U.S. federal cybersecurity agency CISA said it did not have a prepared response plan for how it should handle a cybersecurity incident in May, after an investigative reporter notified the agency that a contractor had publicly exposed sensitive keys and credentials for accessing U.S. government systems.

CISA, the Homeland Security unit tasked with defending federal networks and helping to safeguard critical infrastructure, revealed Friday in a post-mortem report that its staff “had to spend time building [a playbook] during the early stages of the incident.” The agency said it is important to prepare playbooks for “all anticipated needs” to ensure that organizations are ready to respond in the event of a security incident rather than scrambling to improvise one in real time.

The agency did not say how long the missing playbook delayed CISA’s response, and a spokesperson did not immediately respond to TechCrunch’s request for comment. 

Independent cybersecurity journalist Brian Krebs reported in May that a security researcher with cyber firm GitGuardian alerted him to reams of exposed passwords stored in a publicly accessible GitHub repository, which an employee of a CISA contractor had uploaded.

According to Krebs, the researcher tried to alert the contractor but didn’t hear back. Only after Krebs contacted CISA did the agency take the repository offline and revoke and replace all of the exposed credentials to prevent any potential future abuse.

CISA said that no customer or mission data was exposed in the incident and thanked the researcher and reporter for their help. The agency said that its channels for allowing security researchers to notify CISA of potential incidents “were not well defined,” and that it has made changes to make it easier and faster for researchers to contact the agency.

CISA has been without a permanent director since the start of President Donald Trump’s second term in January 2025. The agency has also been affected by cuts, furloughs, and layoffs affecting about a third of its workforce since Trump took office. 

Phia, the shopping startup co-founded by Bill Gates’ daughter, Phoebe Gates, and Sophia Kianni, has been accused of a practice known as “cookie stuffing,” which may have helped the product receive commissions and credit for sales it did not actually generate, according to a Bloomberg investigation. 

The report has sparked controversy and led to Phia’s suspension from Impact.com, a leading affiliate and influencer platform. Other startups have been sued over “cookie stuffing,” notably Honey, which is owned by PayPal and remains the subject of an ongoing class action lawsuit. 

Founded in 2025, Phia has raised more than $40 million in funding and has a star-studded list of investors, including Kim Kardashian and Hailey Bieber. The startup developed an app as a browser extension that works somewhat like Google Flights, but for shopping. Phia helps customers find the lowest-priced items across various retailers as well as discount codes to use when shopping. The company takes a commission on purchases made through the platform through an industry practice known as affiliate marketing. 

The Bloomberg investigation, as well as findings from an independent consultant and a competitor, found that if a user shopped at an online retailer — even if they arrived at the site on their own or through another affiliate program like Wirecutter — Phia would open a new tab in the background. During the checkout process, Phia would override the referral codes from other affiliates and instead inject its own, allowing it to take credit for and potentially receive a commission on a purchase it didn’t earn. 

Once the issue was flagged to Phia, a spokesperson told Bloomberg that all necessary changes had been made to fix the issue. A check by Bloomberg found the issue had been resolved. It’s unclear if the fix is enough to satisfy the retailers and affiliate partners that work with Phia.

TechCrunch reached out to Phia for comment and has not received a response.

Meta has axed a controversial feature that allowed users to modify photos from public Instagram accounts using AI. The feature, which was rolled out earlier this week along with a batch of other AI tools, “missed the mark” and is no longer available, according to the company.

Earlier this week, Meta announced Muse Image, a new AI image generator built by its dedicated AI unit known as Meta Superintelligence Labs. Meta promoted one feature that allowed individuals to generate images by @-mentioning public Instagram accounts that they wanted to reference. The feature, which wasn’t designed to alert a user if their photos were used in this way, prompted immediate backlash.

TechCrunch wrote its own guide explaining to users how to disable the feature.

Now, Meta has reversed course. The company issued a blog post Friday announcing that it was removing the feature. Puck News founding partner Dylan Byers was the first to share the company’s decision.

“Our intent was to provide a useful creative tool and to give people control over whether their public content could be referenced in this way,” the company posted on its blog. We’ve heard the feedback that this feature missed the mark, so it’s no longer available.

TechCrunch reached out to Meta for more information and will update this article if it responds.

Since its integration with social media platforms, AI has been misused with wild abandon — often to generate naked images of female celebrities. Platforms have attempted to mitigate this trend, although the guardrails introduced have often fallen short.

In the case of Meta’s newly nixed feature, it seems somewhat obvious that it would have been abused in this way. Indeed, Byers notes that the decision to do away with the feature came “amid scrutiny from users and talent agencies, including CAA”.