A Word document that infects the next one, 30+ Minnesota water systems hit, and phone chips get pricier
A hidden instruction in a Word document can copy itself into the next document
A security researcher published a demonstration of a self-spreading attack on Copilot for Word. Instructions are hidden in a document as white text on a white background. When someone uses that document as source material for Copilot, the hidden text tells Copilot to change what it writes — the demo alters financial figures — and to copy the hidden instructions into the new document. That freshly created, internal-looking file then carries the payload to the next person who feeds it to Copilot. The formatting trick works because Copilot strips colors and font sizes before handing text to the model, so invisible text reads the same as visible text. There is a walkthrough here. Microsoft was notified under coordinated disclosure and has shipped mitigations, including a rebuilt "Edit with Copilot" experience and a model upgrade; the researcher reports the underlying technique still reproduces with those in place. Why it matters: the danger is not a virus in the usual sense — it is that AI writing tools cannot tell the difference between the document you gave them and instructions someone hid inside it. Treat any document from outside your company as untrusted before you point an AI tool at it: skim it yourself first, and select the text you want summarized rather than handing over the whole file. Then read what the AI produced before you forward it or reuse it as a source, especially any numbers.
A coordinated attack disrupted more than 30 Minnesota water systems
Minnesota IT Services confirmed that more than 30 water systems across the state were affected on July 26 and 27, according to The Hacker News and BleepingComputer. Four communities publicly reported disruptions — Braham, Plymouth, South St. Paul, and Maple Plain. Braham's treatment plant went offline, Plymouth lost cellular communications at water towers, and Maple Plain declared a local emergency. Utilities kept service running by operating equipment manually, and as of July 28 officials said they were not aware of any requests for residents to change how they use their drinking water. No one has been officially identified as responsible. Why it matters: the equipment that runs small utilities, building systems, and shop-floor machinery is often reachable over cellular modems that nobody has looked at in years, and that is what got hit here. If your business runs anything with a remote-access modem — HVAC controls, irrigation, security cameras, a card reader — ask whoever installed it two questions this week: is remote access still enabled, and is it still using the password it shipped with. If your local utility posts a water advisory, that is the signal to act on; absent one, no action is needed at home.
Qualcomm is reportedly raising chip prices on September 1, and phones follow
Qualcomm has told hardware partners that prices for its Snapdragon chips will rise by double-digit percentages starting September 1, according to a customer letter reviewed by Bloomberg and reported by Android Authority and 9to5Google. The company cited rising costs it says it can no longer absorb, pointing to supplier and component bottlenecks. Coverage describes the increase as reaching beyond phones into tablet chips, Windows-on-Arm laptop processors, wearables, and standalone VR headsets. Qualcomm has not published a press release naming a specific rate. Why it matters: chips bought after September go into devices designed for late 2026 and 2027, so this shows up as higher sticker prices on next year's Android phones and Arm laptops rather than on anything sitting in a store today. If a work phone or laptop refresh is already on your list for this year, the practical read is that waiting is unlikely to get you a better price on the next generation — buy on the current generation's timeline and normal sale cycles instead of holding out for a cheaper new model.
The FCC barred new imports of foreign-made humanoid robots and power inverters
The Federal Communications Commission added foreign-made humanoid robots, quadruped "robot dog" machines, and power inverters to its Covered List, barring new imports on national security grounds, TechCrunch reports. The stated concern is that the devices could be remotely controlled, used for surveillance, or drawn into cyberattacks. The measure mainly affects imports from China, which holds roughly 85% of the humanoid robot market. NPR reports China has objected. Equipment already authorized for US sale is not covered, and the FCC said devices already installed in homes are unaffected. Why it matters: the part with the widest reach is power inverters, the boxes that convert DC electricity to AC in solar arrays, battery backups, and RVs. If you have a solar or backup-power installation quoted or in progress, ask your installer now whether the inverter model is already US-authorized and what the substitute is if it is not — that is where schedule slips and price changes will land. Anything already on your roof or in your garage keeps working.
Android is rolling out age signals so apps can tell whether a user is a minor
Google is expanding its Play Age Signals API, which lets an app learn a user's age range without being handed a birth date or other personal details. Parents set a child's age range in the Family Link parental-controls dashboard, and apps that adopt the API can read that signal to adjust what they show. Adults can choose to share their range when an app asks. The signal is not shared automatically. It is live in Brazil, reaches Australia and Canada in mid-August, and is slated for all markets by the end of 2026. Apple shipped comparable tools in February. Why it matters: for parents, this replaces per-app age settings with one place that feeds every app that participates — worth checking that the age on your child's Family Link profile is actually correct, because apps will start acting on it. For anyone running an app or a site with an age-restricted audience, this is the direction age checks are heading: a yes-or-no signal from the platform rather than collecting birth dates yourself, which is less customer data for you to store and defend.