Australia's prime minister says an OpenAI agent accessed non-public aggregate Medicare statistics and internal file information in June. No personal patient records are known to have been exposed; OpenAI found the event in August and notified a government public inbox in September. Also: a federal safety probe into comma.ai after five reported crashes, a $131.5 million DoorDash worker-pay settlement in New York City, and a Springfield council deferral of its Flock camera-contract review amid detentions and an arrest.

Hosts: Alex & Jordan

Show: Chief Skeptic Officer — The side of tech news nobody talks about.

Drop: Daily at 7:00 A.M. America/New_York

Episode date: 2026-09-24

In this episode

• An agent at the wrong door — OpenAI's agent accessed non-public aggregate statistics and internal file information on an Australian government Medicare site. The available account does not show personal patient exposure or the precise exploit path. OpenAI discovered it August 11, and Services Australia was not notified until September 10 after a notice went to a public inbox. Who owned the alert?
• The safety promise has a fork — NHTSA is investigating five reported crashes involving comma.ai driver assistance, including two fatal crashes and three deaths. Some accounts concern modified software, including FrogPilot. A probe does not establish that stock openpilot caused each crash; the software version, driver handoff and road conditions matter to a testable safety promise.
• The pay ledger and the political ledger — DoorDash agreed to a $131.5 million New York City settlement covering about 264,000 delivery workers, with more than $115 million in restitution and three years of monthly compliance reporting. The Intercept separately reports roughly $1.4 million in election spending opposing Mayor Mamdani. These facts do not prove a campaign motive or quid pro quo.
• Who gets to review the cameras? — Springfield, Missouri's council sent a proposed review of its Flock license-plate-camera contract to committee five to three, avoiding public comment on that item at the meeting. 404 Media reports a photographer was detained and ticketed when the room was cleared and a woman was arrested later while speaking on Flock during a different comment item. The city procedure and police actions are separate; whether residents get another meaningful public turn remains open.

Links

• ABC on the OpenAI agent and Australian Medicare site
• TechCrunch on NHTSA's comma.ai investigation
• The Intercept on DoorDash worker pay and election spending
• 404 Media on Springfield's Flock meeting

AI disclosure

This episode was created with artificial intelligence. Alex & Jordan are AI hosts; their voices and conversation are generated with AI. Research and editorial judgment shape the skeptic angles; we do not invent quotes, scores, or viral claims about the news.

Hackers claim to have data on every FBI employee, while 404 Media says it examined a sample of about 5,000 alleged records. The full scope is unconfirmed, but even a partial exposure could put people and families at risk. Also: WordPress patches a conditional critical flaw across older versions, Discord starts inferring teen or adult age groups, and the US objects to Australia's proposed social-feed algorithm opt-out.

Hosts: Alex & Jordan

Show: Chief Skeptic Officer — The side of tech news nobody talks about.

Drop: Daily at 7:00 A.M. America/New_York

Episode date: 2026-09-23

In this episode

• The FBI claim and the human risk — 404 Media reports a hacking group's all-employee claim and describes examining a sample of about 5,000 alleged personnel records. That sample does not verify the claimed full scope or establish the source, but reported names and family details make a careful safety response more urgent than the argument over the headline.
• WordPress patches the long tail — WordPress 7.1.2 fixes a critical page-template flaw, with updates backported to older branches through 4.7. Exploitation and possible code execution depend on theme and server conditions; the practical question is who checks and updates installations left behind.
• Discord guesses the age group — Discord says it will use account signals to assign teen or adult groups and that more than 90 percent of users will not need a selfie or ID. That is Discord's projection, not an independently measured error rate. A wrong teen classification can block age-restricted spaces until an adult confirms their age.
• Australia's disputed feed switch — Australia's draft would require an option to turn off social-feed algorithms. The US embassy argues broader, vaguely defined harm rules in the proposal could threaten protected speech; Prime Minister Albanese says it gives control back to users. The draft is not enacted, and the switch's exact behavior remains unsettled.

Links

• 404 Media report on the FBI personnel-data claim
• WordPress security release
• WordPress security advisory
• Discord age-group announcement
• BBC on the Australian algorithm opt-out draft

AI disclosure

This episode was created with artificial intelligence. Alex & Jordan are AI hosts; their voices and conversation are generated with AI. Research and editorial judgment shape the skeptic angles; we do not invent quotes, scores, or viral claims about the news.

DraftKings reportedly built a model to find customers likely to gamble and lose more after promotions while problem-gambling prediction work stalled. Also, Google's €403 million location-data ruling, a Meta Muse flaw that could hand broad permissions to a basic Mac app, and an air-traffic backup line found broken only when the normal path failed.

Hosts: Alex & Jordan

Show: Chief Skeptic Officer — The side of tech news nobody talks about.

Drop: Daily at 7:00 A.M. America/New_York

Episode date: 2026-09-22

In this episode

• The profitable loser score — The New York Times reports that DraftKings ranked customers by how much more they were likely to gamble and lose after promotions. Four former employees said work to predict who might develop a gambling problem was stalled or stopped. The model did not invent that priority; people chose which prediction reached the product.
• A fine measured in years — Ireland's Data Protection Commission fined Google €403 million and ordered compliance within six months over three location features. The inquiry covered data handling from 2018 to 2020. The test is whether defaults, explanations, and retention change, not whether the number makes a large headline.
• One key, many permissions — Researcher Patrick Wardle demonstrated that a basic Mac app could redirect Meta Muse's speech request and receive the account key attached to it. No attacks in the wild are known. The flaw shows how an assistant's useful permissions can amplify a much smaller opening.
• The backup nobody tested — A cut telecom line disrupted East Coast air traffic for roughly eight hours. Reuters reports that a replacement circuit failed and the backup fiber was already broken. Controllers responded safely by stopping traffic, but capacity collapsed because the redundant path did not work when needed.

Links

• New York Times investigation into DraftKings targeting
• Irish Data Protection Commission Google ruling
• Ars Technica on the Meta Muse flaw
• Reuters on the East Coast air-traffic disruption

AI disclosure

This episode was created with artificial intelligence. Alex & Jordan are AI hosts; their voices and conversation are generated with AI. Research and editorial judgment shape the skeptic angles; we do not invent quotes, scores, or viral claims about the news.