AI Deletions, Copilot Worms, and Claude Games

Today is shaping up to be a pretty revealing AI day: on the one hand, research shows how complicated “deleting data” in agent networks really is. On the other, current product news is a reminder that AI is not only becoming more productive, but also surprisingly easy to misuse. In short: more power, more problems — the old equation, just with better marketing.

🧹 When Unlearning Fails: Data deletion is harder than expected

The new arXiv paper When Unlearning Fails: Reliable Data Deletion under Post-Training in Agent Networks highlights a core problem in modern agent systems: when models keep learning after deployment, a simple “please forget this data” often is no longer enough. The reason is the feedback loop — earlier data has shaped later behavior, and that behavior is then embedded again in new trajectories. So deletion is not just an intervention in the dataset, but in an entire chain of downstream decisions.

Why does this matter? For companies running agents in production, data governance becomes significantly more complex. It’s not just about privacy or compliance, but also about whether a model can really be “cleanly” repaired afterward. The paper makes it clear: unlearning in agent networks is not a Post-it note you can just peel off — it’s more like a knot in the wiring harness. And that’s where things get unpleasant.

🛰️ Google Earth and AI fakes: the temptation was too great

Google appears to have integrated the AI image feature in Google Earth far too early and pulled it back after just two days. With only a few prompts, users could generate deceptively realistic fake satellite images — including scenes that would be politically or socially highly sensitive. This is not a harmless filter gimmick, but a real misuse problem: when an interface like Google Earth projects authenticity, the potential for harm from misinformation rises dramatically.

The context here matters: image generators are no longer just a creative tool, but an infrastructure problem. Once generative models move into maps, search interfaces, or other trusted contexts, the question shifts from “Can the model make images?” to “Can the user convincingly fake reality?” Spoiler: yes, unfortunately. And that is exactly why product design here is not just UX, but also AI safety.

📄 Copilot worm in Word: prompt injection with self-propagation

A security researcher has shown that a manipulated Word document can spread like a worm via Microsoft Copilot in Word: invisible prompt injections are hidden in the document, reactivated the next time it is used, and then end up in new files. Microsoft has confirmed the issue, but after 144 days and two attempts, apparently still had no solution. That’s the kind of “feature” no product manager wants on the roadmap.

The case shows how difficult LLM security is in Office environments. Prompt injection is no longer just an abstract prompt-engineering topic, but a real attack path in standard software. When an AI assistant processes content from documents, it must be able to distinguish between legitimate instructions and hidden manipulation — reliably. For you, that means: with Copilot, agents, and document workflows, trust is good, but validation is much better.

🧠 Meta AI with a memory agent: long-running tasks become more stable

Meta AI is testing a second agent that does not perform the task itself, but runs alongside as a memory layer. The idea behind Meta AI lets a second AI agent take notes is simple and elegant: a memory agent maintains a structured memory store and actively decides which information is important enough to be fed back to the main agent later. This is meant to prevent complex tasks from “going off the rails” over time because the model loses earlier mistakes or insights.

This is especially relevant for longer agent workflows, such as research, coding, or multi-step automation. The reported improvements of up to 8.3 percentage points on benchmarks are not a cure-all, but they are a strong signal: memory in agents is not optional, it is central. You could say: the main agent is the intern, and the memory agent is the person writing the same context on the board for the third time.

🎮 Claude Opus 5 builds browser games via prompt

Anthropic’s Claude Opus 5 generates playable browser games with just a prompt, providing a pretty vivid example of generative software development. From a single prompt, complete 3D browser games emerge — with geometry, textures, physics, and sometimes even music. No asset import, no classic game engineering, just code that runs directly in the browser. This is less “prompt as input” and more “prompt as project brief.”

What makes this exciting is several things at once: first, it shows how far models have come in multimodal generation and code synthesis. Second, it suggests that “vibe coding” is becoming increasingly serious for interactive applications too. Third, as always, it raises the question of quality, safety, and maintainability. Because a game built by prompt is impressive — until someone expects it to work without magic, luck, and a lot of fine-tuning.

🧩 MMFGU: federated graph unlearning goes multimodal

With MMFGU: Multimodal Federated Graph Unlearning, another building block is added to the big topic of “forgetting data” — this time for federated graph systems with text, image, and structural information. That is exactly what makes the problem complicated: when data is not isolated, but multimodal and distributed, deletion requests become more granular, more frequent, and technically trickier. Removing a single account or interaction can affect multiple signal types.

In practice, this is especially relevant in social, recommendation, or knowledge graph setups. There, unlearning is not just a governance issue, but a model-architecture issue. The paper shows how quickly privacy, scalability, and model consistency collide. In short: the more modalities, the more places where a “please forget this” turns into a research case.

🛠️ Tool tip of the day

If you work with LLM workflows, prompt-injection tests, or agent experiments yourself, a clean sandbox approach for local runs and repeatable tests is worth it. A good starting point is a lightweight evaluation setup that lets you check prompts, tool calls, and security cases separately. If you’re looking for a suitable product right now: #

---

Don’t want to miss any news? Subscribe to the newsletter