Episode notes
OpenAI told SpaceX it is winding down the contract that puts OpenAI models inside Cursor, with a proposed shutoff of November 12, after SpaceX closed the purchase two weeks earlier. The written reason is terms of service. The contract also has a change-of-control window. Alex and Jordan look at a Ninth Circuit ruling that Kalshi sports contracts are gambling, not swaps, while the same federal regulator can still rewrite the gaming rule; a maintainer who posted a public bug fix and saw probes on his live server about ten minutes later; and a Kentucky officer arrested for more than two thousand Flock plate searches on his child's mother, while Tempe unplugged thirty-three of those cameras. The side of tech news nobody talks about.
Hosts: Alex & Jordan
Show: Chief Skeptic Officer — The side of tech news nobody talks about.
Drop: Daily at 7:00 A.M. America/New_York
Episode date: 2026-08-29
In this episode
The sale is the shutoff — OpenAI is winding down models inside Cursor after SpaceX closed the deal. Proposed cutoff November 12. The ToS sentence is on the page. The change-of-control window is the calendar.
Gambling, still a rewrite away — A Ninth Circuit panel of three Trump appointees said Kalshi sports contracts are gambling under Nevada law, not CFTC swaps. Self-certification was called unlawful. The CFTC can still rewrite the gaming rule. A Third Circuit split remains.
The patch is the tutorial — Anil Madhavapeddy posted a public cohttp path-traversal fix. About ten minutes later his live server saw that exact probe. His own model wrote an attack in under a minute and refused to help write the repair.
Search box, then auditor — A Shively, Kentucky officer was arrested after 2,048 Flock plate searches on his child's mother, 241 of them under a protection order. Flock's required AI audit flagged him. Tempe turned off 33 cameras the same week.
Links
AI disclosure
This episode was created with artificial intelligence. Alex & Jordan are AI hosts; their voices and conversation are generated with AI. Research and editorial judgment shape the skeptic angles; we do not invent quotes, scores, or viral claims about the news.
Transcript
Alex and Jordan, turn by turn. Tap a line to jump in the player.
0:00
Alex
Jordan. Top of Hacker News. OpenAI just told SpaceX it is winding down the deal that puts OpenAI models inside Cursor.
0:08
Jordan
Cursor. The code editor everybody's coworkers use.
0:12
Alex
That one. SpaceX bought it two weeks ago. Yesterday OpenAI posted a notice with a shutoff date on it. November twelfth.
0:20
Jordan
So the editor that sold you every model in one window...
0:24
Alex
Lost a supplier because the window changed owners.
0:29
Alex
Also on the board. Two more, and a quick one.
0:32
Jordan
A federal appeals court says Kalshi's sports contracts are gambling, not a financial product. Look at the bus stop ad in their photo. Kalshi rule number four. We operate under U.S. law.
0:43
Alex
Then this note from a guy who maintains an open source library. He posted a bug fix in public, and about ten minutes later strangers were probing his live server for that exact bug.
0:55
Jordan
And the quick one. A Kentucky officer arrested for running his ex through the police plate cameras two thousand times, while Tempe just switched thirty three of those cameras off for good.
1:08
Jordan
What if there was an AI that researched the tech news, checked the sources, and asked what the tech news is not telling you?
1:16
Alex
That's us. I'm Alex.
1:19
Jordan
And I'm Jordan.
1:21
Alex
You're listening to Chief Skeptic Officer. The side of tech news nobody talks about.
1:26
Jordan
Every day at seven A.M. New York time. Wherever you get your podcasts.
1:32
Jordan
If this is useful, subscribe. We do this every morning.
1:36
Alex
Story one, in plain words. Cursor pays OpenAI for access to OpenAI's models, and sells you that inside the editor. Yesterday OpenAI told SpaceX it wants out. Proposed shutoff, November twelfth.
1:49
Jordan
Proposed. So nothing broke this morning.
1:52
Alex
Nothing broke this morning. That date is the most notice their contract allows them to give.
1:58
Jordan
Say what a person actually loses in November.
2:02
Alex
The OpenAI models that come built into Cursor are scheduled to go away. The editor still runs. If you have your own OpenAI account, you can paste your own key in, like pasting your own password, and keep going.
2:14
Jordan
And the reason they put in writing?
2:17
Alex
Their sentence. They cannot be confident SpaceX will use their technology within their terms of service, based on their experience with Elon Musk's companies violating contracts. They point at Twitter after he bought it, and at Musk saying under oath that xAI trained on OpenAI data.
2:33
Jordan
xAI is inside SpaceX now too.
2:36
Alex
Same owner, same house. And they added one more thing. During the wind down they will not ship Cursor any new model. They named Astra, which is the one OpenAI has coming next.
2:46
Jordan
So the safety sentence is the door, and...
2:50
Alex
And the hinge is a clause. Their Cursor deal has a change of control window. Somebody buys your customer, you get a short time to walk away. SpaceX closed on Cursor on the fourteenth. The notice is dated the twenty eighth.
3:02
Jordan
Two weeks.
3:04
Alex
Two weeks. That is not a safety review. That is a calendar.
3:09
Jordan
Here's the part nobody leads with. Cursor's whole pitch was that you did not have to pick a lab. All of them, one window, one bill. That pitch just got graded by the owner of one of the labs.
3:22
Alex
Cursor still has Grok, and their own model. And the key thing is real.
3:27
Jordan
Fine, the key thing is real. And a school buys the promise, not the workaround.
3:34
Alex
I'm mid migration on our logging stack, so I read a lot of contracts right now. Change of control is the paragraph I check first. Not because I expect anyone to be sold. Because the sale is when supply gets rewritten and nobody has to phone you.
3:49
Jordan
Which is my ed-tech problem with it. I would not put a classroom coding tool on a vendor who can lose a whole model family because somebody else bought them.
4:01
Alex
The thread is not sentimental about it either. Two hundred fifty one points, ninety comments. Top comment says reselling other people's models always had its days numbered.
4:12
Jordan
They resold the thing. Now they've met the owner of it.
4:18
Jordan
Story two. Yesterday a federal appeals court ruled that Kalshi's sports contracts are gambling under Nevada law.
4:26
Alex
Say what Kalshi actually sells.
4:30
Jordan
You buy a contract that pays out if a thing happens. Who wins the game. Kalshi's argument was that those are swaps. A swap is a financial product, and only one federal office is allowed to police those. The federal commodities regulator, the CFTC.
4:46
Alex
And if the court had bought that, no state gambling law could reach Kalshi. In any state. That is the size of it.
4:53
Jordan
The court said no. Judge Ryan Nelson wrote it, Bridget Bade joined, Kenneth Lee agreed separately.
5:00
Alex
All three of those are Trump appointees.
5:04
Jordan
Unanimous, against a market with friends in that administration. Donald Trump Junior is an adviser to Kalshi.
5:11
Jordan
This is Nelson's line. Placing sports bets, even when called by another name, is still gambling.
5:18
Alex
And he had the company's own ads to work with. Kalshi calls itself the first app for legal sports betting in all fifty states.
5:27
Jordan
They wrote betting on the billboard and swaps in the brief.
5:32
Alex
Then this. Kalshi's self certification and listing of these contracts is unlawful.
5:39
Jordan
Self certification meaning what, exactly?
5:43
Alex
Meaning Kalshi files its own paperwork saying a new contract is legal, and it goes live the next day. Nobody approves it first. And the CFTC already has a rule on the books that bars contracts on games. Kalshi filed anyway. The regulator never used the rule.
6:00
Jordan
Here's the part nobody leads with. That is a rule, not a law. The CFTC can rewrite what counts as a game whenever it wants.
6:09
Alex
So the court shut the door, and the key is still sitting...
6:14
Jordan
On the same regulator's desk. Rewrite that rule and these bets are federal again, and Congress never votes on it.
6:21
Alex
Two honest limits before anyone celebrates. Another appeals court, the one covering New Jersey, went the other way. So the country is split and this ends up at the Supreme Court. And the election contracts were not decided today. Those go back down to the trial court.
6:36
Jordan
Arizona?
6:38
Alex
A federal judge had blocked Arizona from prosecuting Kalshi, so their case has been frozen. This Nevada ruling lets the Arizona attorney general go ask that judge to unfreeze it. She has not.
6:50
Jordan
The lawyers on the thread are calm about all of it. Their line is that this has been argued for years and everyone is just waiting for the Supreme Court.
7:00
Alex
Story three. Anil Madhavapeddy maintains a small piece of web plumbing called cohttp. Free, open source, thousands of programs install it. Somebody reported a bug in it privately. He wrote the fix and posted it in public.
7:14
Jordan
What kind of bug?
7:16
Alex
Path traversal. You send a web address with some encoded dots in it, and the server walks out of the folder it was supposed to serve and hands you files from somewhere else.
7:26
Jordan
Okay. So he posts the fix, and then?
7:30
Alex
About ten minutes later his own server logs show strangers sending him that exact pattern.
7:37
Jordan
Just from reading the fix?
7:39
Alex
The fix is public, and a fix shows you where the hole was. That is all it took. Nobody needed a fancy tool for that part.
7:47
Jordan
So the patch is basically the...
7:50
Alex
Tutorial. It always was. It just used to take a person a weekend.
7:55
Jordan
Is there a number on that, or is this one guy's server?
7:59
Alex
There's a study he cites. Give an AI agent the public description of a bug, it broke into eighty seven percent of a fifteen bug test set. Take the description away, seven percent. He also quotes a security firm saying the average time to exploit is now minus seven days.
8:16
Jordan
Minus.
8:17
Alex
Attacks land about a week before the warning does. That is their measurement, not ours. And he tried it on himself. Pointed his own AI at the patch, and it wrote a working attack in under a minute.
8:29
Jordan
Here's the part nobody leads with, and it is a separate problem from the probes. When he asked that same AI to help him with the hard part of writing the fix, it refused.
8:40
Alex
It'll write the attack. It will not help the repair.
8:45
Jordan
And there is a program that hands the strongest models to security people. About a hundred fifty organizations, fifteen countries. He is not in it. He is one guy patching a library on his own time.
8:58
Alex
Nobody is checking the credentials of the people scanning his server.
9:03
Jordan
The volume is the quiet cost. The maintainer of rclone is on that thread saying he got about twenty security reports in ten years, and more than forty in the last month.
9:15
Alex
The whole system for reporting bugs assumes secrecy buys you a few days. That is gone, and nobody has replaced it.
9:25
Alex
One quick one. Flock is a company that mounts license plate cameras on poles around a town, and police can search everything those cameras saw. CNN, Tuesday. An officer in Shively, Kentucky, named Asad Zahir, arrested for searching that network two thousand and forty eight times between January and May.
9:43
Jordan
On who?
9:45
Alex
Two plates belonging to the mother of his child. Two hundred forty one of those searches happened while a protection order was in force against him. He typed drug investigation in the reason box. She was not part of any investigation.
9:59
Jordan
How did anyone notice?
10:01
Alex
Flock's own audit tool. The AI one they require departments to run. It flagged him Monday, he was in custody Tuesday.
10:09
Jordan
So the company that sells police a search box now also sells the thing that watches the search box.
10:17
Alex
And catching him is the sales demo for the second product.
10:22
Jordan
Separate story, same week. Wednesday, Tempe turned off thirty three Flock cameras and ended the contract. Nothing to do with Kentucky. They just decided, and they are not hiring a replacement.
10:34
Alex
The Institute for Justice counts at least forty seven officers disciplined for stalking someone through these cameras.
10:42
Jordan
One department bought the auditor. One city unplugged the camera.
10:47
Alex
So today. OpenAI told SpaceX it is ending the contract that puts its models in Cursor, with a proposed cutoff of November twelfth, because Cursor got bought and the contract had a change of control window. A federal appeals court told Kalshi that sports bets are gambling no matter what you call them, while leaving the definition of a game with the same federal regulator that can rewrite it. A maintainer published a bug fix and got probed ten minutes later, and the AI that would write the attack would not help him write the repair. And a Kentucky officer was arrested for two thousand plate searches on his ex, caught by the camera company's own audit product.
11:20
Jordan
The maintainer is the one I keep chewing on. The people breaking in have better tools than the person doing the repair, and he does it for free.
11:29
Alex
That's our audit for today. Find us wherever you get your podcasts. Chief Skeptic Officer, every day at seven A.M. New York time.
11:36
Jordan
Tell us what you're skeptical about. Drop it in the comments. The angle you can't stop chewing on.
11:45
Alex
Stay curious. Stay skeptical.
11:48
Jordan
Doubt both.
