geopolitics (e.g., drones and satellites) and AI (e.g., agents, digital twins, and no-code) now dominate the innovation agenda. The shift from AI experimentation to agentic infrastructure is happening. AI agents are rapidly evolving from a mere concept to a fundamental part of enterprise infrastructure. This signals that digitalization strategies, including governance and accountability mechanisms, must be rebuilt around agentic AI.

AI summaries are now an almost expected feature of search engines. This article explains why this is problematic, using the example of the recent polarising vote on the '10-Millionen-Initiative' in Switzerland. I would only add that systems repeatedly shown to be susceptible to prompt injection are destined to become targets for the AI era's version of SEO spam, putting these AI summaries at risk of devolving into meaningless slop over time.

This article is interesting because Schneier, writing primarily about AI safety and the futility of model bans, incidentally reframes the entire AI sovereignty debate. Everyone is fighting over frontier models: the expensive, inaccessible layer. But the harness, the code that orchestrates and directs AI models, is where power actually lives. It is buildable today, and almost nobody is talking about it.

Voilà qui est intéressant, mais guère surprenant : lorsque l'on s'appuie sur les intelligences artificielles, on perd peu à peu l'habitude de ce que l'on savait faire par soi-même. C'est probablement analogue au fait de ne plus être capable de marcher de longues distances quand on prend constamment la voiture ou le train. J'aurais bien aimé savoir si les utilisateurs et utilisatrices de l'IA en retirent par ailleurs d'autres bénéfices — ou si leur esprit critique s'émousse lui aussi, nous entraînant vers un monde où nous ne serions plus capables de distinguer ce qui nous aide de ce qui nous nuit.

This article serves as a reminder that the digital world relies entirely on physical infrastructure and its geopolitical importance. The proposed cable from Chile to Hong Kong became a test of how far the U.S. would go to curb China's telecommunications ambitions, with Washington blocking the project and encouraging Chile to choose Google's alternative. As Europe's sovereignty strategy unfolds, the warning is clear: controlling infrastructure is a form of raw geopolitical power. Similar diplomatic, economic or regulatory retaliation, such as tariffs, licensing, or access conditions, could easily target Europe next.

While I generally agree with this nuanced discussion about how use of 'AI' in a plethora of government processes is neither new nor necessarily bad, I think an important point that it only indirectly addresses is that we should avoid using these systems as a panacea for overrun and underfunded public services.

This piece is interesting for managers because it reframes sovereignty as a company-level operating challenge rather than a geopolitical abstraction. Instead of blacklisting vendors, a reactive and politically driven mistake, organizations must consider which services are critical and how to maintain them. Geopolitics has entered the boardroom, and the technical scope now explicitly encompasses cloud architecture, data flows, and vendor dependency mapping as direct instruments of sovereign risk management.