Daily AI · 2026-06-23

Useful AI Daily - June 23, 2026

Today's useful AI signal is control. OpenAI is pushing AI-assisted security into open-source maintenance, IBM is packaging frontier models for cyber defense, Copilot's JetBrains update adds agent and credit controls, SearchLeak shows why assistant permissions matter, and Google Vids gives ordinary users a low-friction avatar test.

Try AI where the task is bounded, logged, and reversible. Watch agent permissions, data reach, and cost signals. Skip any AI workflow that can read sensitive data but cannot explain its approval, billing, or escape path.

Updated 2026-06-23 · ai-daily, security-basics, developer-tools, privacy

The Short Version

Try for maintainers: OpenAI's Patch the Planet pairs AI-assisted security research with expert review and patches for major open-source projects.
Watch for security teams: IBM joined OpenAI Daybreak and launched an application-security service using OpenAI cyber capabilities.
Try in IDEs carefully: GitHub's JetBrains Copilot update adds organization agents, Claude as an agent provider preview, and per-turn AI credit visibility.
Audit permissions: Varonis' SearchLeak research shows how Microsoft 365 Copilot can expose sensitive data when permissions and prompt surfaces meet.
Try for normal work: Google Vids avatars are a practical way to turn a script or presentation into a short training or update video.

5 Updates Worth Your Time

Try for maintainers OpenAI Patch the Planet

OpenAI is turning AI security research into patch support

What changed: OpenAI introduced Patch the Planet, a Daybreak initiative with Trail of Bits, HackerOne, and Calif. The program supports maintainers by using AI-assisted security research plus human review to validate vulnerabilities, develop patches, improve tests, and coordinate disclosure for projects including cURL, NATS Server, pyca/cryptography, Sigstore, aiohttp, Go, freenginx, Python, and python.org.
Why it matters: Who should care: open-source maintainers, security teams, and builders who depend on shared infrastructure. The useful part is not just faster bug finding; it is the full loop of validation, patching, tests, and maintainer control.
Try, watch, or skip?: If you maintain a project, treat this as a checklist even if you do not join the program: add fuzzing, variant checks, stronger CI, a disclosure path, and a human review step before AI-generated findings reach users.

Read source

Watch security IBM OpenAI cyber defense announcement

IBM is packaging OpenAI cyber models for enterprise defense

What changed: IBM said it joined the OpenAI Daybreak Cyber Partner Program and launched a managed application-security service that uses OpenAI cyber capabilities to help organizations identify and validate software vulnerabilities. IBM says the work builds on Project Lightwell and emphasizes governed, read-only access to client code environments.
Why it matters: Who should care: security leads, compliance-heavy teams, and software vendors. Frontier-model security is moving from demos into managed services, which means the buying question becomes governance, evidence quality, and blast radius.
Try, watch, or skip?: Watch before you buy. Ask any AI security vendor how findings are reproduced, what code access the model gets, how false positives are filtered, and whether patches are tested before a ticket hits your backlog.

Read source

Try carefully GitHub Copilot JetBrains changelog

Copilot's JetBrains update makes agents more controllable and more measurable

What changed: GitHub's June 22 JetBrains update added support for organization and enterprise agents, queued or steering messages in Copilot CLI sessions, an agent debug logs summary, Claude as an agent provider in public preview, model picker improvements, and a per-turn AI credits indicator.
Why it matters: Who should care: developers using JetBrains IDEs and teams standardizing agent workflows. The best signal is not another model picker; it is that agents now need admin-published defaults, debug summaries, and visible credit use.
Try, watch, or skip?: Try it on a non-critical repo. Keep Claude provider preview behind team policy, check GitHub's note about bypass permissions mode, and compare per-turn credit use before making it your default coding path.

Read source

Audit permissions Varonis SearchLeak research

SearchLeak is the Copilot permission warning to act on

What changed: Varonis Threat Labs disclosed SearchLeak, a Microsoft 365 Copilot vulnerability chain that it says could expose sensitive data such as emails, meeting details, MFA codes, and private organizational files with a single click. Varonis says Microsoft has mitigated the issue.
Why it matters: Who should care: Microsoft 365 admins, operators, and anyone connecting AI assistants to email, calendar, SharePoint, OneDrive, or internal documents. The risk is not only a chatbot answer; it is the assistant's reach across existing permissions.
Try, watch, or skip?: Do not panic, but run a permission review. Find overshared folders, stale guest access, sensitive labels, and users whose Copilot access reaches data they should not need.

Read source

Try for normal work Google Workspace Vids avatars

Google Vids avatars are a useful low-risk AI video test

What changed: Google Workspace said anyone with a Google account in the US can try AI avatars in Google Vids at no cost, with more regions rolling out later. The post focuses on turning presentations, training material, and updates into short videos with avatars, voiceovers, and generated clips.
Why it matters: Who should care: non-technical readers, solo creators, teachers, support teams, and small-business operators. This is a practical AI use case: make a short explanation once instead of repeating the same presentation live.
Try, watch, or skip?: Try one safe video: a public FAQ, a feature walkthrough, or an internal process with no customer names, unreleased plans, or private documents. Keep it short enough that a human can review every line.

Read source

Tool Worth Trying Today

Google Vids avatar explainer

Turn one existing slide, help article, or SOP into a one-minute avatar video and judge whether the format saves explanation time.

Best for: Creators, teachers, founders, support teams, and operators who need repeatable explanations but do not want to record themselves every time.

Watch out: Start with non-sensitive material. Do not upload private photos, customer records, HR issues, legal documents, or unreleased product plans unless your Workspace admin, retention settings, and sharing controls are clear.

Source: Google Workspace Vids avatars

Privacy / Cost Watch

Security agents need tighter permissions than chatbots. If an AI tool scans code, logs, tickets, or repos, document read access, write access, retention, and who validates every finding.
GitHub notes Claude as agent provider preview currently runs in bypass permissions mode. Treat that as a test-lab feature, not a default for sensitive repos.
SearchLeak is a reminder to clean up document permissions before adding AI search or assistant features on top of existing workspaces.
AI video tools can make sharing easier, but they can also leak faces, names, scripts, customer examples, and internal plans. Review the final video and the source material before publishing.
Varonis' SearchLeak research is this week's permission warning: a connected AI assistant can turn existing email, files, calendar, and SharePoint access into a bigger data-exposure surface.

One Practical Workflow

Run a 30-minute AI permission and cost audit

Pick one AI assistant or agent you used this week.
List what it can read: files, email, repos, chat, calendar, browser, or tickets.
List what it can change: code, docs, settings, messages, deployments, or purchases.
Check whether every run has a visible cost signal, log, or usage report.
Remove one permission, set one budget limit, or move one risky task back behind human approval.

Builder Note

The product lesson today is permission design. The winning AI tool is not the one with the most autonomy; it is the one that makes scope, cost, logs, rollback, and review visible before users trust it with real work.

Ignore For Now

Ignore vague AI security claims

Skip vendors that say they use frontier AI for security but cannot show how findings are reproduced, how false positives are removed, what data the model sees, and who approves patches.

Bottom Line

The useful AI move today is to make control visible. Use AI to find bugs, explain work, and help with code, but keep permissions narrow, premium-model use intentional, and sensitive data out of tools whose retention and admin controls you have not checked.

Sources

Past issues RSS