Morning digest: EU court, bug bounty, and voting

Morning digest for Tuesday, Nov 3. In the first generative AI case to reach the EU's top court, an adviser to the court says a chatbot like Google's Gemini can infringe news publishers' rights when its answers copy their articles closely enough that you don't need to read the original, while training AI on their work is, as a rule, allowed. Also: OpenAI raised its bug bounty payouts, with the top award now up to $172,000 with bonuses, and is bringing in an outside firm for its next security sprint; on Election Day, a study found chatbots got about 1 in 7 voting-logistics answers wrong or outdated; WIRED found more than 400 harmless-looking apps hiding sexual deepfake tools; a UK prosecutor cited a court case that doesn't exist after an AI search summary; Marvell agreed to buy Lumentum in a $115 billion AI networking deal; and Epic says Unreal Engine 5.9 arrives in Preview next week with improved AI workflows.

1. An adviser to the EU's top court says chatbot answers can infringe news publishers' rights, but training on their articles is generally allowed. The case started in Hungary, where the website operator Like Company sued Google, saying Gemini reproduced its articles in answers to users between June 2023 and May 2024. A Hungarian court asked the Court of Justice of the European Union how EU law applies, and on Tuesday Advocate General Maciej Szpunar, one of the court's independent advisers, gave his opinion. The court's press release calls it "the first generative AI case to reach the Court of Justice." Gemini uses what the court calls "Retrieval-Augmented Generation," meaning it looks up pages on the web in real time to answer you. Szpunar said that when a chatbot pulls a news article and reuses it in an answer, "the press publisher's right may be infringed in certain circumstances." Publishers don't own "the mere facts" in a story, only how it's written, so it depends on two things: whether the chatbot got the article unlawfully, for example by getting around a paywall, and whether the answer reuses the article's wording so recognisably that "the user, by reading that answer, is entirely dispensed from accessing the original publication." On training, he said the questions were hypothetical because there's no evidence Like Company's articles were used, but added that training an AI model on protected material is, "as a rule, freely permitted under the text and data mining exception," an EU rule that allows automated analysis of text and data. What to watch: The opinion isn't binding, and the judges have only now begun deliberating, with a ruling "at a later date." Reuters notes that such opinions are usually followed, so if the court agrees, AI chatbots in the EU may need to summarise the news more loosely or pay for it.

2. OpenAI raised its bug bounty payouts, with exceptional findings now worth up to $172,000 with bonuses. A bug bounty pays outside security researchers who find and report weaknesses before attackers do. OpenAI says it is "more than quadrupling the midpoint of our reward ranges for medium, high, and critical findings on average." A critical bug in ChatGPT, Codex or the API Platform can now earn up to $30,000, and "Exceptional critical findings on those targets remain eligible for up to $100,000, and now up to $172,000 with bonuses." The bonuses come from new multipliers for high-quality reports, a five-tier loyalty program and short "priority campaigns" for new features. In OpenAI's own example, a bug that lets someone view other ChatGPT users' chats works out to $171,925. Reports still awaiting an award get the new ranges, and OpenAI will pay the difference on awards from the past 30 days. In a separate post, OpenAI says its next internal "security sprint" will bring in the security firm Cathedral, whose researchers will use OpenAI's models "to challenge our defenses." In the last sprint, OpenAI "dedicated 25% of our product engineers to finding and fixing weaknesses," using Codex to reproduce bugs and prepare fixes. OpenAI posted about both on X Monday evening. What this means for you: Your ChatGPT and Codex accounts aren't affected, but more paid outside testing should mean bugs that could expose your chats get found sooner. If you do security research, the new rates apply now.

3. On Election Day, a study found chatbots gave wrong or outdated answers to about 1 in 7 voting-logistics questions. The nonprofit Innovating for the Public Good is testing seven chatbot products, including Google's AI Mode and AI Overviews, Claude, Copilot, Gemini, ChatGPT and Perplexity, with real voter questions, NPR reports. In October, "13.9% of chatbot answers to voting-logistics questions were outdated or inaccurate," and 5.9% had errors that could make someone miss a deadline, vote on the wrong day or skip a required step. The group says Claude and Copilot produced three-quarters of the clear errors; on voting questions, Claude was wrong or out of date one time in three, Copilot one in four and ChatGPT one in ten. Anthropic told NPR that some of the testing went through its API, where "some of Claude's key safeguards may not have been active"; the researchers say a separate check found API and web answers comparable. NPR also found that Meta AI, Claude, Grok and ChatGPT all refused to say who to vote for at first, but gave lists of candidates matching a voter's views after two or three prompts; Gemini didn't. Monday's digest covered OpenAI's and Anthropic's election "war rooms"; this is new data on how the answers hold up. What this means for you: If you're voting today, get your polling place, hours and ID rules from your state or county election office's website, not a chatbot answer.

4. WIRED found more than 400 harmless-looking AI apps and sites hiding tools for making sexual deepfakes. The apps look like everyday tools, such as AI pet portraits, language lessons or workout coaching, but "When accessed under certain conditions," they quietly load a hidden interface for making explicit AI images and videos from photos users upload, WIRED reports. Researchers say each app checks with its server when it's opened, and one trigger for the hidden version appears to be installing it from one of the network's ads on Facebook or Instagram. The network appears to be run by Chinese developers and a Hong Kong company called KeLing Technology Limited, which didn't respond to WIRED. Researchers counted 27 of the apps live on Google Play in September, with more than 350,000 downloads between them, many rated suitable for all ages. Apple removed 19 apps after WIRED got in touch and said the developers swapped in the explicit content after its review, and Google had removed most of them before WIRED contacted it. Meta says it took action against 11,600 ad accounts and 15,000 pages tied to the network. WIRED says similar ads and apps were still appearing as it finished the story. What this means for you: If your kids install AI photo apps, check the reviews and the developer before you allow them, and report any app that behaves differently from its store listing.

5. A senior UK prosecutor cited a court case that doesn't exist, and it reportedly came from an AI search summary. Ravinder Dhillon of the Crown Prosecution Service (CPS), the main prosecuting agency in England and Wales, cited "CPS – R v J [2024] EWCA Crim 3529" in a high court dispute over whether to prosecute a child, the Guardian reports. The case was made up; the Guardian understands it came from an AI summary in an internet search. Two high court judges called her explanation "unsatisfactory," though the court said the error didn't change the outcome. The CPS said it "identified an error had occurred from conducting legal research using the internet," reviewed other cases, and told staff that "case law must be cited from trusted legal sources." It's the second known case involving the CPS, and it brings a UK tracker of AI-related court errors to 101 entries. What this means for you: Search engines now put AI answers at the top of results, so open the original source before you quote a case, law or figure from one.

6. Marvell agreed to buy Lumentum in a $115 billion all-stock deal aimed at AI data-center networking. Marvell makes chips that move data between processors and servers, and Lumentum makes lasers and optical parts that send that data as light. AI data centers need ever-faster links between thousands of chips, and the companies say copper wiring is reaching its limits, pushing the industry toward optical links. Lumentum shareholders will get 4.5 Marvell shares for each share, valuing Lumentum at about $1,132 a share, and Marvell shareholders will own about 67% of the combined company. "AI infrastructure is undergoing a fundamental architectural shift toward optical connectivity," Marvell CEO Matt Murphy said. The companies expect more than $1 billion a year in cost savings, a claim, not a result. TechCrunch calls it one of the largest deals in tech history. What to watch: The deal needs shareholder and regulatory approval and isn't expected to close until the first half of 2028.

7. Unreal Engine 5.9 is coming in Preview next week, with improved AI workflows and the web as a new target platform. "It's official: 5.9 is happening and it's coming in Preview next week," Epic's Unreal Engine account posted early Tuesday. Epic says it "will include improved AI workflows, web as a target platform, rendering and animation updates, plus more." A target platform is somewhere you can ship a project, so this suggests Unreal projects could run in a web browser. Epic didn't say what the AI workflow changes are, and says changes are starting to land in the 5.9 branch on GitHub, with "More details coming soon!" When you'll feel it: The Preview is due next week. Previews are early test builds, so try 5.9 on a copy of a project, not your main one.