Everyone is navigating AI security in real time even Google

Chrome security update addresses 22 critical severity flaws CyberInsider Google publishes exploit code threatening millions of Chromium users Ars Technica Google Chrome's security flaw is compromising your sensitive data, passwords and banking details:... Moneycontrol.com India's CERT-In warns Chrome users running older versions to update NewsBytes Google leaks details for Chromium bug that can turn browsers into bots csoonline.com

Prison calling service Pay Tel has secured a publicly exposed cloud server storing hundreds of thousands of driver’s licenses and other sensitive information about people who used its services, according to a cybersecurity firm that alerted the company to the security lapse.

Security researchers with UpGuard said in a blog post that they identified a Microsoft Azure-hosted storage server hosting at least 300,000 driver license scans and other government-issued identity documents belonging to Pay Tel.

The server was unprotected without a password, allowing the data inside to be accessible from the web.

Pay Tel provides tablets and other communication devices to prisons across much of the United States for inmates to receive calls. Customers signing up to Pay Tel have to provide a copy of their identification documents and a profile photo before they can use the service, which UpGuard said were exposed. The security researchers said inmate communications, including text messages, handwritten notes, and financial records, were also exposed as a result of the security lapse.

UpGuard said it alerted Pay Tel on May 7 after determining that the company managed the server, and followed up days later before it was secured. Pay Tel has not yet acknowledged the security incident.

The data exposure at Pay Tel is the latest example in recent months of tech companies leaving people’s highly sensitive documents on the open web for anyone to find. TechCrunch has reported on this recurring problem of companies often misconfiguring their systems or falling below cybersecurity best practices, and as a result, allowing anyone on the internet to view their customers’ personal information.

UpGuard said many of the user-uploaded photos also contained the precise real-world location of where the images were taken; in some cases, granular enough to identify someone’s home address.

This is Pay Tel’s second known security lapse in as many years, following a ransomware attack in June 2025.

Pay Tel president Vincent Townsend did not respond to an email from TechCrunch with questions about the security lapse. It’s unclear if the company plans to notify the individuals whose data was exposed or if the company will alert attorneys general under U.S. state data breach notification laws.

TechCrunch could not ascertain who, if anyone, is responsible for cybersecurity at Pay Tel. When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

Zack Whittaker is the security editor at TechCrunch. He also authors the weekly cybersecurity newsletter, this week in security.

He can be reached via encrypted message at zackwhittaker.1337 on Signal. You can also contact him by email, or to verify outreach, at zack.whittaker@techcrunch.com.

View Bio

Luxury smartphone brand Vertu on Thursday unveiled a foldable phone powered by an AI agent that connects with enterprise software and coordinates workflows. The company is targeting executives who manage business operations and communications on the move.

Called the Alphafold, the foldable smartphone starts at $6,880 for the calfskin version. Higher-end models feature bespoke finishes including alligator leather, 18K gold, and natural diamond accents, along with customized detailing. This continues Vertu’s long-standing strategy of positioning its phones as luxury status symbols aimed at affluent buyers. The company told TechCrunch that its highest-end standard model is currently priced at $46,800, with further customization options available.

The launch marks Vertu’s latest attempt to reinvent itself for the AI era after struggling to remain relevant in the modern smartphone market. The Hong Kong-headquartered company, once known for luxury handsets and concierge services popular among wealthy buyers before the rise of the iPhone, has changed ownership multiple times over the years as mainstream smartphone makers came to dominate the industry. Nonetheless, Vertu is betting the Alphafold can help reinvent the brand for the AI era by combining luxury hardware with enterprise-focused AI capabilities.

Vertu’s Alphafold comes with Hermes Agent, built on top of the open-source Hermes project by Nous Research. The agent can connect to enterprise systems like ERP and CRM, and coordinate tasks such as approvals, scheduling, sales tracking, travel planning, and operational reporting through natural-language prompts. However, the company said that its Phone-to-ERP and VPS deployments would be customized for each customer depending on their existing enterprise systems, with pricing varying accordingly.

Image Credits:Vertu

The Alphafold, Vertu said, can route requests across multiple AI models including OpenAI’s GPT, Anthropic’s Claude, Google’s Gemini, and selected open-source models, while also integrating with more than 80 apps and dozens of native phone functions for cross-platform workflows.

Existing AI features on smartphones from major manufacturers remain focused largely on consumer tools such as image editing and voice assistance, Vertu CEO Molly Ma said. This leaves room for more advanced AI-agent workflows tied to enterprise systems. She also pointed to earlier AI-agent smartphone experiments in China that gained popularity before facing challenges over data privacy and cloud-based data collection.

The Alphafold, Ma said, aims to address those concerns through a privacy-focused architecture featuring a proprietary A5 security chip. This silicon is designed to isolate authentication keys, biometric credentials, and sensitive enterprise information from the main operating system, the company said. It added that commercially sensitive data can be processed locally on the device, while prompts sent to external AI models are redacted or tokenized before leaving the phone.

While Vertu has emphasized the device’s privacy and security architecture, including on-device processing and data redaction features, the company said the system has not yet undergone third-party security audits or independent certification. However, Vertu told TechCrunch that independent audits and certification remain on its security roadmap “as an explicit next-stage commitment,” adding that it would “communicate the progress and the results publicly” once the product matures further.

The Alphafold is powered by Qualcomm’s Snapdragon 8 Gen 4 processor and features an 8.05-inch foldable display alongside a 6.53-inch outer screen, a 6,500mAh battery, and satellite communication capabilities. The device also includes a triple rear camera setup with 50-megapixel primary and ultrawide cameras, as well as a 5-megapixel telephoto lens. Vertu said the phone’s hinge uses metal, titanium, and carbon-fiber components and is rated for up to 650,000 folds.

The Alp

I recently had the opportunity to sit down with Francis de Souza, COO of Google Cloud, backstage at an event in Los Angeles. Amid the din around us, de Souza, who speaks in the calm, measured manner of a university professor, offered useful advice for companies navigating the AI security moment we’re all living through, noting that “there’ll be a transition period, and then I think we get to this better place.”

He wasn’t speaking about Google at that moment, but it’s clear that even Google is still figuring things out.

De Souza’s core message was one security professionals have been trying to get executives to internalize for years, now made urgent by AI: security can’t be an afterthought. “As companies embark on this AI journey, they need to take a platform approach,” he said. “Security is not something you can bolt on later, and it’s not something you can leave up to employees to do on their own.” He warned specifically about “shadow AI” — employees reaching for consumer tools without organizational oversight — and argued that companies need to demand security, governance, and auditability from their platforms from the start. “There’s no such thing as an AI strategy without a data strategy and a security strategy. They need to go hand in hand.”

Worth noting: he wasn’t pitching Google Cloud alone. When I observed that his advice sounded like a Google advertisement, he pushed back. Google, he said, is committed to a multicloud approach, and he made the case that companies that think they’re operating on a single cloud almost certainly aren’t. “Even if they pick a single cloud, they’re relying on SaaS applications, there are business partners that may be using different clouds,” he said. “It’s important for companies to have a security posture that is consistent across clouds, across models.”

He also made the case that the threat landscape has changed so fundamentally that old defensive models are too slow. He noted that the average time between an initial breach and the handoff to the next stage of an attack has dropped from eight hours to 22 seconds, and that the attack surface has expanded well beyond the traditional network perimeter. “In addition to your usual estate, you have models now. You have data pipelines used to train the models. You have agents, you have prompts. All of this needs to be protected.”

One threat de Souza flagged that doesn’t get enough attention: agents moving through a company’s internal systems can surface forgotten data repositories that nobody has thought about in years. “A lot of organizations have old SharePoint servers [and access controls] they haven’t really updated, but it didn’t matter because nobody really knew where they were. But agents roaming your enterprise will find those data assets and will expose the data on them.”

The answer, in his view, is to meet machine speed with machine speed. “We’re now seeing the emergence of an AI-native, fully agentic defense where organizations can run agents driving their defense,” he said. “Instead of having a human-led defense or even a human in the loop, you can now have humans overseeing a fully agentic defense.” He added that this has become a leadership issue, not just a technology one. “This is a board-level issue and an executive team issue. It’s not just a security team’s issue.”

But even as AI takes on more of the defensive workload, the people qualified to oversee it are in short supply — and the vulnerabilities that AI itself is introducing are multiplying faster than security teams can address them. “We’re going to need people to deal with the bug-pocalypse,” LinkedIn’s chief information security officer Lea Kissner told the New York Times this week, adding that she doesn’t expect the industry to understand AI security in any sustainable long-term way for at least several years.

Which brings us back to the platform providers themselves. The Register has published a series of reports over the past several weeks documenting a wave

Everyone is navigating AI security in real time even Google

Chrome security update addresses 22 critical severity flaws

Chrome security update addresses 22 critical severity flaws

Discussion (0)

A security lapse at prison payphone service Pay Tel publicly exposed over 300K callers drivers licenses

Vertu wants CEOs to run companies from an AI foldable starting at $6,880