The AI Agent Privacy Blind Spot Exposed by Meta's Muse Incident: Approving a Template Is Not the Same as Consenting to Disclosure
Toronto tech blogger Matt Robb wanted to sell a used keyboard.
Toronto tech blogger Matt Robb wanted to sell a used keyboard.
Latham & Watkins, the second-largest U.S. law firm by revenue, was recently reported to have taken a move rarely seen in the legal industry: it has directly purchased Nvidia GPU servers and begun building and fine-tuning its own internal artificial intelligence system. The news was first disclosed by the UK's Financial Times, subsequently confirmed by Bloomberg Law, Law360, and other media outlets, and Latham itself confirmed the fact to the press. Unlike most coverage that focuses on the technological spectacle of "law firms buying chips too," this article aims to discuss another thread driving this decision—data security compliance.
Security researcher Chaofan Shou recently claimed on social media platform X that he paid to purchase approximately 6TB of data from a leading domestic large model 'relay station.' This data is mixed with a large number of SSH keys, VPN configurations, Alibaba Cloud credentials, and GitLab tokens that users forwarded through the relay station while using AI coding tools.
**A Legislation Sparked by "Hallucinations"** Over the past two years, generative AI has rapidly entered the daily work of law firms: drafting documents, searching for cases, and organizing evidence summaries. But behind the convenience, a recurring problem has begun to plague the entire legal industry—AI "fabricating" case law. Lawyers have found that even well-trained, high-performing large models will, in the course of writing, "spout nonsense with a straight face," fabricating cases, citations, and legal bases that appear real but do not exist at all. This phenomenon is called "AI hallucination." According to statistics from legal research institutions, as of early 2026, more than 600 court cases across the United States have involved lawyers submitting documents containing AI-hallucinated citations, and this trend is still accelerating—from a few sporadic cases per month to new cases appearing almost every day.
Imagine a home service robot: it remembers your home's layout, recognizes your face and voice, knows when you wake up, and where you habitually place your keys. This is not science fiction, but the reality of embodied intelligence coming to life—in 2025, China's embodied intelligence market has approached one trillion yuan, with continued growth expected in 2026. But this robot is also doing something traditional AI applications rarely do: turning the entire physical world into its training data. Cameras, microphones, force sensors, and LiDAR operate around the clock, collecting images, audio, spatial maps, human trajectories... This is entirely different from an app pop-up asking you to click 'agree' a few times.
Kirkland & Ellis announced a $500 million investment in AI technology, raising critical questions about client data privacy and security. The initiative promises enhanced legal services but also introduces new risks and regulatory considerations for the firm and its clients.
Brazil's National Data Protection Authority (ANPD) fined TikTok for failing to comply with child data processing rules, marking a significant enforcement action.
The U.S. Federal Trade Commission (FTC) has referred a complaint against TikTok to the Department of Justice, alleging violations of the Children's Online Privacy Protection Act (COPPA). This action could result in a fine of up to $400 million, making it one of the largest penalties in FTC history. The move highlights ongoing scrutiny of TikTok's data practices and their impact on young users.
Over the past two years, generative AI tools have rapidly evolved from a "novelty" into everyday office tools. From writing emails, creating PPTs, coding, to organizing meeting minutes—employees may interact with AI in almost every aspect of their work. However, many companies still operate in a phase where AI usage is "employee-initiated, department-tolerated, and company-unaware." For multinational enterprises, especially those with operations or employees in both China and the U.S., this laissez-faire approach is amplifying risk exposure. The EU AI Act's General-Purpose AI (GPAI) rules have entered the enforcement phase; U.S. AI regulation presents a fragmented landscape of "federal restraint, state proliferation"; and cross-border data flows between China and the U.S. are further compounded by each country's data security and export control rules, making this one of the most overlooked and perilous areas for many companies.
**The logic of doing RWA in Hong Kong is actually very simple: no matter how new the technology, the nature of the asset does not change, and the old rules still apply.**
The U.S. Federal Register recently published the final rule of Executive Order 14117, enhancing data privacy and security standards.
The European Commission has published its comprehensive review of GDPR implementation, highlighting successes in data protection awareness while identifying challenges in cross-border enforcement.
The Federal Trade Commission has opened formal investigations into several major AI companies over their practices of collecting and using personal data to train large language models.
Chinese regulators imposed a record fine on a major tech company for violating the Personal Information Protection Law by collecting user data without proper consent and failing to implement adequate security measures.
The European Data Protection Board imposed a record-breaking €1.3 billion fine on Meta Platforms for transferring EU user data to the United States in violation of GDPR requirements.