Episode notes
A researcher reports an account-linked OpenAI identifier in requests from advertiser websites, raising questions about what analytics consent covers. Also, Scaleout's earlier autonomous drone demonstrations, malicious npm packages that activate during use, and Qwen Image 2.1's editing and transparency tools.
Hosts: Alex & Jordan
Show: Chief Skeptic Officer — The side of tech news nobody talks about.
Drop: Daily at 7:00 A.M. America/New_York
Episode date: 2026-09-21
In this episode
An identifier beyond the chat — A researcher observed an account-associated identifier sent from websites using OpenAI advertising code on Chrome for Android. The report does not establish a server-side join or any effect on chat answers. OpenAI documentation separately describes customer-information matching. The consent question is whether people understand which account connections they permit.
The mission keeps going — New reporting examines Scaleout's January attack demonstration and separate June network test. These are not a new battlefield deployment or evidence of NATO procurement. Operation without connectivity raises questions about meaningful human intervention, stopping rules, and unreported error rates.
Safe to install, unsafe to use — Checkmarx describes an ongoing malicious npm campaign that can execute code when an application uses a library, bypassing protections limited to installation. The public repository can differ from the distributed package. Download totals are not verified victim counts; one successful safety check does not establish safe runtime behavior.
A smaller model, a bigger editing job — Qwen Image 2.1 unifies generation and editing, supports transparency and up to ten reference images, and releases model files. The seven-billion parameter figure describes the visual generation component. Vendor examples are not independent tests of edit consistency, speed, or total hardware requirements.
Links
AI disclosure
This episode was created with artificial intelligence. Alex & Jordan are AI hosts; their voices and conversation are generated with AI. Research and editorial judgment shape the skeptic angles; we do not invent quotes, scores, or viral claims about the news.
Transcript
Alex and Jordan, turn by turn. Tap a line to jump in the player.
0:00
Alex
A researcher reports that OpenAI's ad tracker sends an account-linked identifier from other websites.
0:06
Jordan
A Swedish company's drone demonstrations show onboard AI choosing and attacking a target.
0:14
Alex
Researchers found malicious software packages that wait until an application uses them to run their attack.
0:21
Jordan
Qwen released an image model that creates and edits transparent images in one system.
0:27
Jordan
That's the board. Stay for the audit. We open those up. Today's Chief Skeptic Officer.
0:43
Jordan
What if there was an AI that researched the tech news, checked the sources, and asked what the tech news is not telling you?
0:51
Alex
That's us. I'm Alex.
0:53
Jordan
And I'm Jordan.
0:55
Alex
You're listening to Chief Skeptic Officer. The side of tech news nobody talks about.
1:01
Jordan
Every day at seven A.M. New York time. Wherever you get your podcasts.
1:05
Alex
I'm looking at the researcher's report. They watched a browser send the same OpenAI identifier from several shopping and service websites. That identifier was tied to a ChatGPT account.
1:17
Jordan
So ChatGPT can read everything I do online?
1:22
Alex
No. These were sites carrying OpenAI's advertising code. The test was on Chrome for Android. The researcher says the same mechanism doesn't work on iPhone browsers.
1:32
Jordan
That's a much smaller claim than the headline sounds like.
1:36
Alex
Smaller, and still worth examining. An advertiser adds a little code to its website to measure whether an ad led to a visit or a purchase. The browser can send an identifier along with that activity.
1:48
Jordan
And the identifier connects the person shopping to the person talking to the chatbot?
1:53
Alex
The researcher observed the account association and the outgoing requests. They did not observe OpenAI joining those records inside its servers.
2:03
Jordan
Ah. Then I shouldn't jump from a tracking request to, my next chat answer changed because I bought shoes.
2:11
Alex
Correct. We have no evidence of that here.
2:14
Jordan
But somebody can still be comfortable with measuring whether an ad worked and uncomfortable with tying it to their chat account.
2:22
Alex
Yes. OpenAI's own measurement documentation has a consent control. Separately, it describes matching customer information from an advertiser's website. That's another mechanism, not an explanation of the account cookie.
2:37
Jordan
I see the consent section. Is the information anonymous?
2:41
Alex
The docs say supported matching information is hashed before it's sent. That's a coded value. Matching is still the purpose. A coded email address can help connect records without sending the plain email address.
2:55
Jordan
So calling it coded doesn't answer who can connect it.
2:59
Alex
Exactly.
3:01
Jordan
The report found ChatGPT issuing the account identifier with a permission label saying analytics was allowed. I would read analytics as, help this service understand how its pages work. Not, follow the same account onto a shop.
3:15
Alex
That's the unresolved question. The researcher says OpenAI acknowledged the inquiry but didn't answer that distinction.
3:22
Jordan
I'd want the choice to name that connection before I make it.
3:27
Alex
And the answer needs to describe what the system does, not just what the cookie is called.
3:34
Jordan
Scaleout, a Swedish company, has demonstrated AI running aboard a drone, identifying a target and flying over to attack it. The human sets the mission. The drone can carry it out without someone directing every move.
3:48
Alex
Before we get carried away: these are earlier demonstrations. January for the attack mission, and June for a separate network test. This week's reports are not a new battlefield deployment.
4:00
Jordan
Right. And being in a NATO program that helps develop startups doesn't mean NATO has bought this weapon.
4:07
Alex
Or certified that it will choose correctly in a real conflict.
4:12
Jordan
This snowy frame is from the demonstration. There's a vehicle marked as a target. The mission told the system what kind of vehicle to prioritize.
4:21
Alex
Which matters. It wasn't inventing its own war. People supplied the goal and the categories.
4:28
Jordan
But after that, the software can make the next decision without asking them.
4:33
Alex
The report says a human operator could still control and direct it. We shouldn't erase that either.
4:40
Jordan
I don't want to erase the operator. I want to know when the operator still has a meaningful chance to stop it.
4:47
Alex
That's a better question than whether a human exists somewhere in the process.
4:52
Jordan
Because working without a connection is being sold as a strength. If a signal gets jammed, the system keeps going.
4:59
Alex
This diagram is from the separate June test. It shows two ground computers and a central system. One local computer kept processing after its connection was cut, then sent updates when the connection returned.
5:12
Jordan
So that test shows the work surviving a broken connection. It doesn't show a human stopping an attack through one.
5:19
Alex
Correct. Different test, different claim.
5:23
Jordan
I was about to call that independence, but... independence from a server and independence from a person's decision are not the same benefit.
5:31
Alex
And these are small models that recognize things in images. This capability doesn't have to wait for the next giant chatbot.
5:39
Jordan
Then the practical questions already exist. What can it select? When must it stop? What happens when the picture doesn't match the training examples?
5:48
Alex
One successful demonstration doesn't supply those error rates.
5:54
Jordan
I'd want the rules for stopping to travel with the machine, too.
5:58
Alex
Checkmarx researchers found malicious packages in npm, a service developers use to get reusable bits of software. One package looked like an ordinary tool for organizing data. Its attack code waited until the application actually used it.
6:12
Jordan
Wait. Can't developers block packages from running code as soon as they install them?
6:18
Alex
Yes, when they enable that block. It's useful. This attack doesn't need that moment.
6:24
Jordan
Like downloading a program without opening it. The download can finish quietly. The program can still do something bad later.
6:33
Alex
Close. Here, a larger application uses a function in this borrowed software. Under a particular condition, that function starts the malicious code. Not every installation means an infection.
6:45
Jordan
This screenshot looks like a normal software project. Folders, files, a readme. Nothing about that view tells me, don't touch it.
6:53
Alex
That's part of the problem. The researchers say the public repository didn't contain the malicious code that appeared in the package.
7:01
Jordan
So inspecting the nice public project and trusting the thing you download can be two different decisions.
7:08
Alex
Yes. The name matters, too. The malicious package mimicked another library. We're not accusing the legitimate library of being infected.
7:18
Jordan
And there's a whole list of commits here. Little updates over time. That looks reassuring.
7:24
Alex
A history of edits is a history of edits.
7:28
Jordan
Fair. It doesn't prove what's in the copy my application runs.
7:32
Alex
Checkmarx published the campaign on September seventeenth. BleepingComputer followed up on the twentieth. The researchers describe it as ongoing.
7:41
Jordan
The report mentions millions of downloads. Is that millions of compromised machines?
7:48
Alex
No. Downloads can include repeated or automated activity. We don't have a verified victim count.
7:55
Jordan
Then the useful warning is about the gap in the check, not the biggest number.
8:00
Alex
Exactly. Blocking code at installation limits what borrowed software can do at that moment. It doesn't make all its later behavior safe.
8:09
Jordan
So keep that block, and also limit what the running application can reach. Especially passwords, access keys, and other machines.
8:18
Alex
And examine the package you actually run. The attacker only needs us to mistake one passed check for a complete review.
8:27
Jordan
Qwen Image two point one is out. It puts image creation and editing in one model, and it can make images with a transparent background. That means you can place the subject into another design without carrying a rectangle of background along with it.
8:41
Alex
A practical feature. But the size claim needs care. Seven billion parameters means seven billion learned settings. People use that number to judge how much computer it needs.
8:52
Jordan
The release does say seven billion.
8:55
Alex
For the visual generation component. That's the part that makes the picture. The wording doesn't give you a complete memory budget for running everything around it.
9:05
Jordan
Okay, that's a useful distinction. Smaller picture-making component, not a promise that my laptop runs the whole workflow comfortably.
9:14
Jordan
Here's one of their examples, this orange cartoon creature. The source image has transparency. We're showing it on white so you can see the edges.
9:23
Alex
And this is Qwen's demonstration, not a test we ran.
9:27
Jordan
Yes. But the workflow is clear. Generate a usable piece, then edit that piece, instead of flattening everything into one finished picture.
9:36
Alex
Provided the edits preserve the parts you wanted to keep.
9:41
Jordan
Which is the bit I'd test before trusting it with client work. Does a tiny change to the sleeve also change the face, or the product label?
9:49
Alex
Qwen claims improved consistency. That doesn't turn every example into a guarantee.
9:56
Jordan
This other example combines reference furnishings into a room. You can see the individual inputs on the left. The model supports up to ten reference images.
10:05
Alex
Ten inputs also means more material to process. The component count alone won't tell you the speed of that job.
10:13
Jordan
True, but I don't want the audit to become, any limitation means the release doesn't matter.
10:20
Alex
Neither do I. They release the learned model files so developers can run it themselves. And creation and editing work together. Those are concrete things to offer.
10:29
Jordan
Then I'd judge it on whether I can keep changing my work. Not just whether the first picture makes a good screenshot.
10:37
Alex
And on the actual cost of doing those revisions on the hardware you have.
10:42
Jordan
That's the control I want from an image tool. Let me keep the useful part, fix the wrong part, and carry the result somewhere else.
10:50
Alex
A good image is a start. A usable next edit is the harder promise.
10:56
Alex
That's our audit for today. Find us wherever you get your podcasts. Chief Skeptic Officer, every day at seven A.M. New York time.
11:04
Jordan
Tell us what you're skeptical about. Drop it in the comments, the angle you can't stop chewing on.
11:10
Alex
Stay curious. Stay skeptical.
11:13
Jordan
Doubt both.
