AI Weekly Malaysia

Northeastern University researchers, working with Consumer Reports, ran what they describe as the first large-scale measurement study of the connected-vehicle ecosystem, testing 21 late-model vehicles across 19 brands plus 30 companion mobile apps. They found 19 of 21 vehicles contacted at least one third party over Wi-Fi, 7 of 30 apps transmitted PII to trackers, and 5 of 30 sent VIN plus other PII to trackers. Consumer Reports supplied the vehicle fleet, which the team says would have cost over $1.2M to assemble independently; the peer-reviewed paper lands at IMC '26, and the Hacker News thread drew 233 points and 195 comments.

Why: The number to act on is 7 of 30: roughly a quarter of the tested companion apps leaked personal data to third-party trackers without it being an obvious product feature, and 5 leaked the VIN itself. If you ship a mobile app with analytics, attribution, or ad SDKs, this is a concrete reason to capture your app's outbound traffic and check what identifiers those SDKs attach — a VIN or device identifier leaving your app is a compliance problem you inherit, not one the SDK vendor absorbs. There is no Malaysia-specific finding in the text, so local relevance is indirect: anyone building insurtech, fleet, or vehicle-adjacent apps should treat third-party SDK data flows as part of their own privacy surface.

A Hacker News submission titled "A Privacy Analysis of Web and Mobile Conversational AI Agents" (subtitle: "Prompt like a butterfly, sting like a tracker"), hosted on jorgegarciaherrero.com, drew 378 points and 121 comments. The submitted file is a PDF whose extracted text is raw PDF object/stream data, so no findings, methodology, sample sizes, tracker names, or measurements could be read from the text provided here. Only the title, the tracker-focused subtitle, the source domain, and the discussion activity are verifiable.

Why: You cannot act on this one yet: the PDF text did not decode, so there is no list of trackers, no count of apps or sites tested, and no finding to verify. The one concrete thing you can act on is the community signal — 378 points and 121 comments means a meaningful slice of this audience cared enough to read and argue about conversational-agent privacy. If you ship an embedded chat widget or a conversational agent on web or mobile, the actionable step is to check it yourself before quoting this paper: open your own agent's network tab and confirm which third-party analytics or ad domains load on first message.