Friday’s tech news was about consequences catching up: Apple rewrote the rules for AI agents on the Mac, international police seized a ransomware empire run by a teenager, New Mexico told a judge Meta should pay tens of billions, Rivian proved a cheaper EV can sell, and arXiv put science’s firehose on a ration.
1. Apple tightens macOS Full Disk Access after AI agents read private messages
Apple announced on October 2 that it will introduce additional controls around macOS’s Full Disk Access permission, one of the most powerful settings on a Mac. The trigger was AI agents. “As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially,” Apple said in a developer blog post.
Full Disk Access lets an app read files, mail, messages, and even browsing history. It was designed so backup software could work. But AI agents like Meta’s Muse and OpenAI’s Dots now ask for it to see everything on the machine. “Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems… without users’ full knowledge and understanding,” Apple wrote.
The timing is pointed. Days earlier, Inc. columnist Jason Aten reported that Meta’s Muse agent knew the contents of his private messages even though he said he never granted it access. According to his account, Muse had synced more than 187,000 rows of his message history from the Mac’s local Messages database. Meta disputed the claim, saying Messages access is opt-in and requires enabling both Full Disk Access and the Messages connector.
Why it matters: Going forward, apps will only be able to get that level of access through what Apple calls “very explicit user action.” That changes the economics of desktop AI agents: any product whose value proposition is “see everything, do everything” now faces a friction gate Apple controls. Apple gave no implementation date or macOS version, so developers will be watching beta release notes.
2. Operation KillSwitch: KillSec’s leak site seized, 16-year-old suspected of running the group
Europol and the FBI announced Operation KillSwitch on October 1, a coordinated takedown of the KillSec ransomware group. Authorities in the US and Europe took control of the group’s leak site and five central servers, securing at least 110 terabytes of stolen data against further access. Ten countries took part, with Hamburg’s state criminal police leading the investigation and Bitdefender and Group-IB supporting.
The detail that will travel furthest: police in Spain arrested a 16-year-old Romanian national in Alicante, identified by Hamburg police as the group’s suspected administrator and main operator. Two more suspects in their twenties were arrested in the UK and Romania. Eight properties were searched across four countries. A Dutch national arrested in the UK, using the handle “Archduke,” was indicted by a federal grand jury in Puerto Rico on September 16 on conspiracy and extortion charges and faces extradition.
KillSec had been active since around 2024 and is linked to roughly 1,000 attacks worldwide, about 500 of them successful, with close to 300 victims named on its leak site. According to Europol, the group got in through software vulnerabilities and poorly secured access points, especially cloud storage, then named victims on its dark-web leak site and threatened to publish stolen files. Investigators also found the group used AI to build its ransomware infrastructure and identify victims.
Why it matters: Ransomware groups keep getting younger in their operations and older groups keep rebranding, but the takedown is a real win: 110 TB of stolen data is now in law enforcement hands rather than on a leak site where any visitor could download it. It also continues the pattern that takedowns work when countries coordinate — 10 nations, one action day on September 30.
3. Rivian posts record quarter: 19,248 deliveries on the back of the R2
Rivian delivered a record 19,248 vehicles in the third quarter, up 45.8% from a year earlier and ahead of the analyst consensus of about 18,000 (Visible Alpha’s average was 18,001). Production hit 19,751 vehicles at the Normal, Illinois plant. The driver was the R2 midsize SUV, whose deliveries began in June — the first full quarter of sales for the cheaper model.
The company reaffirmed its 2026 delivery guidance of 65,000 to 70,000 vehicles, which implies the fourth quarter must clear roughly 23,000 to hit the bottom of the range. Wall Street was not fully satisfied: shares fell about 3.1% on Friday on disappointment that the guidance was not raised.
The contrast with the rest of the US EV market is stark. Ford sold 6,047 EVs in the quarter, down 80.2% from a year earlier, after the end of federal EV tax credits. GM sold 25,473 EVs, down 61.7%. Tesla delivered better than expected but still down about 2% year over year.
Why it matters: Rivian’s story is the opposite of the industry’s: a new, relatively affordable model can grow sales in a market where subsidies just died. The R2 is now Rivian’s entire growth thesis — and its $1.25 billion Uber partnership targets robotaxi deployment from 2028.
4. New Mexico asks judge for up to $40 billion from Meta
The state of New Mexico asked a judge on October 2 to order Meta to pay between $35 billion and $40 billion in penalties after a jury found the company misled consumers about the privacy of their data on Facebook, in a case rooted in the Cambridge Analytica scandal.
The September 25 jury verdict in Santa Fe found Meta responsible for more than 43 million violations of New Mexico’s Unfair Practices Act. Jurors examined 29 statements from Meta and its leadership and found 26 misleading — covering data access, hate speech, and misinformation. New Mexico law allows up to $5,000 per willful violation; the outside calculation reaches $219 billion. Meta asked the court to cap penalties at $3.45 billion, arguing the state never proved residents were actually misled. A ruling is expected later in October.
Why it matters: The gap between $3.45 billion and $40 billion is the fight, but the verdict itself is the precedent: a US jury found a platform’s public privacy statements systematically misleading, with per-violation math that turns one state’s consumer law into a $219 billion ceiling. Every other state attorney general is watching.
5. arXiv rations submissions: two papers a month, AI slop is why
Effective October 1, arXiv caps every author at two submissions per calendar month and three active submissions at any time, in a policy titled “Fair Moderation, Equitable Access, and AI: arXiv’s Updated Rate Limit Policy.” The cause is a flood of AI-generated papers overwhelming the volunteer moderators who run the world’s main preprint server.
The numbers explain the panic: arXiv received 40,363 submissions in September 2026, nearly double the 20,569 in September 2024 and four times the 9,869 of a decade earlier. That record volume generated almost 9,000 support tickets, and submissions in the computer-science AI category have grown more than sixfold in two years. A rejected submission still counts against the monthly total, and AI tools remain permitted when properly disclosed.
Why it matters: arXiv is the first major research platform to admit its review pipeline cannot scale against generative AI’s output rate. Every other preprint and journal system faces the same math; this is the pilot program for how science publishing adapts.
The day in numbers
| Number | What it is | Source |
|---|---|---|
| 187,000+ | Rows of message history Muse reportedly synced, per the columnist’s account (Meta disputes it) | Inc. via Startup Fortune |
| 110 TB | Stolen data secured from KillSec’s leak site and servers | Europol / FBI |
| ~1,000 | Cyberattacks linked to KillSec, ~500 successful, ~300 victims named | Europol |
| 19,248 | Rivian Q3 deliveries, up 45.8% year over year | Rivian / Reuters |
| 43 million | Consumer-law violations the jury attributed to Meta in New Mexico | Reuters |
| 40,363 | arXiv submissions in September 2026, vs 20,569 in Sept 2024 | arXiv |
Key takeaways
- AI agents are entering their accountability era. Apple is gating disk access while the courts and Congress catch up, and Meta’s Muse is the case study for what happens when an agent reads more than users expect.
- Ransomware still gets taken down the old way: coordinated cross-border police work, servers seized, operators arrested. KillSec’s alleged teenage administrator is a reminder of how low the barrier to entry has become.
- The $40 billion question: whether New Mexico’s penalty request survives judicial review will set the template for every state-level privacy case against big platforms.
- Affordable EVs can still sell: Rivian’s record quarter, in a market where Ford’s EV sales fell 80%, is the strongest evidence yet that price, not demand, is the industry’s problem.
References
- Apple says it’s tightening macOS ‘Full Disk Access’ controls due to new risks from AI agents — TechCrunch, Oct 2
- Apple Announces ‘Full Disk Access’ Changes on macOS Due to AI Agents — MacRumors, Oct 2
- Bitdefender Supported Operation KillSwitch — Bitdefender, Oct 1
- Rivian Breaks Delivery Records with R2 SUV Launch — Reuters via ETAuto, Oct 2
- New Mexico wants Meta to pay up to $40 billion in penalties after data privacy trial — Reuters, Oct 2
- arXiv now limits every researcher to two paper submissions a month — Startup Fortune, Oct 2
- Top Tech News Today, October 2, 2026 — Tech Startups, Oct 2
Was this useful?
Thanks for the feedback.
