Hourly Dossiers, Forged Certificates, and What Keeps Jamie Dimon Awake

A TIME Magazine investigation alleges that Meta's AI assistant, Muse, builds behavioral dossiers on its users on an hourly basis — logging inferred preferences, emotional states, likely locations, relationship dynamics, and political leanings continuously rather than generating periodic summaries. The architecture implied by hourly updates requires passive monitoring of user activity patterns beyond what users explicitly share with the assistant, representing a qualitatively different level of granularity from what prior Meta privacy disclosures have described.

The United States still lacks comprehensive federal privacy legislation, leaving enforcement dependent on FTC actions against specific conduct and on Meta's user agreement language, which has historically provided broad consent claims that complicate regulatory challenges. The picture is different in Europe: under the GDPR and the EU AI Act, the type of system TIME describes could trigger fines of four to six percent of global revenue. Meta's global revenue was roughly $165 billion last year, placing potential European exposure in the seven-to-ten-billion-dollar range.

JPMorgan CEO Jamie Dimon raised a separate but structurally related alarm at a financial conference, warning that AI — and specifically a tool he named as Mythos — has increased cyber vulnerability to the banking sector by a factor of ten. His concern centers on AI agents: autonomous systems that can probe thousands of potential vulnerabilities simultaneously, adapt based on what is working, and operate at machine speed. Dimon argued that traditional bank security architectures were designed against human attackers with cognitive limitations on simultaneous operations, and are not suited to the adversarial model that AI agents represent. The Treasury's financial stability oversight function and CISA have reportedly shared this concern privately for at least 18 months.

Google disclosed separately that hackers successfully forged its security certificates — the TLS certificates that serve as the foundational trust mechanism telling browsers that a website is authentic and not an impersonator. A successful forgery of Google certificates, which are trusted by essentially every major device and browser globally, enables man-in-the-middle attacks on encrypted traffic that both endpoints believe to be secure. Prior certificate authority incidents, such as the DigiNotar breach in 2011, caused significant damage; the full scope of what was exposed in the Google case and for how long has not been fully disclosed. The connecting thread across Meta's dossiers, Dimon's warning, and the Google forgery is a widening gap between the expanding attack surface for surveillance and intrusion and the defensive and regulatory infrastructure available to address it.