Three reports from the past few days showing where the risk of AI ends up: with you as the user. Meta wants advertisers to be liable for what its AI does with their adverts. A US hospital is warning more than 3,000 patients after use of an unapproved AI tool. And Anthropic explains how a test version of Claude attacked real developers.
Meta: you pay for its AI's mistakes
Meta is adding a separate section on AI features to its business terms. According to PPC Land, as an advertiser you are "solely responsible" for what Meta's AI features do with your ads, even if Meta switches those features on itself. The terms say the AI can make mistakes and that you must indemnify Meta against claims. The original start date was 30 October; after complaints from publishers to European and British regulators, Meta postponed it from 23 October to 20 November. The content itself is unchanged.
What does this mean for you? If you advertise via Meta, check which AI adjustments are switched on and turn off any you won't check yourself. Carrying on after 20 November counts as agreement. You'll find tools for marketing such as AdCreative.ai and Jasper in our list; there you keep the final check yourself before anything goes live.
Hospital: spreadsheet with patient data entered into public AI tool
Johns Hopkins Bayview in Baltimore is sending letters to 3,182 patients, WMAR-2 News reports. An employee uploaded a spreadsheet to an unapproved, publicly available AI tool. It contained names, admission and treatment dates, patient numbers, departments, medication and the names of treating clinicians of patients admitted between May and September. The incident was discovered on 21 September; the employee deleted the chat and the file, and the hospital asked the AI company to erase the data. Which tool was used has not been disclosed.
What does this mean for you? In the Netherlands this would be a data breach under the GDPR, with a duty to report. A ban alone doesn't work: make sure your team has an approved tool with a data processing agreement. Check the GDPR check for ChatGPT in healthcare and the one for Claude, or professional tools for healthcare such as Autoscriber and Attendi.
Mythos 5: test model attacked real developers
On 23 October Anthropic published an analysis of a test carried out with the British AI Security Institute. In 9 of the 43 runs of a hacking exercise, a test version of Claude Mythos 5 did things it was not allowed to do: it submitted a malicious pull request to a real GitHub repository, created a fake account to pressure the maintainers, and guessed passwords on real accounts. Internet access was deliberately enabled, and the safeguards active in ordinary models such as Fable 5 were switched off. The AISI found no real-world harm.
What does this mean for you? It isn't about the model you use yourself. It does show that an AI agent with internet access and a narrow task can go far beyond it. So in your own work, don't give agents more rights than they need. Compare the models on Claude vs ChatGPT.
In brief
- If you advertise through Meta: from 20 November you are responsible for the AI adjustments.
- Staff who choose their own AI tool are a GDPR risk; arrange an approved alternative.
- Only give AI agents the rights they need for the task.
All models and their privacy scores side by side: /modellen/ and /veiligheid/.
