Caveat Briefing for 11.12.26

France attributes refrigerator hacks to Iran.

France has claimed that the refrigerator hacks being experienced across Europe were caused by Iran’s Revolutionary Guards.

New York prepares to launch a new AI testing system.

New York Governor Kathy Hochul is preparing to launch a new program that looks to independently test AI systems and train AI safety experts.

Iran accused of causing series of refrigerator hacks.

THE NEWS

On Monday, French officials formally accused Iran of launching a series of cyberattacks that compromised refrigerators across Europe. In a joint report, France’s cybersecurity and intelligence agencies accused Shahid Kaveh, an alleged Iranian offensive cyber unit, of launching the attack and named Hamid Reza Lashgarian, Mahdi Lashgarian, and Reza Salarvand as alleged associates of the group. 

The report also stated that the group masquerades as vigilante hackers, using names like “CyberAveng3rs” and “Cyber Isnaad Front.”

The report also stated that a total of 700 sites had been targeted within France and that at least fifteen fires had occurred.

France’s foreign minister, Jean-Noel Barrot, stated:

“This is the first large-scale cyberattack aimed at sabotage on national territory and it constitutes a major assault on the nation’s interests and the security of the French people.”

For context, these attacks caused the internal temperature systems within refrigerators to behave abnormally, raising temperatures so high that they would catch fire. Additionally, the incident caused crates of meat and other refrigerated contents to spoil, costing millions of euros.

Outside of food stores, these attacks also reportedly impacted blood banks within France, forcing employees to move stored blood to different cold storage units.

THE KNOWLEDGE

Since the war between the US and Iran began in 2026, there has been a significant increase in concern regarding Iranian hostile cyber operations. However, unlike other nation-state actors, Iran has not been consistently attributed to cyberattacks that look to engage in espionage. Rather, Iranian cyberattacks have consistently taken a more destructive approach.

Earlier this year, municipalities across the US experienced a cyber incident that impacted water systems. The attacks, which were attributed to Iranian threat actors, caused providers in over twelve states to shut down pump stations, raising the risk of contaminated water. 

These recent refrigerator attacks demonstrate how this same approach is being extended to other industries. Rather than targeting corporate networks to steal information or obtain financial leverage, these operations aim to sow as much physical damage as possible. By manipulating refrigeration controls, attackers are able to disrupt food storage, damage inventory, and create hazardous conditions. 

The attacks represent the inherent vulnerabilities associated with operational technologies. Many of these systems have been designed to ensure constant availability, leaving them prone to cyber attacks. As organizations increasingly connect these devices, the risks related to operational compromises only grow.

THE IMPACT

These refrigeration attacks demonstrate how cyber operations targeting operational technology will produce consequences that extend beyond the traditional IT environment. The compromise of these controls will directly impact the physical processes that consumers often depend on every day.

The real-world impacts create a difficult challenge for both businesses and critical infrastructure operators. Refrigeration systems, water facilities, and other industrial equipment are designed to prioritize reliability and availability, not security. However, as these systems become increasingly connected, they are going to introduce additional opportunities for unauthorized access. Organizations may therefore find themselves managing cybersecurity risks across equipment that was not originally designed with modern network threats in mind.

For organizations, these incidents reinforce the importance of incorporating operational technology into broader cybersecurity strategies. These processes include identifying internet-facing industrial systems, replacing outdated equipment and firmware where possible, restricting access, and ensuring that critical systems could be isolated. As the attacks demonstrate, protecting the networks that support physical infrastructure is increasingly important to maintaining the services and resources that businesses and communities rely on.

New York launches a new AI testing program.

THE NEWS

On Tuesday, Governor Kathy Hochul launched a new program that looks to independently test AI systems alongside training the next generation of AI safety experts. When announcing the program, Governor Hochul stated:

“While the federal government fails to act, New York is leading the way on AI safety and holding big tech accountable. The stakes are too high to simply take AI companies at their word.”

Additionally, the state’s RAISE Act will come into effect on January 1st, which will now require AI developers to submit detailed safety frameworks. The new center will be tasked with reviewing these frameworks to assess their thoroughness.

The center is partially funded by a $30 million gift from Tom Secunda and a $25 million research investment from SUNY and the state. Secunda commented that:

“AI is opening up questions that scientists could not tackle before. With Empire AI and researchers across New York, the Center can test systems independently and give public officials evidence they can use.”

THE KNOWLEDGE

New York’s RAISE Act is one of the more comprehensive state AI bills. The legislation requires qualifying AI developers to establish and publish safety frameworks, improve transparency, and report critical safety incidents to the state. Further, the bill also establishes stronger oversight capabilities and empowers the state’s attorney general to issue civil penalties for violations. 

However, establishing safety requirements does not necessarily guarantee that AI systems will operate as intended. One of the bigger challenges that regulators will need to address will involve the ability to independently evaluate AI models and whether the safeguards put in place are effective.

Through more robust independent AI testing, researchers will be able to better evaluate for potential vulnerabilities, unintended behaviors, and weaknesses in their safety mechanisms. If New York’s AI center is able to help address these challenges, then it could prove to be a use case for other states to better monitor and address AI risks.

THE IMPACT

While it is unclear how effective these new policies will be, this new center may prove to be a model for other states to institute independent AI inspections. Several states have pursued stronger AI safety requirements, alongside greater financial penalties and government oversight. However, many of these requirements still rely heavily on AI developers to establish their own safety frameworks, evaluate potential risks, and report incidents.

Reliance on self-assessments and reporting can create challenges when evaluating the effectiveness of AI safety practices. Companies may have difficulty identifying weaknesses in their own systems, particularly when relying on internal evaluations to determine whether existing safeguards are sufficient. Additionally, developers may have competing commercial interests that influence how they assess and communicate potential risks.

The effectiveness of this approach will ultimately depend on the center’s ability to conduct meaningful evaluations, access the systems and information necessary for testing, and translate its findings into actionable regulatory guidance. If successful, New York’s initiative could establish a framework for other states seeking to balance AI innovation with greater accountability.

Dave Bittner, Ben Yelin, and Ethan Cook sit down to discuss the outcomes associated with the recent results from the US’s 2026 midterm elections. Given the significant race wins for Democrats across both federal and state elections, the results will not only significantly impact the Trump administration’s policies but likely will also impact cybersecurity, AI, and national security.

Listen to the episode now. 

Meta expanding AI age checks for Instagram.

What: Meta is planning to expand its AI age-estimation technologies on Instagram, Facebook, and Messenger to improve Teen Account protections.

Why: On Monday, Meta announced new protective measures for its Teen Accounts. These new measures will look to automatically limit who can contact teens. Further, parents within the US will begin receiving Instagram notifications explaining how teens are placed in age-appropriate protections.

NOVEMBER 9, 2026 | Source: Reuters

Microsoft presses Trump to scuttle expected ban on Chinese data center technology.

What: Microsoft has been pressing the Trump administration to halt its plans to bar the Chinese imports of key components used in AI data centers.

Why: On Tuesday, reports emerged that Microsoft has been pressuring the Trump administration to stop the implementation of its planned policy to bar the Chinese importation of key components used in AI data centers. The administration created the policy due to concerns that China would be able to steal data, install malware, or disrupt service availability.

John Miller, Executive Vice President of Policy and General Counsel of the Information Technology Industry Council (ITI), commented on the proposed policy:

“It really threatens to arguably grind [the data center rollout] to a halt.”

NOVEMBER 10, 2026 | Source: Reuters

Google agrees to add privacy protections for data sale.

What: Google will implement stronger data protections for sold Spirit Airlines data.

Why: On Tuesday, Google agreed to add stronger data privacy protections from the acquisition of employees’ data from Spirit Airlines. Google gained access to this data after paying a $10 million deal to acquire Spirit’s data to train its AI models. 

Google won the auction for this data in August and now gains access to Spirit’s email, spreadsheet, and calendar data.

NOVEMBER 10, 2026 | Source: Reuters