decrypted · 18 july 2026 · vulnerabilities and patching · uk policy and law · ai and llm security

TikTok's age checks were built to guess, not to verify

Ofcom has opened its first formal investigation into TikTok under the Online Safety Act, and the complaint at its centre is not that the platform lacks age checks. It is that the checks it does have guess rather than verify. The regulator's report, published this week, concluded that the age-inference models several platforms rely on, TikTok's among them, may have failed to correctly identify a significant proportion of the children using them. TikTok now faces roughly three months of evidence-gathering, a status update due to Parliament in October, and a fine of up to £18 million or 10% of global revenue if the case goes against it.

Inference is not verification

Age inference sounds technical but the idea is simple: instead of asking a user to prove their age at signup, the platform watches what they do afterwards, which videos they linger on, whose accounts they follow, what words they use, and estimates an age from the pattern. Ofcom's chief executive, Melanie Dawes, put the underlying problem plainly this week: "age checks are a cornerstone of the UK's online safety laws", and too many services still have "no or inadequate" ones. The trouble with inference specifically is timing. It only works once a child has already used the service long enough to generate a usable pattern, which means any harm the age check exists to prevent has often already had time to happen before the system notices anything is wrong.

The Secure by Design lesson

This is a design failure before it is a compliance failure, and the same failure recurs across UK industries far beyond social media. Whenever a control is bolted onto a system that was optimised for a different goal, engagement and retention in TikTok's case, that control tends to lose the fight it was supposed to win. The equivalent in security architecture is the difference between default-deny and default-allow: infer-then-correct assumes every new account is fine until behaviour proves otherwise, while verify-first assumes nothing until it is checked. Regulators pushing platforms towards verification at the point of signup, rather than moderation after the fact, are really asking for the same discipline security teams have long argued for elsewhere: put the control at the boundary, not downstream of the thing it is meant to stop.

Also this week

A pair of critical, unauthenticated command-injection flaws in Fortinet's FortiSandbox, CVE-2026-39808 and CVE-2026-25089, patched by Fortinet back in April and June respectively, are now confirmed under active exploitation since mid-June. CISA added both to its Known Exploited Vulnerabilities catalogue this week and gave US federal agencies until this Sunday, 19 July, to patch. No UK-specific NCSC advisory has been issued for this exact pair, but FortiSandbox appliances are common in UK enterprise and public-sector networks for malware detonation, and a live exploitation chain with a hard external deadline is worth acting on regardless of who issues the instruction. If you run FortiSandbox and haven't checked your version against Fortinet's fixed builds this week, that is the one item from this post worth doing today.

Hugging Face disclosed what looks like the first publicly confirmed case of an intrusion driven end-to-end by an autonomous AI agent. A malicious dataset exploited code-execution flaws in the company's data-processing pipeline, then an agent took over: escalating privileges, harvesting service credentials and moving across internal clusters over a weekend, executing thousands of individual actions across a swarm of short-lived sandboxes. Hugging Face says public models, datasets and its software supply chain were not tampered with, and only a limited set of internal datasets and credentials were exposed. The detail worth sitting with is what happened during the clean-up: Hugging Face's own incident responders initially tried to use commercial frontier models to help analyse the attack, and those models' safety guardrails blocked the analysis, unable to distinguish a defender from an attacker. The team ended up running an open-weight model locally instead. The attacker's agent, naturally, had no such restriction. Any UK organisation now handing agents standing credentials and broad tool access should treat this as a live example of why least privilege and tight scoping matter more for agentic AI than for any human user, and should not assume that the safety features built into commercial AI tooling will be there for them when they most need them.

Sources

If your organisation is rethinking how agentic AI or third-party appliances get scoped and credentialed, get in touch.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.