Health onboarding voice agent reads back caller's date of birth — security review finds privacy leak
yupperspuppers1 · reddit · 2026-11-15
A health onboarding voice agent that collects medical history and books lab work was found in review to read back a caller's stored ZIP code and date of birth whenever asked "what do you have on file?" — a serious privacy leak since anyone on the phone can ask that.
The same review surfaced two more issues: skipping screening questions like dialysis or pregnancy when callers rush, and booking lab work after the care-team visit instead of before. These only appear in unusual conversations, so spot checks keep missing them. The author asks how to test "never say X" and ordering constraints before real patients call — synthetic callers with fake data?
More from Safety
- Bypassing Opus 5.5 refusals with a 'boss' agent: multi-agent setups revive the confused deputy flaw — rickasaurus · 2026-11-15
- Claude-BugHunter: Claude Code skill bundle with 82 skills for bug hunting hits 5.9k stars — elementalsouls · 2026-11-15
- South Korea's top tax accountant exam scorer admits to cheating with AI — Polymarket · 2026-11-15
- Anthropic filing: restricted customers (likely Chinese distilling) ≈5-7% of revenue — StewartalsopIII · 2026-11-15
- Rutger Bregman reverses stance: 'We need to stop the AI industry, including Anthropic, right now' — birchlse · 2026-11-15
- 159k Lovable Apps Scanned: Many Expose Chats and Passport Data via Misconfigured Supabase APIs — bibryam · 2026-11-15