Dark.ai's privacy promise, Meta's $25B bill and a WhatsApp scam that skips your OTP
Eternal says its new AI can't read your chats, Meta gets a record fine it can afford, Chrome's scam shield gets smarter, a WhatsApp takeover that needs no OTP, and a half-written AI rule for TV news.
- Long Press · Daily Five23 Oct 202601 / 05
commentaryIndiaEternal's Dark.ai says it can't read your chats. Prove it.
Eternal, the company behind Zomato and Blinkit, said in its October 21 shareholder letter that it is building Dark.ai, a general-purpose AI assistant running fine-tuned open-weight models on its own servers. I like the ambition. I'm not ready to buy the headline line, "We cannot read your conversations, even if we are forced to." A chatbot has to process your prompt to answer it, so what matters is where the keys sit and what gets logged, and Eternal hasn't said. No price, no audit, and a launch that's "hopefully" this year.
The questionWhat is Eternal's Dark.ai assistant and is it really private?
In one lineDark.ai is a general-purpose AI assistant from Eternal, Zomato's parent, revealed in its October 21, 2026 shareholder letter. It runs fine-tuned open-weight models on Eternal's own servers and claims end-to-end encryption, but there's no audit, key-custody detail or price yet, so the privacy claim is unproven.
The problem
Most people paste work documents, health worries and money questions into chatbots run by companies that also sell ads or train on that data. Privacy-first assistants exist, but almost none come out of India.
What changed
According to MediaNama, Eternal's October 21 letter pitches Dark at founders, researchers, enterprises and governments, with end-to-end encryption and an encrypted memory layer users control. It has been piloted inside Zomato for a few months on open-weight models hosted on Eternal's own infrastructure, and a global launch is hoped for within 2026.
The catch
Nothing in the letter explains how the model answers a prompt it supposedly can't read, who holds the decryption keys, or whether there will be an audit. CFO Akshant Goyal called it a "zero one bet" that Eternal will shut down if it doesn't work, which is honest, though not exactly comforting if you've moved your work into it.
What it means for you
Interesting to watch, not something to plan around yet. When it launches, look for a published security design or a third-party audit before you paste in anything you wouldn't email to a stranger.
Questions people ask
When will Eternal's Dark.ai launch, and how much will it cost?
Eternal's letter says Dark will launch globally, hopefully within 2026, after a few months of internal pilots at Zomato. There's no price yet. CFO Akshant Goyal said it may be priced so that not everyone wants it, which reads like a premium product aimed at founders, researchers, enterprises and governments first.
Can Eternal's Dark.ai really not read my conversations?
That's Eternal's claim: it says it cannot read your conversations, even if forced to. The letter doesn't explain how the model answers prompts it can't read, who holds the keys, what's logged, or whether chats train models. Until Eternal publishes that, or an independent audit, treat it as a promise rather than a guarantee.
SourcesMediaNama ↗
- Long Press · Daily Five23 Oct 202602 / 05
commentaryMeta owes New Mexico $25 billion. It'll barely notice.
A New Mexico judge ordered Meta to pay $25 billion on October 21, after a Santa Fe jury found close to 44 million violations of the state's consumer-protection law over what Facebook told users about their data, hate speech and Cambridge Analytica. It's a record-sized number that will barely dent the company: Meta reported $64.6 billion in third-quarter revenue the same week, and it's appealing. The part that could matter more is the state's plan to rewrite the $5,000-per-violation cap, which is what held this penalty down from a theoretical $220 billion.
The questionWhy was Meta ordered to pay $25 billion in New Mexico?
In one lineOn October 21, 2026, New Mexico judge Francis Mathew ordered Meta to pay $25 billion after a jury found close to 44 million violations of the state's Unfair Practices Act over Facebook's privacy claims and its Cambridge Analytica response. Meta says it will appeal.
The problem
Meta spent years telling users they controlled their data while the Cambridge Analytica fallout showed otherwise, and fines so far have mostly been a cost of doing business.
What changed
Judge Francis Mathew picked the highest penalty level, citing the involvement of senior Facebook leadership, according to Source NM. The jury had sided with the state on 31 of 34 counts. The state asked for up to $40 billion, the $5,000 cap per violation shaped the final figure, and it accrues 15% annual interest until paid.
The catch
Meta will appeal, so no money moves for a while. Set against Meta's Q3 2026 results, with $64.6 billion in revenue and $135 to 145 billion of projected 2026 capex, $25 billion is a bad quarter rather than a reckoning.
What it means for you
Nothing changes in your Facebook or Instagram settings because of this. The habit that helps is the old one: check what each app can see, and treat privacy promises as marketing until a court or regulator has tested them.
Questions people ask
Will Meta actually pay the $25 billion New Mexico penalty?
Not soon. Meta's chief legal officer C.J. Mahoney called the ruling a tax on speech and said Meta is confident it will win on appeal, and the state's attorney general expects one. The penalty accrues 15% interest a year until it's paid, so a long appeal isn't free for Meta either.
Does the New Mexico Meta ruling affect Facebook users in India?
Not directly. The case was brought under a New Mexico consumer-protection law and the money goes to that state. What it shows Indian users is that courts are starting to put a price on misleading privacy claims, which is worth remembering the next time an app promises you full control of your data.
- Long Press · Daily Five23 Oct 202603 / 05
tipChrome's Enhanced protection just got a Gemini scam checker
Google's October 2026 Chrome update put its newest scam defences behind Enhanced protection, so it's worth 30 seconds to switch on: Settings > Privacy and security > Security > Enhanced protection. Standard protection is fine for most sites. Enhanced now adds server-side Gemini checks on fake antivirus and fake browser-update pages, plus a warning when a page tricks you into copying a 'verification' command into your computer, which is the ClickFix scam. The price is that Chrome shares the URLs you visit and small page samples with Google. On a parent's laptop I'd take that deal every time.
The questionHow do I turn on Enhanced protection in Google Chrome?
In one lineOn a computer, open Chrome, click the three-dot menu, then Settings > Privacy and security > Security > Enhanced protection. Since Google's October 2026 update, that mode gets server-side Gemini scam checks and ClickFix warnings. The trade-off is that Chrome sends visited URLs and small page samples to Google.
The problem
ClickFix scams show a fake error or CAPTCHA and tell you to paste a command to fix it, which quietly installs malware. Browser warnings built for dodgy links weren't designed to catch that.
What changed
Per SecurityWeek, Chrome now has a second 'suspicious site' warning level, has moved Gemini scam analysis to Google's servers for all Enhanced protection users, and checks copied commands that look like ClickFix payloads. Separately, Chrome now asks before opening unencrypted HTTP sites for everyone.
The catch
The best bits only work in Enhanced protection, and that mode sends more browsing data to Google, as the Chrome Help page spells out. If you'd rather Google didn't see your URLs, Standard plus some care is a fair choice.
What it means for you
Turn it on for any computer used by someone who clicks first and thinks later. Then tell them the rule anyway: no real website will ever ask you to paste a command to prove you're human.
Questions people ask
What does Chrome's Enhanced protection do that Standard protection doesn't?
Enhanced protection checks sites in real time with Google Safe Browsing and scans suspicious downloads more deeply. Since Google's October 2026 update it also gets server-side Gemini analysis of fake antivirus and fake browser-update pages, and warns you when a page gets you to copy a malicious ClickFix command.
What data does Chrome Enhanced protection send to Google?
Google's Chrome Help page says it sends the URL of sites you visit, a small sample of page content, extension activity and system information to Safe Browsing, used only for security. If you're signed in and turn it on for your Google Account, that protection can extend across other Google services as well.
SourcesSecurityWeek ↗Chrome Help ↗
- Long Press · Daily Five23 Oct 202604 / 05
myth busterIndiaNever shared your OTP? Your WhatsApp can still be taken over.
Rajasthan Police warned on October 22 that scammers are taking over WhatsApp accounts with fake QR codes and links that quietly connect your account to their device, and no OTP is involved. That's the part people miss. We've spent years drilling 'never share the OTP' into our parents, which is right, but it has left a lot of them thinking that's the only door into the account. Once a scammer's device is linked, they can read chats and message your contacts asking for emergency money in your name. Check your Linked devices list today and switch on two-step verification.
The questionCan someone hack my WhatsApp without my OTP in India?
In one lineYes. Rajasthan Police warned on October 22, 2026 that scammers use fake QR codes and links to connect a victim's WhatsApp to their own device, with no OTP needed. They then message contacts asking for emergency money. Checking Linked devices and turning on two-step verification shuts most of this down.
The problem
Most WhatsApp safety advice is about OTPs and verification codes. Linking a new device with a QR code uses neither, so people who follow the advice to the letter still get caught.
What changed
The Rajasthan Police advisory, reported by Udaipur Times, lists fake QR codes, impersonation to get OTPs or two-step PINs, abused app permissions and remote-access apps as the main routes in. Once inside, scammers ask contacts for money for emergencies or medical treatment and send suspicious links.
The catch
Two-step verification mostly stops someone re-registering your number on a new phone; it won't necessarily undo a device link you approved by scanning. The Linked devices list is what catches the QR route, and almost nobody opens it unless someone tells them to.
What it means for you
Open Linked devices now and log out anything you don't recognise, then do the same on your parents' phones this weekend. If a friend asks for urgent money on WhatsApp, ring them on a normal call before you pay, and report fraud on 1930.
Questions people ask
How do I check if my WhatsApp is linked to another device?
Open WhatsApp and go to Linked devices, under Settings on iPhone or the three-dot menu on Android. Every computer or browser using your account is listed there with when it was last active. Tap any session you don't recognise and log out, then turn on two-step verification with a recovery email.
What should I do if my WhatsApp is hacked through a QR code?
Rajasthan Police advise logging out unknown linked devices, re-registering WhatsApp with your number, and securing two-step verification and your email. Warn your contacts through another channel, save screenshots as evidence, and report it at cybercrime.gov.in, on the 1930 helpline, or at your nearest cyber police station.
SourcesUdaipur Times ↗
- Long Press · Daily Five23 Oct 202605 / 05
hot takeIndiaThe I&B Ministry's AI rule for TV news skips the label
The Ministry of Information and Broadcasting's advisory to private news channels, signed October 21, says AI use "may be limited to assistive capacity". That's the whole AI section. It doesn't say what assistive means, and it doesn't ask channels to label AI anchors, even though Aaj Tak's Sana has been on air since 2023 and the ministry itself wants more AI presenters on DD News. The licensed AI anchor isn't really the risk. The deepfake clip of a real anchor forwarded on WhatsApp is, and a consistent on-screen label is the simplest way to tell the two apart.
The questionWhat did the I&B Ministry say about AI anchors on Indian TV news channels?
In one lineIn an advisory signed October 21, 2026, the Ministry of Information and Broadcasting told private satellite news channels that AI use "may be limited to assistive capacity" and must not compromise accuracy. It doesn't define assistive, doesn't mention AI anchors directly, and doesn't require any AI labelling.
The problem
AI anchors are now normal on Indian TV, and fake AI clips of well-known anchors already circulate. Viewers have no consistent way to tell an authorised AI presenter from a forgery.
What changed
According to MediaNama, the advisory came on the recommendation of the ministry's Inter-Departmental Committee and bundles the AI line with instructions on live anti-terror coverage, debates, Survey of India maps and disaster visuals. It cites a Programme Code provision for those other instructions, but none for the AI guidance.
The catch
An advisory without a definition is easy to follow and hard to enforce. The ministry took 144 actions against private channels between 2021 and 2025, mostly warnings and apology scrolls, so the stick here was never very big.
What it means for you
If a clip of a famous anchor says something wild, check the channel's own handles before forwarding it. And if you think AI anchors should carry a label, now is a good time to say so, because this rule is clearly still half-written.
Questions people ask
Which Indian news channels use AI anchors?
Aaj Tak has run AI anchor Sana since March 2023 and an AI version of Anjana Om Kashyap. India Today launched Sutra with BharatGen in February 2026, and News18, Odisha TV, Power TV and BIG TV use them too. DD Kisan has AI Krish and AI Bhoomi, and the ministry wants more on DD News.
Do Indian TV news channels have to label AI anchors or AI content?
Not under this advisory. MediaNama's reading is that the October 21 advisory asks channels to use AI carefully and within the Programme Code, but sets no disclosure or labelling requirement for AI anchors or AI visuals. Programme Code violations can still draw action under the Cable Television Networks Act, 1995.
SourcesMediaNama ↗
Taps
Quick hits. One line each, for when a long press is too much.
- IndiaInc42 ↗
Swiggy will move Instamart to an inventory model within three quarters
Blinkit made the same switch first. Inc42 says Swiggy expects up to 80 bps more contribution margin once it's fully rolled out.
- IndiaThe Hacker News ↗
eMudhra will exit the global SSL/TLS certificate business after its weak-key failure
It follows browsers blocking eight intermediate certificates with guessable private keys, per The Hacker News.
- IndiaMediaNama ↗
Bengaluru police arrest man over AI video of fake Vidhana Soudha blast
The Instagram clip mixed real footage with an AI explosion. He's booked under BNS public-mischief sections, per MediaNama.
- GlobalDimsum Daily ↗
Unitree's H2-X humanoid video shows it vaulting a car and lifting one
No specs, price or release date, and no word on which moves were teleoperated. Enjoy it as a trailer, per Dimsum Daily.
- GlobalTechCrunch ↗
OpenAI is reportedly raising $30 billion at a $1.25 trillion valuation
Coatue leads with UAE investors, per TechCrunch. Last month's reported figure was $1.4 trillion, so the number is drifting down.