AI Weekly Malaysia

California Governor Gavin Newsom signed SB 947, the 'No Robo Bosses Act', which bars employers in the state from relying exclusively on 'automated decision-making systems' to fire or discipline workers, and restricts AI's use as a 'principal tool' in those decisions. The signing reverses Newsom's veto of an earlier version of the bill last October, which had passed both legislative chambers with overwhelming majorities. The report does not detail penalties, effective dates, or enforcement mechanisms.

Why: The law bans AI as the sole or principal decision-maker, not AI as an advisor — so if you build HR, people-ops, or agentic workflow tooling for California employers, the compliant design is AI producing a recommendation that a named human reviews and signs off on, with that review logged. If you sell to US customers from Malaysia, decide now whether human-in-the-loop approval is a default in your termination/discipline flows or a per-customer config, because retrofitting an audit trail after a customer asks is the expensive path.

TechCrunch reports the FBI sent staff an internal notification declaring a "cyber security incident" after hackers stole personal data — names, addresses, job titles, and Social Security numbers — from the FBIJobs.gov application portal. The ShinyHunters group claims it exploited a vulnerability in an Oracle PeopleSoft server hosting HR data, and outlets have since confirmed stolen medical records including blood and urine samples and psychiatric reports. The group says it is not seeking a financial ransom but is demanding correction of an earlier claim.

Why: Oracle PeopleSoft is common HR/ERP infrastructure, so the concrete lesson here is that an internet-facing HR portal can leak SSNs plus medical and psychiatric records in one hit. If you run or integrate PeopleSoft (or any HR app holding applicant data), the decision to make now is whether that portal needs to be publicly reachable at all, and whether you even need to retain applicant medical data after rejection. Note the ransom posture: this group reportedly skipped a cash demand, so paying-ransom playbooks and 'we'll just restore from backup' assumptions do not map to this incident.