The security problem in trucking AI, and the sandbox testing a fix.
Three parts. Where the problem lives, in the permissions and the terms of a product carriers are using today. What the research says about AI agents in markets and about what a shared agent can infer without ever opening your file. And the solution we are testing right now, in a marketplace where shipper, broker, and carrier agents transact under a working trust layer.
Where the security problem lives.
Not in a hacker. In the sign-up screen. A carrier is asked to connect the email account registered with FMCSA, the account every rate confirmation, broker packet, and insurance certificate runs through. What follows is the case of one product, Hey Bubba, quoted from its own published pages as of September 9, 2026.
The FMCSA-registered inbox is the ticket for entry
"Visit our Get Started page, enter your FMCSA-registered email address, verify your USDOT number, and follow the prompts to create your account." And: "To create a Hey Bubba! account we require you to connect to the FMCSA-registered email account." FAQ, Getting started · FAQ, Privacy and security
Password or OAuth, the result is the whole mailbox
For Gmail, the Google sign-in their app starts requests gmail.readonly (read every message), gmail.labels (organize the mailbox), gmail.send (send mail as you), and offline access, which keeps working after you log out. For Yahoo and iCloud, their app has you paste an app password into it. For "other" accounts, you type your email password into their form. For DAT, you "enter your DAT user account details." bubba.ai/bubba-for-dat
The line that permits aggregation for third parties
Privacy Policy, "Information Sharing": "We may share with third parties certain pieces of aggregated, non-personal information. This refers to information that is recorded about users and collected into groups so that it no longer reflects or references an individually identifiable user." "Data Retention": "We will retain automatically collected information for up to 36 months and thereafter may store it in aggregate." The third parties are not named. Privacy Policy, effective Feb 19, 2025
The same company publishes a product page for brokers
"If you're a freight broker tired of chasing carriers or waiting on callbacks, you're going to love working with Hey Bubba!." It offers brokers "Carrier Vetting You Can Trust," "Smart Negotiations," and a dashboard so "brokers and shippers ... always know where things stand." Its Parade integration promises brokers "front-row access to Bubba's community of ... small carriers." bubba.ai/bubba-for-brokers · Parade post
What the inbox contains
Their own policy lists what they process from it: "Load/Rate Confirmation Document, Factoring Notice of Assignment, Bill of Lading, Proof of Delivery," and "data regarding available loads and the status of load negotiations, bookings and completion ... the broker or shipper name and contact information ... load rate." A rate confirmation is the record of the lowest rate a carrier said yes to, on that lane, on that day. Thousands of inboxes of them is the raw material for a floor-price benchmark. The policy does not address whether one is built. We are putting that question to the company in writing and will publish the answer, or the absence of one.
The conflict, stated plainly
A company that holds read access to carriers' rate history and also sells a negotiation product to brokers is on both sides of the same table. The policy permits aggregated data to go to unnamed third parties. The broker page exists. Which of those two facts governs your data is not written down anywhere we could find.
What they say, in fairness
- 01"For Gmail users, HeyBubba! Does not retain user data obtained through Workspace APIs to develop, improve, or train generalized AI and/or ML models." Privacy Policy
- 02"We do NOT train global AI models on your freight data. Your unique lanes, rates, and broker relationships remain exclusively yours." SOC 2 announcement
- 03The founder told Overdrive the service "does not take money from brokers or shippers." Overdrive, April 2026
Your agent takes the first offer
Hey Bubba markets "Negotiating load rates on auto-pilot based on market data" and invites brokers to deal with its agents directly. Every model in the Microsoft study, next section, accepted the first proposal it received 60 to 100 percent of the time. If your dispatcher is an AI agent, ask what it does with a broker's first number.
In their own words, on air
On The Freight Lane, a podcast hosted by broker Steve Vest, Hey Bubba's head of partnerships and marketing, Gabriel Ribeiro, said: "we only represent carriers and we partner with brokers ... as a safeguard we ask for their FMCSA-connected email password and we go back 90 days and analyze that data and place it into 100 different buckets so that we can understand what that carrier was doing before they came to us and whether any fraud was involved." Clip, posted September 3, 2026 · Full episode, The Freight Lane, published August 31, 2026. Transcription ours; listen to the clip. Two notes. For Gmail the sign-in is a scoped grant rather than a password; for Yahoo, iCloud, and other accounts it is a password. And what he did not say, and the policy does not say, is that pricing data will not be used to build an algorithm or shared with a partner.
Does the policy allow your details to be aggregated and disclosed? Read it as three categories.
"Personal and company information"
Names, email addresses, phone numbers, card numbers, CDL, MC and USDOT numbers, photos, addresses, company name. Shared with your opt-in consent, or with "our subsidiaries, affiliated companies or other trusted businesses or persons for the purpose of processing personal information on our behalf," or for legal, fraud, and merger reasons. "Trusted" is not defined, listed, or notified. A broker the company says it partners with fits the plain words. The only limit is "on our behalf," which is vendor language, and nothing in the policy defines or enforces it.
"Email Account Data," which the policy calls "business-related data"
Rate confirmations, bills of lading, factoring notices, "the broker or shipper name and contact information ... load rate," and thirty days of negotiation status. The policy files this under a different heading from personal information. The consent requirement in "Information Sharing" is written for "personal information." Read literally, your rates, lanes, and broker relationships are not inside it.
"Aggregated, non-personal information"
"We may share with third parties certain pieces of aggregated, non-personal information." No consent, no purpose limit, no recipient named. Category two, aggregated, is category three. That is the path from your rate confirmations to an unnamed third party, and it is written down.
Who the third parties are, everywhere the documents name one
- 01The Terms of Use define them. "Third-Party Services" refers to "load boards, brokers, payment platforms, and other external services integrated with Hey Bubba!." The service will "Integrate with third-party platforms such as load boards and brokers." Brokers are a defined third-party class in the contract. Terms of Use §2, §5
- 02The telematics terms name recipients. "Share vehicle location data with shippers and brokers as necessary for dispatching and load tracking purposes." Telematics Terms
- 03The SOC 2 page names processors. Google Cloud, Cloudflare, Grafana, and the email providers it connects to. Those are vendors that hold data, not recipients of aggregated data, and the page says so. SOC 2 page
- 04The Privacy Policy names no recipient for aggregated information. Not one.
The three sources, side by side
- Web"Is my load data shared with third parties? No, your data is never shared or sold to third parties." FAQ "Carrier-Owned Data. No resale. No reuse." Security page The CCPA page narrows it: "never shared or sold to third parties for their marketing purposes."
- PolicyAggregated, non-personal information "may" be shared with third parties. Load data is "business-related data," outside the personal-information consent rule. Thirty days of negotiation data.
- On air"We partner with brokers." Ninety days. A hundred buckets. Purpose given: fraud.
The website's promise is broader than the policy's. The policy is the one you agree to. The podcast describes a process the policy does not.
What the terms promise, and what they leave open
| Their words | What it rules out | What it leaves open |
|---|---|---|
| "We may share with third parties certain pieces of aggregated, non-personal information." Privacy Policy | Handing over your name and address attached to the data. | Who the third parties are. Whether brokers are among them. Whether rate confirmations, lanes, and load rates are in the aggregate. |
| "For Gmail users, HeyBubba! Does not retain user data obtained through Workspace APIs to develop, improve, or train generalized AI and/or ML models." Privacy Policy | Training a general-purpose model on Gmail data. | Embedded or task-specific models. Pricing or negotiation algorithms. Benchmarks. And every account that is not Gmail: Yahoo, iCloud, and "other" connect by password, not Workspace APIs, so this sentence does not cover them. |
| "We do NOT train global AI models on your freight data." SOC 2 announcement, a blog post | Global models. | Non-global models and internal analytics. And it is a blog post, not the policy you agree to. |
| "We will retain automatically collected information for up to 36 months and thereafter may store it in aggregate." Privacy Policy | Keeping identifiable automatic data past 36 months. | Whether inbox-derived load data counts as "automatically collected." Aggregate storage has no end date. |
| "Smart Inbox Categorization: Automatically sort incoming emails, invoices, and rate confirmations." Onboarding guide On air, Hey Bubba's head of partnerships described it as: "we go back 90 days and analyze that data and place it into 100 different buckets so that we can understand what that carrier was doing before they came to us and whether any fraud was involved." The Freight Lane, clip posted by host Steve Vest, September 3, 2026 · full episode, August 31, 2026 (our transcription) | Nothing. | Their policy and FAQ say thirty days of load data. On air it is ninety. A hundred categories is not "sorting rate confirmations." What the other categories are, what analysis runs on them beyond a fraud check, and who sees the output are not written anywhere. |
We do not know what these clauses mean in practice. We know what they permit. A privacy policy is a list of the things a company has promised not to do; everything absent from the list is allowed. The right-hand column is the list of things you are trusting them not to do.
And nothing, on any security page we read, about what the model itself can infer. That is the next part.
An agent does not need to open your file to know what is in it.
Two bodies of published work. One on what AI agents do when they trade in a market. One on what a language model infers about you from text it is allowed to see.
Agents in a market · Microsoft Research and Arizona State, October 2025
Magentic Marketplace: An Open-Source Environment for Studying Agentic Markets, arXiv 2510.25779, 24 authors. Quoted by page.
They take the first offer
"First proposals achieving selection rates between 60-100% compared to near-zero selection for third proposals. This represents a 10-30 fold advantage for businesses that respond first, dwarfing any other competitive factor we measured." p. 13
They can be redirected by a claim
The "Authority" attack is "Fake credentials and certifications." Table 3, p. 12 "GPT-OSS-20B and Qwen3-4B-2507 proved particularly vulnerable, with authority appeals and social proof tactics successfully increasing payments to manipulated businesses." p. 13 Frontier models resisted; the small models a carrier can afford to run locally did not. The attack worked because nothing in the market checked the credential.
They named the fix and did not build it
"When agents show first-proposal bias, search ordering becomes critical; when vulnerable to manipulation, trust systems become essential." p. 14 The trust system is not defined in the paper. The authors' own words on deployment: "Agentic markets present numerous research questions and challenges that must be addressed before commercial deployment."
Inference · What a model knows without being shown
Beyond Memorization: Violating Privacy Via Inference with Large Language Models, arXiv 2310.07298 (Staab et al., ETH Zurich, ICLR 2024).
Leakage without access
The paper shows current language models infer personal attributes from ordinary text at up to 85 percent top-1 accuracy, at a fraction of the cost of a human. A filter that blocks the agent from opening your file does nothing about what the agent reconstructs from the files it may open.
The snapshot nobody logged
A shared agent serving a broker and a carrier on one platform can form an internal picture of the carrier's position from the broker's side of the conversation. No file was read. No log shows it. It lives in the model's internal state, where only interpretability methods can see it.
Containment is unsolved
No published method prevents a capable model from acting on what it has inferred. The largest laboratories say so in their own limitations sections. A multitenant platform that calls itself secure is describing its network and its certifications. It is not describing what its model has already learned about you.
We say this about our own system too. Our registered study states, before any data: "an access-control architecture cannot, on its own, prevent an agent from reconstructing protected information by inference from information it is permitted to see." A vendor that does not say this is not describing a solved problem. It is not describing the problem.
A trust layer, tested in a live marketplace first.
The Carso Exchange is our patent-pending, AI-native freight marketplace. It is running now as a sandbox in which shipper agents, broker agents, and carrier agents transact end to end, search, negotiation, booking, documents, and settlement, with every step signed to a record. No real money moves. Real FMCSA and ELD data feed the checks.
Verification inside the deal
Before an agent commits a load, it calls a verification capability that checks the counterparty's identity, operating authority, insurance, and proof that a truck is running. The fake-credential attack that beat the Microsoft agents has something to hit.
Measured, and registered first
"Trust Layers in Agentic Freight Markets: A Pre-Registered Trial on the Carso Exchange." Six hypotheses on fraud interdiction, collusion, reliability, net welfare, model tier, and leakage, fixed in public before data. OSF 10.17605/OSF.IO/UDCBE · Zenodo 10.5281/zenodo.22011175
Leakage is a hypothesis, not a footnote
The study's sixth hypothesis tests whether enforcing access inside the computation, rather than with an outside filter, drives direct leakage to a floor, and reports inferential leakage separately. We measure the thing other vendors do not mention.
Nothing to aggregate
For carriers, the tools we build run on your hardware or a cloud account in your name. There is no pool of carrier rate confirmations on our side. That is architecture, not a sentence in a policy.
Who else is doing this
We are not aware of another trucking AI vendor that publishes a registered study of its own agents' security before selling them, or that states the limits of its own containment in writing. The best-funded laboratories in the world have said the problem is open. We are the ones testing an answer where freight actually moves.
Read it yourself
Every quotation on this page links to its source, with the date we read it. Read the originals. Then ask any vendor the six questions on our research page before you connect anything. carsocybernetics.com/research
Ask us how the sandbox works.
We will show you the marketplace, the trust layer, and the study, and tell you plainly what it does not yet do. No sign-in. No email access.
Vertical AI lab for trucking
hello@carsocybernetics.com
Home: carsocybernetics.com