NEWS
Taiwan Flags AMap, Bilibili, iQiyi and Bimobimo as High-Risk Data Apps
Taiwan’s Ministry of Digital Affairs named four Chinese-made apps high-risk on Wednesday, after security testing confirmed all four transmitted user data to servers in China: AMap, Bilibili, iQiyi, and Bimobimo. Cyber Security Administration Director Lee Yu-wei (李昱緯) announced the findings at a news conference in Taipei and urged residents to stop downloading or using any of the four.
The warning extends beyond government buildings, yet its reach has a hard limit. Taiwan’s agencies are already barred from Chinese-made apps under the Cyber Security Management Act, which applies to government bodies and designated critical-infrastructure operators. That statute reaches no further. For ordinary civilians, Wednesday’s advisory carries no legal force.
Four Apps Flagged at a Taipei News Conference
Lee Yu-wei’s announcement covers four distinct corners of Chinese digital life: navigation, short-video and video streaming, and social communications. Security tests, conducted under Taiwan’s standard cybersecurity evaluation framework, found permission requests in each app that exceed what their stated core functions require.
Taiwan’s National Security Bureau had separately briefed legislators earlier in May, with NSB Director-General Tsai Ming-yen telling the legislature’s Foreign Affairs and National Defense Committee that investigators found security concerns in nine of the 15 reviewed categories for the navigation app alone. Data collected by that platform included contact lists, call histories, audio and video feeds, and location information – all transmitted back to servers in China. Wednesday’s announcement from the Ministry of Digital Affairs represents the full public assessment that the NSB’s May briefing had signaled was coming.
The announcement came roughly five weeks after the ministry banned the navigation app from government agency devices in April, when officials noticed the app was displaying traffic-light countdown timers at Taiwan road intersections without any integration with local traffic management systems. That observation pointed to an active data channel between the app and servers in China: the platform was processing Taiwan road conditions through an undisclosed path.
We remind the public to avoid downloading and using high-risk apps as much as possible to protect their property and privacy.
Lee Yu-wei, Cyber Security Administration Director at Taiwan’s Ministry of Digital Affairs, Taipei, May 27, 2026.
Permissions Beyond Each App’s Core Function
The Navigation App: Location, Contacts, and Background Transmission
The platform requested three categories of access that stand apart from its mapping function. Contacts permissions gave it the ability to read names, phone numbers, and the address-book social graph of any user who approved the request. Location permissions were configured to operate while the app was closed, meaning a device that had not opened the app in hours was still recording and transmitting GPS coordinates. Combined, those two permissions let the app construct a profile of who a user knows and where they have been, across periods when the user was not actively engaging with any map service.
The ministry’s testing further found that all four flagged apps requested Android audio and video access with no disclosed function requiring a microphone or camera. For the navigation platform specifically, that permission stacks on top of the location and contacts risks, opening three simultaneous access points to the physical environment of the device’s owner.
Bilibili, iQiyi, and Bimobimo: Storage and Media Access
Security tests found all three apps requested broad Android storage permissions extending beyond the sandboxed folders where apps conventionally keep their own data. At that level of access, a platform can read documents, photos, and files belonging to other applications – a capability with no evident function in video streaming or social messaging. Each of the three also requested audio and video access on Android devices, matching the same permission profile found in the navigation app.
The Baidu-owned streaming service carries a specific regulatory history in Taiwan. In 2020, Taiwan’s Ministry of Economic Affairs barred Taiwanese companies from acting as agents or distributors for Chinese OTT services – a restriction documented in Freedom House’s Taiwan internet freedom review and framed largely around that platform and Tencent’s streaming products. That earlier rule covered the distribution channel. It did not prevent individual users from downloading the app directly. Wednesday’s advisory addresses that gap.
All three apps send data to servers in China regardless of where their users are located. Whatever the apps collect, Chinese law determines who can demand access to it.
| App | Primary Function | Permissions Beyond Stated Function | Data Destination |
|---|---|---|---|
| AMap | Navigation | Contacts access; location while closed; background data transmission; audio/video on Android | Chinese servers |
| Bilibili | Video streaming | Storage access; audio/video on Android | Chinese servers |
| iQiyi | Video streaming | Storage access; audio/video on Android | Chinese servers |
| Bimobimo | Social platform | Storage access; audio/video on Android | Chinese servers |
China’s Surveillance Laws Reach Every Server
Testing found no trojans or embedded malware in any of the four apps. The security risk sits at a different layer, one written into law rather than code. Any company running servers under Chinese jurisdiction falls under a framework that gives Chinese authorities access to user data without independent judicial review.
China’s National Intelligence Law, passed by the Standing Committee of the National People’s Congress in June 2017, requires “all organizations and citizens” to “support, assist, and cooperate with national intelligence efforts.” The obligation attaches to Chinese-jurisdiction companies regardless of where their customers live. A Taiwanese resident using the navigation or streaming apps named Wednesday is a data source governed by the same rules as a user in Shanghai.
China’s Cybersecurity Law, first enacted in 2017 and revised in legislation that came into force in January 2026, reinforces that obligation. Article 28 of the law compels “network operators” – a category that explicitly covers social media platforms, application creators, and other technology companies – to provide technical support to public security and national security organs upon request. No warrant or judicial authorization step is specified. The Data Security Law of 2021 added further provisions requiring companies to align cross-border data flows with government directives and classifying certain data categories as subject to mandatory government access.
Taiwan’s National Security Bureau made the linkage explicit in its own assessment, stating that under China’s Cybersecurity Law and National Intelligence Law, “Chinese enterprises are obligated to turn over user data to competent authorities concerning national security, public security, and intelligence.” The FBI’s Internet Crime Complaint Center PSA 260331, published in March 2026, reached the same conclusion for American users, warning that apps maintaining digital infrastructure in China are subject to Chinese national security laws that enable government access to mobile app user data.
Nine Months of App Warnings in Taiwan
Wednesday’s announcement is the sixth distinct round of Chinese app warnings from Taiwanese authorities since mid-2025. The flagged category expands with each round; the civilian-use restrictions do not.
- July 2025 – Taiwan’s National Security Bureau tested Rednote, Weibo, Douyin, WeChat, and Baidu Netdisk against 15 security indicators. Rednote failed all 15. Weibo and Douyin each violated 13.
- November 2025 – Officials named DeepSeek and four other Chinese AI models as security threats after testing found data collection and permission overreach across all five.
- December 2025 – The ministry publicly named Douyin, Xiaohongshu, Weibo, WeChat, and Baidu Netdisk as high-risk services and urged the public to delete or avoid them.
- January 2026 – The restricted software list was updated to include TikTok, Weibo, WeChat, RedNote, and Baidu, with officials noting that under Chinese law those companies may be compelled to provide user data to Beijing.
- April 2026 – The navigation app was banned from government agency devices; Taiwan’s defense ministry extended the restriction to service members’ personal phones. A full civilian-risk assessment was promised for May.
- May 27, 2026 – The full assessment was released. The four apps were classified high-risk for public use.
The category arc runs from social media through AI tools to navigation and entertainment platforms. Every wave adds a different app type to the same list, pointing to the same legal destination for the data each collects.
Government Devices Are Barred, Civilian Phones Are Not
The structural gap Wednesday’s announcement did not close is the civilian one. The Cyber Security Management Act applies to government agencies and specific non-government entities including critical-infrastructure providers, state-owned businesses, and government-sponsored foundations. Other than sector-specific rules for financial institutions and telecoms, no equivalent cybersecurity requirement covers the general public. An advisory from the ministry is not a prohibition.
No mechanism under current Taiwanese law removes apps from private phones or compels Apple’s App Store or Google Play to delist the four flagged services in Taiwan. Both platforms continue to distribute the apps globally under content policies set outside Taipei. The Carnegie Endowment’s analysis of China’s data access obligations describes the same problem: these laws may compel companies to cooperate with Chinese defense and intelligence services even when doing so would violate the laws of the country where those companies operate, and the absence of independent judicial oversight within the Chinese system leaves affected parties with little recourse. The US Department of Homeland Security’s data security advisory framework puts the same point in blunter terms, noting that under China’s national intelligence law, firms are required to share data with the Chinese government upon request even when that request is illegal under the jurisdiction where they operate.
Aggregate data is the risk that individual permission notices obscure. A single contact list from one device is a minor data point. Contact lists, location histories, and audio metadata harvested passively across months from several hundred thousand engineers, journalists, defense contractors, and government workers become a human-intelligence map of Taiwan’s professional and social landscape. Taiwan noticed the navigation app was processing Taiwan road data in April, roughly three years after the app became freely downloadable on the island. The May 27 assessment names three more apps working on the same structural logic. Whether civilian devices will be required to remove any of them is a political question the ministry has left unanswered.
GAMING
Xidax X-6 RTX 5070 Ti Gaming PC Hits Its 30-Day Low at Newegg
Newegg has the Xidax X-6 Series gaming desktop at $2,449.99, marked down from its $2,999.99 list price and sitting at its lowest point in 30 days. Inside the Onami White chassis sits an NVIDIA GeForce RTX 5070 Ti with 16GB of GDDR7 memory on NVIDIA’s Blackwell architecture, a Ryzen 7 9800X3D processor boosting to 5.2GHz, 32GB of DDR5 dual-channel RAM, and a 2TB NVMe (Non-Volatile Memory Express, the high-speed solid-state storage interface) SSD, assembled and serviced in Xidax’s Utah facility.
Comparable RTX 5070 Ti builds from standard-tier brands typically land between $2,200 and $2,400, without the boutique build quality. Getting an Xidax at this price narrows that premium to a question worth answering seriously. But the configuration also draws a hard line: the Ryzen 7 9800X3D is purpose-built to maximize frame rates, not to power a dual-role creative workstation, and that shapes who this deal is actually for.
Boutique Pricing Hits a 30-Day Floor
Xidax gaming PCs sit above the typical prebuilt price band for equivalent hardware, and for visible reasons. Every unit ships hand-assembled from the company’s Utah facility rather than rolling off an offshore production line. The X-6 Series Onami White features curved tempered glass panels, an aRGB interior, and a case designed to function as a display piece as well as a gaming rig. The premium case and in-house assembly are baked into that original $2,999.99 price tag.
At $2,449.99, the arithmetic changes. The boutique premium over a budget-tier prebuilt with the same GPU shrinks to somewhere between $250 and $450 depending on which alternative you’re comparing, and Xidax’s build quality gap over those alternatives is real. Newegg’s 30-day low badge tracks against the broader spring pattern: 50-series prebuilt inventory has expanded since January, and deal frequency on RTX 5070 Ti systems has increased noticeably heading into summer.
Where the Xidax X-6 currently sits relative to three competing builds in the same GPU tier:
- $2,449.99 for the Xidax X-6 Onami White (Ryzen 7 9800X3D, 2TB SSD, boutique Utah assembly, on sale at Newegg)
- $2,399.99 for the ZOTAC MEK RTX 5070 Ti (Ryzen 7 9700X, 1TB SSD, OEM build), recently $200 off on Amazon
- $2,189.99 for the HP OMEN 45L (Intel Core Ultra 7 265K, RTX 5070 Ti, 1TB SSD), $310 off on Amazon
- $2,000-$2,200 is the range where Skytech and ABS RTX 5070 Ti builds from brands like the Skytech King 95 and ABS Kaze II Ruby cluster, typically with a Ryzen 7 7800X3D or 9700X
What NVIDIA’s Blackwell Architecture Delivers
The RTX 5070 Ti sits between two clear market positions. The RTX 5070 below it handles 1440p gaming well but gives up VRAM headroom and ray tracing performance. The RTX 5080 above it adds substantially more compute headroom, but at a price that pushes most prebuilts to $3,000 or higher. For ultra settings at 2560x1440p resolution without leaning on upscaling, the RTX 5070 Ti handles the load natively. At 4K, DLSS 4 (Deep Learning Super Sampling, NVIDIA’s AI-powered frame upscaling system) and MFG (Multi-Frame Generation, an AI technique that inserts additional rendered frames between native ones) do the heavy lifting in supported titles.
The Blackwell silicon in this card carries several measurable improvements over NVIDIA’s prior Lovelace generation. Key specifications from NVIDIA’s published Blackwell architecture documentation:
- 16GB GDDR7 video memory on a 256-bit bus, providing strong bandwidth for high-resolution textures, ray-traced scenes, and VRAM-intensive mods
- 8,960 CUDA cores for rasterization and general-purpose GPU compute across gaming and creative workloads
- 4th-generation RT Cores for hardware-accelerated ray tracing, a full generational step over Lovelace’s third-generation implementation
- 5th-generation Tensor Cores driving DLSS 4’s AI upscaling pipeline, including the Multi-Frame Generation mode that can multiply effective frame output in supported games
For creative applications, the card handles 4K video editing timelines and mid-complexity 3D rendering without issue. Its ceiling relative to the RTX 5080 shows up in sustained professional rendering pipelines, where the compute gap compounds over hours. Paired with the Ryzen 7 9800X3D, the combination is optimized for gaming output rather than professional throughput.
The 9800X3D Cache Advantage at 1440p
AMD’s Ryzen 7 9800X3D runs 2nd-generation 3D V-Cache, AMD’s process of vertically stacking 64MB of additional SRAM directly onto the processor die. The result is a total 96MB of L3 cache, compared to the 32-64MB typical of non-X3D desktop processors. The cache’s job in gaming is to keep more of the game’s actively used code paths and rendering instructions on the die itself, so the CPU spends less time waiting on slower system RAM. Those waits create frame time spikes and elevated 1% lows, the stutter a player feels even when average frame rate looks high.
In gaming benchmarks, the architecture lead over Intel is significant. Tom’s Hardware’s review of the 9800X3D found it outperforming Intel’s Core 9 285K by approximately 35% on average across a broad test suite, a margin Intel has not closed through multiple successive chip generations. The VRLA Tech benchmark analysis confirms the same pattern in 2026: the 9800X3D’s advantage is most pronounced at 1440p, where the GPU is handling meaningful load but the CPU still influences frame pacing. At 4K, games shift closer to fully GPU-bound operation and the cache advantage narrows.
The second-generation cache design also places the SRAM below the processor cores rather than above them, a structural change from the first-generation X3D architecture. Positioning the cache beneath the cores improves heat transfer away from the die, allowing the 9800X3D to support AMD’s Precision Boost Overdrive overclocking feature. Standard prebuilt configurations like the Xidax X-6 run at rated clocks rather than a tuned PBO profile, but the stock performance at 4.7GHz base and 5.2GHz boost still delivers the smoothest frame delivery available from a consumer gaming CPU in this generation.
Xidax X-6 Versus the Value Tier
Three builds from the current market establish what the Xidax premium buys and where cheaper alternatives make a stronger case:
| Feature | Xidax X-6 Onami White | HP OMEN 45L | ZOTAC MEK RTX 5070 Ti |
|---|---|---|---|
| Current price | $2,449.99 | $2,189.99 | $2,399.99 |
| GPU | RTX 5070 Ti 16GB GDDR7 | RTX 5070 Ti 16GB GDDR7 | RTX 5070 Ti 16GB GDDR7 |
| CPU | Ryzen 7 9800X3D (5.2GHz boost) | Intel Core Ultra 7 265K | Ryzen 7 9700X (5.5GHz boost) |
| RAM | 32GB DDR5 | 32GB DDR5 | 32GB DDR5 |
| Storage | 2TB NVMe SSD | 1TB NVMe SSD | 1TB NVMe SSD |
| Assembly | Boutique, Utah in-house | HP OEM | ZOTAC OEM |
| Best fit | Gaming-first, premium aesthetics | Gaming plus creative workloads | Gaming, value-focused |
The HP OMEN 45L makes a specific argument for buyers who do more than game. Intel’s Core Ultra 7 265K carries 20 P-core threads and a multi-threaded compute profile that outperforms the 9800X3D in video encoding, compilation, and sustained rendering tasks. At $260 less than the Xidax, it pairs that Intel flexibility with the same GPU and the same RAM, though it ships with half the storage. For anyone who edits, streams at professional settings, or runs demanding creative software alongside gaming, that $260 is better spent on the OMEN.
The ZOTAC MEK is the value play. Its Ryzen 7 9700X (Zen 5 architecture, 5.5GHz boost, no 3D V-Cache) trades cache depth for a higher boost clock, which helps in applications that scale with frequency rather than cache size. For pure gaming performance head-to-head against the 9800X3D in cache-sensitive titles, the 9700X concedes ground. The Xidax’s 2TB storage advantage also matters practically, given that modern AAA titles routinely exceed 100GB per install.
Who This Build Serves, and Who It Doesn’t
The strongest case for the Xidax X-6 at $2,449.99 is the gaming enthusiast who values build quality and is comfortable paying a moderate premium over a budget prebuilt for something that looks and feels different. Boutique assembly and case design hold real value for buyers who will live with a PC on their desk for three or more years. The 9800X3D’s 3D V-Cache advantage is most visible in open-world titles with complex geometry streaming, strategy games running dense AI agent calculations, and simulation games, which collectively describe a large portion of the 2026 AAA release calendar. Combined with the RTX 5070 Ti’s Blackwell feature set, this configuration will handle that workload at 1440p ultra settings without compromise.
Two buyer types should skip it. Heavy creatives doing sustained video editing, 3D rendering, or compilation work need Intel’s higher core count or AMD’s own Ryzen 9 9950X3D over the 9800X3D. The cache architecture that makes the 9800X3D exceptional for gaming trades off the raw multi-threaded throughput those workflows require. Buyers watching their budget more carefully will find RTX 5070 Ti systems from Skytech and ABS starting $250 to $450 below the Xidax, capturing the same GPU tier with a 7800X3D or 9700X processor in a standard prebuilt case. Note also that the Xidax X-6 Series listing on Newegg carries a component brand disclaimer: specific internal component brands may vary from what is advertised, which is standard practice for boutique builders managing parts availability.
The 30-day low badge marks this as an active deal window, not a permanent price shift. If the Xidax X-6 climbs back toward $2,549 or above in the coming weeks, the arithmetic against the HP OMEN 45L and the ZOTAC MEK tightens considerably, and the boutique premium becomes harder to justify. At $2,449.99, it holds. At $2,549, the HP OMEN’s $360 price gap starts doing real work.
NEWS
How to Remove Your Phone Number From Google Search Results
Type your own name into Google. If your phone number, home address, or email shows up in the results, Google’s free “Results About You” tool lets you request removal directly from your account without filling out lengthy legal forms.
The dashboard scans Google Search for your personal contact details on a rolling schedule and notifies you each time something surfaces. In February 2026, Google expanded it to flag government-issued ID numbers too. Most users have never opened it.
What the Results About You Dashboard Covers
- 3 contact types monitored: phone numbers, email addresses, and home addresses
- February 2026: the update added government-issued ID number monitoring, including US Social Security Numbers, and streamlined bulk removal for explicit images
- 2 removal outcomes when a request is approved: full URL de-listing for most cases, or query-based removal for pages that also carry publicly valuable content
“Results About You” is a privacy dashboard accessible at Google’s Results About You privacy dashboard or through the Google app. Once you enter your name and contact details, Google scans its search index on a regular schedule and notifies you whenever those details appear in a result. You can then request removal of any flagged result from the dashboard itself, or directly from a search results page using the three-dot “More” menu next to any result.
That same update also simplified the removal process for explicit images, adding a three-dot menu option inside Google Images and enabling bulk removal requests instead of one-at-a-time submissions.
On data handling, Google states it stores the contact information you provide for monitoring using advanced encryption and access controls. The company says it does not use this data to personalize ads or share it with third parties, limiting its use to monitoring, processing removal requests, and maintaining request history within your account.
Setting Up Monitoring and Submitting a Removal Request
Setting Up Monitoring
- Go to myactivity.google.com/results-about-you, or open the Google app, tap your profile picture, and select “Results about you.”
- Select “Get started” or “Settings.”
- Enter your name. You can add nicknames, maiden names, and alternate spellings.
- Add your contact details: mobile numbers, home addresses, and email addresses. The tool accepts multiple entries for each type.
- Turn on notifications. Google emails you when a search result matches your entered details, with follow-up alerts as new results appear over time.
Submitting a Removal Request
Once you receive an alert, Google displays the flagged result in the “To review” tab. Select the result and choose “Request to remove.” If no removal option appears on a given result, it comes from a source Google considers valuable to the public, and the self-serve removal path is not available for that entry.
You can also trigger a removal from a standard search results page. Click the “More” dots next to any result, select “Remove result,” then “It shows my personal info and I don’t want it there,” then “Contact Info,” and follow the steps through. For situations involving harassment, doxxing, or professional information posted with intent to harm you, Google’s detailed removal request form covers a broader range of circumstances than the self-serve dashboard handles.
Checking Your Request Status
After submission, Google sends an email confirmation within a few hours. The “Removal requests” tab inside the dashboard shows whether each request is in progress, approved, denied, or undone. There can be a short delay between approval and the result actually disappearing from search, but Google says the change typically takes effect within hours once a request clears review.
What Google Removes and What It Keeps
Every request goes through a public-interest review. Results from government agencies, universities, and news publications typically stay in the index even when they contain your phone number or home address. The table below covers the main content types and how Google handles each one.
| Content Type | Google’s Position | Notes |
|---|---|---|
| Phone number, home address, or email | Removes when approved | Must be your personal info, not a business listing you control |
| Government-issued ID numbers (SSN, passport) | Removes when approved | Coverage formally expanded in the latest tool update |
| Bank account or credit card numbers | Removes when approved | Covered under Google’s older personal information policy |
| Results from government or educational sites | Will not remove | Treated as public record; no removal option shown in the tool |
| Results from news publications | Will not remove | Treated as public-interest content |
| Info you control directly (your own social media or personal blog) | Will not remove | Google expects you to delete it at the source yourself |
A denied request comes with an explanation via email, and the dashboard shows the specific reason for each one. Some cases can be escalated through the detailed removal request form for situations involving harassment or doxxing, where a broader policy framework applies.
Your Data Stays at the Source
Removal from Google Search does not delete the underlying information from the website that published it. Google’s own support documentation says plainly that even after a result is removed from Google Search, it might still be on the internet.
This matters because people-search directories and data brokers operate on a crawl-and-republish cycle. If your phone number appears on a people-search aggregator, removing the Google result blocks strangers from finding it through a Google query, but the original listing stays live on the host site. Market research firm SNS Insider projected the data broker industry would reach $441.4 billion in value by 2032, driven by companies that continuously harvest and re-index personal records from public sources. A number cleared from Google today can resurface in new search results weeks later from a different URL on the same or a different platform.
Treating a Google removal request as the first step is correct. Treating it as the final one is where most people stop short.
Building a Broader Privacy Layer
Google’s tool works best when paired with parallel steps at the original sources. The following actions close the gaps the Results About You dashboard cannot reach on its own:
- Contact the source site directly. Most people-search directories publish an opt-out process. Some require identity verification; others process requests automatically within a few business days.
- Register with the Do Not Call Registry. In the United States, the National Do Not Call Registry is free and permanent. Registration takes effect within 31 days for compliant telemarketers.
- Set a Google Alert for your phone number. Enter your number as the search query at google.com/alerts. You’ll get a notification when it appears in newly indexed content, giving you time to file a removal request before the result accumulates traffic.
- Audit your public social media profiles. Phone numbers listed openly on Facebook, LinkedIn, or older forum accounts feed directly into the data broker pipeline. Making those fields private stops fresh data from entering the cycle.
- Consider a data removal service. Paid options automate opt-out requests across hundreds of data broker databases, a meaningful time saving for anyone with a long online history or an elevated-risk situation such as harassment or stalking.
Frequently Asked Questions
Does removing my phone number from Google Search delete it from the internet?
No. Removing a result through Results About You delists it from Google Search but leaves the content intact on the original website. To fully remove your information, you need to contact the site owner directly. Many people-search directories have automated opt-out pages; others require a written request or identity verification before they process the removal.
How long does Google take to process a removal request?
Google sends an email confirming receipt within a few hours of submission. The review process itself typically takes several days. Once a request is approved, the result usually disappears from search within a few hours, though Google notes a short delay is possible between the approval decision and the listing leaving the index.
What if Google denies my removal request?
Google denies requests when the result comes from a source it considers valuable to the public, such as government, educational, or news sites, when the information is something you can remove yourself at the source, or when it determines the content serves a broader public interest. The Results About You page shows the specific reason for each denial. Cases involving harassment, threats, or doxxing can often be escalated through Google’s personal information removal guidance, which covers a wider set of circumstances than the self-serve dashboard.
Can I use Results About You without a Google account?
The monitoring and dashboard features require a Google account. Without one, or if you prefer not to sign in, Google’s detailed removal request form lets you submit manual removal requests without logging in, though you won’t be able to track request status or receive automated alerts through the app.
Will my phone number come back in Google results after it is removed?
Possibly. If the source website still hosts your number and gets re-crawled, the information can reappear from the same or a different URL. Removing the data from the original site and setting a Google Alert for your number together significantly reduce the risk of it cycling back into the index without your knowledge.
The Results About You dashboard runs on a continuous schedule, checking your entered details against newly indexed results on a rolling basis and sending a notification each time something surfaces. Treat it as a standing alert rather than a single task to tick off. The phone number you cleared this week can reappear from a different source next month, but with monitoring active, you’ll catch it before a stranger does.
NEWS
Vigolium AI Scanner Puts Token Budget Decisions on Operators
Vigolium shipped its first open-source release this month with more than 250 scan modules and an in-process AI agent, called olium, that plans its own attack strategy, generates custom JavaScript extensions mid-scan, and re-checks every finding in a separate triage pass before delivering results to the operator. The project comes from a single author, Jessie Ho, and sits on GitHub under an AGPL (Affero General Public License, an open-source license that requires any entity making the software available over a network to also publish their modifications as open source) license at no cost.
The more consequential decisions in the design are not the module count. They are buried in the budget controls: how much token spend an operator permits per session, what the agent does when time runs out, and why the same JavaScript extension model that gives Vigolium its adaptability also makes a community extension marketplace a genuine security problem.
Two Modes, One Stack
Vigolium exposes two scanning paths from a single command-line interface. The first, vigolium scan, runs a deterministic multi-phase pipeline covering content discovery, browser-based spidering for single-page applications, and active and passive auditing across a module library of 251 scanners covering injection, access control, framework-specific checks, and out-of-band attack testing. That last category includes OAST (Out-of-Band Application Security Testing, a technique for detecting blind vulnerabilities like server-side request forgery and blind injection, where the payload triggers a callback to an external server rather than producing a visible response change). It is repeatable, fast, and fits a CI/CD (continuous integration and continuous delivery, the automated pipeline that tests and deploys code on each commit) gate without touching a language model. The full module breakdown is in Vigolium’s GitHub repository and architecture documentation.
The second path, vigolium agent, hands control to the olium runtime. The LLM (large language model, an AI system trained on large text datasets to generate and reason with language) harness selects its own modules, writes custom scan extensions based on what it observes in the target, and combines static source-code analysis with live dynamic testing. Eight AI providers are supported, including Anthropic’s API, OpenAI, Google Vertex AI, and self-hosted model servers via compatible endpoints such as Ollama and OpenRouter, so the tool is not tied to a single inference vendor.
The gap between the two modes is not only depth versus speed. Cost structure diverges sharply, and that divergence shapes how teams should reach for each.
| Dimension | Native Scan (vigolium scan) |
Agentic Scan (vigolium agent) |
|---|---|---|
| Logic model | Deterministic, repeatable | LLM-driven, adaptive |
| Module selection | Fixed library: 154 active, 97 passive | Dynamic; agent selects and generates extensions |
| Cost structure | Compute only | Compute plus AI token spend |
| Triage | Inline, per module | Separate pass after scanning completes |
| Best fit | CI/CD gates, continuous coverage | Pre-release audits, logic-flaw hunting |
Budget Caps as the First Design Choice
Every autonomous reasoning loop costs tokens. Every tool call consumes context. A session without guardrails can wander for hours on a single target and return findings that are lower quality than a tighter, shorter run would have produced. Vigolium’s operator documentation exposes four configurable caps that are set before each agentic session starts.
- Token cap: Total LLM token spend allowed per session. Raise for single-target deep dives; tighten for broad sweeps where one rabbit-hole target would otherwise consume the whole budget.
- Tool call cap: Maximum agent tool invocations before the session is forced toward a conclusion, stopping open-ended exploration loops.
- Triage iteration cap: Limits how many re-checking loops the agent can run on each candidate finding before delivering a verdict.
- Wall-clock cap: A hard time limit that ends the session regardless of where the agent is mid-task. Ho recommends leaning on this first for CI runs and time-boxed engagements.
Ho described two failure modes from misconfigured caps in remarks to Help Net Security. Set too tight and the agent is cut off mid-investigation, returning a low-confidence stub that the operator still has to decide whether to act on. Set too loose and the agent wanders, spending tokens on diminishing returns and filling a report with noise that should not be there.
His guidance for new users is to open with the wall-clock and iteration caps set conservatively, then loosen only when a genuine investigation is visibly being cut off before reaching a conclusion. The judgment call shifts from the LLM to the human at the configuration stage, which is a more honest accounting of what agentic security tools actually provide: supervised autonomy, not full autonomy.
Triage Runs Separately from the Scan
AI-assisted security testing has a persistent credibility problem: the plausible finding that fails to reproduce. Cross-site scripting (XSS, a class of web attack in which malicious scripts are injected into pages viewed by other users) candidates that the agent reports with confidence but cannot demonstrate are worse than no finding, because they send a developer to chase a ghost and erode trust in every subsequent report from the same tool.
Vigolium handles this by making triage its own phase, run after scanning completes rather than inside it. Ho described the design at the project’s launch:
The scanner finds candidates, then a separate pass re-checks each one against its evidence.
On deduplication, the system favors transparency over quiet cleanup. The agent collapses exact copies of the same issue into a single representative entry but does not make keep-or-kill calls on borderline findings. Anything it is uncertain about is downgraded in severity and surfaced to the operator with its full evidence trail intact, including the specific request-response data that triggered the candidate. Operators see what the agent saw, rather than a curated version of it. That design keeps the audit trail complete and pushes the final judgment to a human, which is where it belongs.
Extensions Run Arbitrary Code Without a Sandbox
Vigolium’s JavaScript engine lets operators write custom scan modules using session-aware HTTP APIs (application programming interfaces, the standard connection mechanism between software services). The extensions run alongside built-in modules, accept command-line flags, and can execute arbitrary commands on the host machine. For teams scanning proprietary authentication flows, unusual API patterns, or frameworks the default module library does not cover, that extensibility is the practical point of the model.
It also creates a material trust problem for any sharing mechanism. Code signing establishes who wrote an extension. It does not tell an operator whether that extension is safe to run against a live application. Asked whether a community registry might emerge, Ho was candid about the constraints any such system would face, as covered in Vigolium’s product overview.
For a registry to function without simultaneously distributing exploits alongside scanners, three conditions would need to hold from the start:
- Provenance and code signing on every submission, establishing a traceable author record so operators know exactly who built each module and when
- An untrusted-by-default posture, with explicit operator opt-in required before any community extension is permitted to execute against a target
- Active curation rather than open submission, keeping the available set small enough to meaningfully review before any module reaches production use
-
CRYPTO3 weeks agoAndreessen Horowitz Bets $2.2B on Crypto’s Quiet Cycle
-
CRYPTO3 weeks agoCathie Wood Calls SpaceX IPO Demand ‘Voracious’ Ahead Of $1.75T Debut
-
NEWS3 weeks agoGhana CSA Plants Office In Ho As Volta Cybercrime Climbs
-
APPS3 weeks agoGoogle’s Buried Page Reveals 500 Niche Websites Still Making Cash
-
NEWS3 weeks agoHormuud Bets $19 Down Will Finally Pull Somalia Online
-
NEWS3 weeks agoApple Strikes Preliminary Deal For Intel To Make iPhone And Mac Chips
-
NEWS3 weeks agoMetalenz Polar ID Hides Face Unlock Under OLED Smartphone Screens
-
AI3 weeks agoGoogle AI Overviews Adds Subscribed Label, Reddit Quotes Inline
