Two Photos Could Flag Diabetes Risk

Enter the singularity, Tech Insiders.

Google is testing whether smartphone photos can flag metabolic risk, OpenAI's safety system is designed to monitor patterns without exposing customer content to its staff, and Stripe says AI has already changed the economy.

Let's see if the future can clear its own CAPTCHA.

Here's what you need to know today:

Google's AI Camera Sizes Up Metabolic Risk

The next health scan may begin with "Say cheese."

Google Research is testing PhotoScan, an AI system that analyzes two full-body smartphone photos—one from the front and one from the side—to estimate body fat percentage and fat distribution. Those patterns, including trunk-to-limb and visceral-to-subcutaneous fat ratios, can reveal metabolic risk that BMI misses.

Built on a dataset of over 35,000 UK Biobank health files and refined using 677 adult volunteers, the prototype estimated body fat more accurately than smartwatch bioelectrical-impedance-analysis sensors (sorry, BIA-equipped Galaxy Watches) in Google's research. Pairing its measurements with age, sex, and BMI improved insulin-resistance prediction to nearly match hospital-grade DXA scans.

The appeal is obvious: A common phone camera could make at-home metabolic screening more accessible and pair neatly with the Pixel Watch 5's new Insulin Resistance Trends. But Google has announced no release plan, and promising research is not a diagnosis.

The awkward full-body photo in the room is privacy. Uploading pictures of your midsection and derived health data demands clear answers about on-device processing, storage, access, deletion, and accuracy before anyone willingly hands over photos of their love handles to the cloud.

Why it matters: Impaired insulin response can lurk for years before type 2 diabetes is diagnosed, so a scalable screening clue could push people toward earlier testing and treatment. Still, PhotoScan should guide a clinician conversation—not crown your camera roll the new radiology department.

Share this newsletter!

Pulse Check

If your phone could flag diabetes risk from two photos, would you try it?

Results from Yesterday's Pulse Check

Which AI behavior worries you most?

Insider Intel

OpenAI Pitches Safety Without Data Retention

OpenAI wants to spot smoke without reading your diary—unless you opt into its new Mac feature, which happily monitors your app and web activity to build unencrypted summaries of your workday.

The AI giant is previewing Private Safety Processing, a security protocol built to flag abuse patterns across a series of AI interactions without exposing user prompts to the company's workforce. The safeguard ensures qualifying API and enterprise customers can maintain zero data retention (ZDR) agreements.

Content stays on customer-controlled infrastructure or will eventually sit securely on OpenAI's servers behind customer-managed encryption keys. When automated systems detect suspicious activity—like a bad actor piecing together a cyberattack over multiple chat sessions—they send only a narrow safety signal instead of full conversation logs.

That contrasts with Anthropic's mandated 30-day retention for covered models like Fable 5, drawing ire from Microsoft's Satya Nadella and Palantir's Alex Karp. For regulated buyers, OpenAI is turning this privacy pledge into a strategic advantage ahead of its targeted 2027 IPO.

The fine print: The preview excludes consumer ChatGPT plans, and potential CSAM images remain a ZDR exception. With a technical white paper arriving in September, the proof is still in the PDF.

Meanwhile, in a masterclass of irony, OpenAI also dropped an opt-in Computer History Mac feature that turns your clicks into plain-text, unencrypted memory files anyone on your device could read.

The AI arms race has officially entered its "privacy for thee, but not for me" era.

Security Alerts

Medusa Ransomware Petrifies 500-Plus Victims

Federal agencies say Medusa ransomware has compromised more than 500 organizations since 2021, a sharp spike from 300-plus last year. While they have a concerning appetite for healthcare, the operation opportunistically hunts whoever leaves internet-facing software unpatched.

Affiliates weaponize exploits within 24 hours—sometimes even a week before they're publicly disclosed—then blend in using native utilities like PowerShell and standard remote-management tools. They steal and encrypt data, threaten leaks, and charge $10,000 to delay publication by a single day.

To fend them off, rapidly patch edge vulnerabilities, require phishing-resistant MFA, segment networks, audit remote-access tools, and keep immutable offline backups. Paying is no undo button: One victim paid up, only for a separate affiliate to demand a second payout for the "true decryptor."

Turns out Medusa's billing department has snakes, too.

Oracle's 943-Patch Fix Fest Gets Critical

Oracle dropped 943 security patches across two dozen product families, turning your weekend into an impromptu IT scavenger hunt. Fusion Middleware took the biggest hit, absorbing 262 updates—with 182 addressing flaws attackers can trigger remotely without a password.

WebLogic is a major headache this round, featuring a pile of CVSS 9.8 bugs reachable via T3, IIOP, and RMI. Don't ignore Oracle Internet Directory's perfect 10.0 LDAP Server flaw, either. Oracle reports no active exploitation yet, but warns that threat actors routinely feast on organizations dragging their feet on patch deployment.

Patch internet-facing systems immediately. Until those updates are applied, harden access: restrict unneeded T3, IIOP, and RMI protocols, segment your network, and hunt for sneaky web shells or surprise admin accounts.

Your weekend maintenance window just filed for mandatory overtime. Good luck.

Flash Bytes

Industry Shakeups

Stripe Routes $7.5B Into OpenRouter

Stripe has agreed to swallow OpenRouter in a deal The New York Times reports is worth $7.5 billion—a massive glow-up from the startup's $1.3 billion valuation just three months ago. While the companies are mum on the fine print, the Times notes the founders' payout will sit at $1.5 billion, leaving the VCs to split $6 billion.

OpenRouter currently processes more than 10 trillion tokens daily across 400-plus models for over 10 million developers and businesses, acting as the "Stripe for AI"—which makes the acquisition perfectly meta. Stripe isn't just processing payments anymore; it's aggressively colonizing the "intelligence pipeline."

For companies using both platforms, whether they are dealing in dollars or AI tokens, the same corporate landlord gets to collect the toll.

But the real kicker? Stripe's investor letter claims the "singularity"—the theoretical milestone where AI outsmarts humanity—actually started back on Jan. 1. It's "operating on that basis" now, which presumably involves buying the entire AI ecosystem before the machines become sentient enough to bypass its transaction fees.

While OpenRouter promises the "same mission" after the ink dries, the industry may reasonably wonder whether a neutral gateway stays neutral when its prospective parent is effectively the landlord of the AI economy. Then again, if the singularity is already here, maybe neutrality is just a legacy feature.

Meet Our Author

Justin Meyers

Writer/Editor at TechnologyAdvice

Justin Meyers is an investigative writer and editor who draws on over a decade of meticulous hands-on research to deliver the full, trustworthy story behind consumer and enterprise tech, including cybersecurity.

Curious about where AI is really headed?

The Neuron cuts through the noise to bring you smart, hype-free takes on the latest AI trends, tools, and breakthroughs. Join 700,000+ professionals from top companies like Microsoft, Apple, Salesforce, and more.

Advertise in Daily Tech Insider!

Daily Tech Insider is a TechnologyAdvice business.

© 2026 TechnologyAdvice, LLC. All rights reserved.

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA.