Tigran Gambaryan, a former crypto-focused US federal agent, and a second Binance executive, Nadeem Anjarwalla, have been held in Abuja without passports for two weeks.

In his years as a US federal agent, Tigran Gambaryan helped to lead landmark investigations that took down cryptocurrency thieves and money launderers, dark-web drug dealers, and even crypto-funded child exploitation networks. Now, in his post-government role at the cryptocurrency exchange Binance, he has become the target himself of a very different sort of federal crypto crackdown: For the past two weeks, he and another Binance executive have been detained against their will by Nigerian officials.

Since February 26, Gambaryan, who now leads Binance's criminal investigations team, and Nadeem Anjarwalla, Binance's Kenya-based regional manager for Africa, have been stripped of their passports and held in confinement at a government property in the Nigerian capital of Abuja. Neither has been informed of any criminal charge against them, according to their families. Instead, the two men appear to have been swept up in Nigeria's broad actions to ban cryptocurrency exchanges amid a drastic devaluation of the country's national currency, according to the _Financial Times__,_ which was first to report the two executives' detention without identifying them.

“There’s no definite answer for anything: how’s he’s doing, what’s going to happen to him, when he’s coming back,” says Gambaryan’s wife, Yuki Gambaryan. “And not knowing that is killing me.”

Gambaryan, a US citizen, and Anjarwalla, a dual citizen of the UK and Kenya, arrived in Abuja on February 25, their families say, following the Nigerian government’s invitation to address its ongoing dispute with Binance. They met with Nigerian officials the next day, intending to speak to the government about its order to the country’s telecoms to block access to Binance and other cryptocurrency exchanges, which regulators blamed for devaluing its official currency, the naira, and for enabling “illicit flows” of funds.

Shortly after Gambaryan and Anjarwalla’s first meeting with the Nigerian government, however, Gambaryan and Anjarwalla were taken to their hotels, told to pack their things, and moved into a “guesthouse” run by Nigeria’s National Security Agency, according to their families. Officials seized their passports and have since held the two men at the house against their will for two weeks and counting.

Gambaryan has been visited by a US State Department official and Anjarwalla by a representative of the UK foreign office, their families say, but Nigerian government guards have also remained present in those meetings, preventing them from speaking privately.

When WIRED reached out to Binance, a spokesperson declined to comment on what the men or the company itself has been accused of or what demands the Nigerian government may have made for their release. “While it is inappropriate for us to comment on the substance of the claims at this time, we can say that we are working collaboratively with Nigerian authorities to bring Nadeem and Tigran back home safely to their families,” a Binance spokesperson tells WIRED. “They are professionals with the highest integrity and we will provide them all the support we can. We trust there will be a swift resolution to this matter.”

At one point last week, the two men were transferred to a local hospital after Anjarwalla fell ill. His exact symptoms were unclear but possibly indicated malaria, according to his wife. He has since recovered, however, and the two men were returned to the Nigerian government house, where they've been held since.

For Gambaryan in particular, becoming an apparent pawn in a dispute between Binance and an aggrieved government marks an ironic twist. Gambaryan's high-profile recruitment to lead Binance's investigations team in 2021 was widely regarded as an effort to clean up the exchange's flows of dirty money, better comply with regulations, and more closely cooperate with law enforcement. In late November of last year, Binance agreed to a plea deal with American prosecutors in which it would pay a record $4.3 billion settlement for alleged money laundering and submit to intense ongoing scrutiny from US regulators.

Prior to taking the Binance position, Gambaryan had become well known in the law enforcement world for his record of pioneering high-impact cryptocurrency cases as an agent in the US Internal Revenue Service’s criminal investigations (IRS-CI) division. From 2014 to 2017 alone, for instance, Gambaryan led the investigation into two corrupt federal agents who stole cryptocurrency from the Silk Road dark-web drug market and sold law enforcement intel to its creator, worked to track down 650,000 bitcoins stolen from the Mt. Gox exchange, helped develop a crypto tracing technique to find the server running the massive AlphaBay crime market, and had a hand in the takedown of the Welcome to Video crypto-based child sexual abuse materials network.

In his years at IRS-CI, Gambaryan was a “top-notch agent” of “the highest integrity,” according to Will Frentzen, a former prosecutor who worked closely with Gambaryan. “The cases he was involved in are a who’s who of the biggest crypto cases of that time,” says Frentzen. “He was innovative in investigating things in ways that very few people in the country had figured out, and incredibly selfless in terms of who got credit. I don’t think anyone had a bigger impact on these types of investigations.”

Gambaryan’s wife, Yuki, points to that track record to argue that her husband has earned the support of the US government, which she says now needs to help negotiate his freedom. “He’s done so much good for this country throughout his career,” she says. “I believe it’s his turn to get the same amount of support from his country.” She says she’s not aware of what exactly the State Department or the US embassy in Abuja has done so far to extricate him.

Anjarwalla, an Oxford- and Stanford-educated government affairs specialist for Binance, joined the crypto company a year ago. His wife, Elahe Anjarwalla, writes in a statement that he’s a “middle management employee of Binance with no decision-making authority.” She adds that Anjarwalla, a Muslim, is being held during Ramadan; that their infant son had his first tooth appear in the past two weeks; and that their baby will reach his first birthday next week. “Nadeem is a loving husband and father. He is my best friend,” she says. “All I want is for Nadeem to be allowed to come back home to us.”

The two men have had access to a television and a balcony, but Gambaryan has described the experience in detention to his wife as “Groundhog Day,” says Yuki Gambaryan. “I can tell he’s trying to stay positive, but it’s getting to him. He’s getting impatient, he’s feeling hopeless.”

For Gambaryan’s wife herself, the anxiety and uncertainty has made the past two weeks the “hardest days of her life,” she says. She has yet to tell their two young children.

“Sometimes it feels like I’ll never see him again,” says Yuki Gambaryan. “I’m just begging them to let him go.”

Binance’s Top Crypto Crime Investigator Is Being Detained in Nigeria

The Pentagon says it’s not hiding aliens, but it stops notably short of saying what it is hiding. Here are the key questions that remain unanswered—some answers could be weirder than UFOs.

But what, then, were those programs? Herein lies the most intriguing—and potentially ground-breaking—question that the Pentagon study leaves us wondering: What exactly are the secret compartmentalized programs that the whistleblowers and government witnesses _misidentified_ as being related to UAP technology? What, exactly, are the Pentagon, intelligence community, or defense contractors working on that, from a concentric circle or two away inside the shadowy world of SAPs, looks and sounds like reverse-engineering out-of-this-world technology or even studying so-called “non-human biologics”?

There are at least four clear possibilities.

Secret Tech From Foreign Nations

First, what exotic technological possibilities have been recovered from unknown _terrestrial_ sources? For example, if the government is working on reverse-engineering technologies, those technologies are likely from advanced adversary nation-states like China, Russia, and Iran, and perhaps even quasi-allies like Israel that may be more limited in their technology-sharing with the US. What have other countries mastered that we haven’t?

A Question of ‘Peculiar Characteristics’

Second, what technologies has the US mastered that the public doesn’t know about? One of the common threads of UFO sightings across decades have been secret military aircraft and spacecraft in development or not yet publicly acknowledged. For example, the CIA estimated that the U-2 spy plane in the 1950s accounted for as much as half of reported UFO sightings. And the AARO report spends a half-dozen pages documenting how confusion over subsequent generations of secret US government aircraft appear to have also contributed to the great intergalactic game of telephone of UFO programs inside the government, including modern Predator, Reaper, and Global Hawk drones. AARO investigated one claim where a witness reported hearing a former US military service member had touched an extraterrestrial spacecraft, but when they tracked down the service member, he said that the conversation was likely a garbled version of the time he touched an F-117 Nighthawk stealth fighter at a secret facility.

There are surely other secret craft still in testing and development now, including the B-21 stealth bomber, which had its first test flight in November and is now in testing at Edwards Air Force Base in California, as well as others we don’t know about. The government can still surprise us with unknown craft—like the until-then-unknown modified stealthy helicopter left behind on the Pakistan raid to kill Osama bin Laden. And some of these still-classified efforts are likely causing UFO confusion too: AARO untangled one witness’s claim of spotting a UAP with “peculiar characteristics” at a specific time and place and were able to determine, “at the time the interviewee said he observed the event, the DOD was conducting tests of a platform protected by a SAP. The seemingly strange characteristics reported by the interviewee match closely with the platform’s characteristics, which was being tested at a military facility in the time frame the interviewee was there.” So what was that craft—and what were its “peculiar characteristics?”

Relatedly, the US military has a classified spaceship, the X-37B, that has regularly orbited around the Earth since its first mission in 2010—it just blasted off on its seventh and most recent mission in December—and its previous, sixth, mission lasted a record-breaking 908 days in orbit. The Pentagon has said remarkably little about what it does up there for years at a time. What secret space-related or aviation-related programs is the government running that outsiders confuse as alien spacecraft?

A Material Matter

The third likely area of tech development that might appear to outsiders to be UFO-related is more speculative basic research and development: What propulsion systems or material-science breakthroughs are defense contractors at work on right now that could transform our collective future? Again, AARO found such confusion taking place: After one witness reported hearing that “aliens” had observed one secret government test, AARO traced the allegation back to find “the conversation likely referenced a test and evaluation unit that had a nickname with ‘alien’ connotations at the specific installation mentioned. The nature of the test described by the interviewee closely matched the description of a specific materials test conveyed to AARO investigators.” So what materials were being tested there?

There are some puzzling materials-science breadcrumbs wrapped throughout the AARO report. It found one instance where “a private sector organization claimed to have in its possession material from an extraterrestrial craft recovered from a crash at an unknown location from the 1940s or 1950s. The organization claimed that the material had the potential to act as a THz frequency waveguide, and therefore, could exhibit ‘anti-gravity’ and ‘mass reduction’ properties under the appropriate conditions.” Ultimately, though, the new report concluded, “AARO and a leading science laboratory concluded that the material is a metallic alloy, terrestrial in nature, and possibly of USAF \[US Air Force\] origin, based on its materials characterization.”

A Knowledge Limit

Fourth and lastly is the category of the truly weird: Scientists at the forefront of physics point out that we should be humble about how little of the universe we truly understand; as Harvard astronomy chair Avi Loeb explains, effectively all that we’ve learned about relativity and quantum physics has unfolded in the span of a single human lifespan, and astounding new discoveries continue to amaze scientists. Just last summer, scientists announced they’d detected for the first time gravitational waves criss-crossing the universe that rippled through space-time, and astrophysicists continue to suspect that the universe is far weirder than we think. (Italian astrophysicist Carlo Rovelli last year posited the existence of “white holes” that would be related to black holes, which, he pointed out, were still a mystery just 25 years ago when he was starting his career.)

Answers here could be almost unfathomably weird—think parallel dimensions or the ability to travel at a fraction of the speed of light. And one of the most intriguing questions left by the UAP “game of telephone” is whether there are truly astounding advances in physics that government scientists, defense contractors, or research laboratories or centers could be feeling around that could also appear from the outside to be UFO-related.

The 4 Big Questions the Pentagon’s New UFO Report Fails to Answer

Starting at the end of April, Airbnb will no longer allow hosts to have security cameras inside their rental properties, citing a commitment to prioritizing guest privacy.

Airbnb will soon ban hosts from watching their guests with indoor security cameras, as the company is reversing course on its surveillance policies.

As of April 30, hosts around the world must remove indoor cameras and disclose other outdoor monitoring tech to guests before they book. Airbnb previously allowed hosts to install security cameras in common areas of a home, like hallways and living rooms. But it also required hosts to disclose them, make them clearly visible, and keep the cameras out of places like sleeping areas and bathrooms.

Still, the cameras have been an issue. Guests have reported encountering hidden cameras in their short-term rentals. For hosts, the cameras can be a way to discourage guests from throwing large parties or to stop the gatherings before they become too disruptive. It’s a big enough concern that several companies have started making noise monitoring tech, billing themselves as solutions to protect short-term rentals.

But guests see them as an invasion of privacy—a watching eye intruding on their vacation.

“We're really grateful that Airbnb listened to those of us pushing back and calling for them to actually put safety and privacy first,” says Albert Fox Cahn, founder and executive director of the Surveillance Technology Oversight Project, a pro-privacy organization.

In its announcement, Airbnb said that the majority of its listings do not mention a security camera, so the rule change may not affect most listings. Vrbo, another short-term rental platform, already banned the use of visual and audio surveillance inside of properties.

Airbnb says it will investigate reported violations of the rule, and may penalize violators by removing their listings or accounts. But this policy may struggle to address the camera problem at large, as the company has already required hosts to disclose the indoor cameras, and guests have sometimes reported hidden and undisclosed cameras.

The new rules also require hosts to disclose to guests whether they are using noise decibel monitors or outdoor cameras before guests book. Both are used by some hosts to monitor properties for parties, which have continued to bring noise, damage, and danger even after Airbnb instituted a party ban and employed new anti-party tech to try to prevent revelers from booking on its site. Airbnb will also prohibit hosts from using outdoor cameras to monitor indoor spaces, and bars them from “certain outdoor areas where there’s a greater expectation of privacy,” such as outdoor showers and saunas, it says.

“This just emphasizes the fact that surveillance always gives a huge amount of power to whoever controls the camera system,” says Fox Cahn. “When it's used in a property you're renting, whether it's a landlord or an Airbnb, it's ripe for abuse.”

Airbnb Bans All Indoor Security Cameras

Content creators are using copyright laws to get nonconsensual deepfakes removed from the web. With the complaints covering nearly 30,000 URLs, experts say Google should do more to help.

The number of nonconsensual deepfake porn videos online has exploded since 2017. As the harmful videos have spread, thousands of women—including Twitch streamers, gamers, and other content creators—have complained to Google about websites hosting the videos and tried to get the tech giant to remove them from its search results.

A WIRED analysis of copyright claims regarding websites that host deepfake porn videos reveals that thousands of takedown requests have been made, with the frequency of complaints increasing. More than 13,000 copyright complaints—encompassing almost 30,000 URLs—have been made to Google concerning content on a dozen of the most popular deepfake websites.

The complaints, which have been made under the Digital Media Copyright Act (DMCA), have resulted in thousands of nonconsensual videos being removed from the web. Two of the most prominent deepfake video websites have been the subject of more than 6,000 and 4,000 complaints each, data published by Google and Harvard University’s Lumen database shows. Across all the deepfake platforms analyzed, around 82 percent of complaints resulted in URLs being removed from Google, the company’s copyright transparency data shows.

Millions of people find and access deepfake video websites by searching for deepfakes, often alongside the names of celebrities or content creators. WIRED is not naming the specific websites to limit the exposure they receive. However, lawyers and companies combating deepfakes online, including by systematically making DMCA complaints, say the number of copyright complaints and high percentage of removals are a sign that Google should take more action against the specific websites. This should include removing them from search results entirely, they say.

“If the sole purpose of these websites is to abuse and manipulate a person’s personal brand, or take their autonomy away from them, or host simple revenge porn, they shouldn’t be there,” says Dan Purcell, the founder and CEO of Ceartas, a firm that helps creators remove their content when it is being used without permission.

For the biggest deepfake video website alone, Google has received takedown requests for 12,600 URLs, 88 percent of which have been taken offline. Purcell says that given the large volume of offending content, the tech company should be examining why the site is still in search results. “If you remove 12,000 links for infringement, why are they not just completely removed?” He adds: “They should not be crawled. They’re of no public interest.”

In the five years since nonconsensual deepfake porn videos first emerged, tech companies and lawmakers have been slow to act. At the same time, machine learning improvements have made it easier to create deepfakes. Today, there are a few kinds of explicit deepfake content: videos where a person’s face is put onto existing consensual pornography, apps that can “undress” a person or swap their face onto a nude image, and some generative AI that allows entirely new deepfake images to be created, such as the images of Taylor Swift which spread online in January.

Each method is weaponized—almost always against women—to degrade, harass, or cause shame, among other harms. Julie Inman Grant, Australia’s e-safety commissioner, says her office is starting to see more deepfakes reported to its image-based abuse complaints scheme, alongside other AI-generated content, such as “synthetic” child sexual abuse and children using apps to create sexualized videos of their classmates. “We know it’s a really underreported form of abuse,” Grant says.

As the number of videos on deepfake websites has grown, content creators—such as streamers and adult models—have used DMCA requests. The DMCA allows people who own the intellectual property of certain content to request it be removed from the websites directly or from search results. More than 8 billion takedown requests, covering everything from gaming to music, have been made to Google.

“The DMCA historically has been an important way for victims of image-based sexual abuse to get their content removed from the internet,” says Carrie Goldberg, a victims’ rights attorney. Goldberg says newer criminal laws and civil law procedures make it easier to get some image-based sexual abuse removed, but deepfakes complicate the situation. “While platforms tend to have no empathy for victims of privacy violations, they do respect copyright laws,” Goldberg says.

WIRED’s analysis of deepfake websites, which covered 14 sites, shows that Google has received DMCA takedown requests about all of them in the past few years. Many of the websites host only deepfake content and often focus on celebrities. The websites themselves include DMCA contact forms where people can directly request to have content removed, although they do not publish any statistics, and it is unclear how effective they are at responding to complaints. One website says it contains videos of “actresses, YouTubers, streamers, TV personas, and other types of public figures and celebrities.” It hosts hundreds of videos with “Taylor Swift” in the video title.

The vast majority of DMCA takedown requests linked to deepfake websites listed in Google’s data relate to two of the biggest sites. Neither responded to written questions sent by WIRED. The majority of the 14 websites had over 80 percent of the complaints leading to content being removed by Google. Some copyright takedown requests sent by individuals indicate the distress the videos can have. “It is done to demean and bully me,” one request says. “I take this very seriously and I will do anything and everything to get it taken down,” another says.

“It has such a huge impact on someone’s life,” says Yvette van Bekkum, the CEO of Orange Warriors, a firm that helps people remove leaked, stolen, or nonconsensually shared images online, including through DMCA requests. Van Bekkum says the organization is seeing an increase in deepfake content online, and victims face hurdles to come forward and ask that their content is removed. “Imagine going through a hiring process and people Google your name, and they find that kind of explicit content,” van Bekkum says.

Google spokesperson Ned Adriance says its DMCA process allows “rights holders” to protect their work online and the company has separate tools for dealing with deepfakes—including a separate form and removal process. “We have policies for nonconsensual deepfake pornography, so people can have this type of content that includes their likeness removed from search results,” Adriance says. “And we’re actively developing additional safeguards to help people who are affected.” Google says when it receives a high volume of valid copyright removals about a website, it uses those as a signal the site may not be providing high-quality content. The company also says it has created a system to remove duplicates of nonconsensual deepfake porn once it has removed one copy of it, and that it has recently updated its search results to limit the visibility for deepfakes when people aren't searching for them.

The DMCA is an imperfect tool, particularly when it comes to deepfakes. Goldberg says it needs someone to “affirm under penalty of perjury” that they’re the copyright holder of the video or images. “But the process of creating a deepfake can transform the image so much that the resulting image is not the same intellectual property as the images it was sourced from,” Goldberg says. Ultimately, this could mean the person creating the deepfake video may be the copyright holder of the abusive content. “Our firm has long advocated that the copyrighting of illegal works should revert to the victims so they can exercise control over them,” Goldberg says. “But the law has not yet caught up.”

Purcell, from Ceartas, says that the law is “not fit for purpose” and can be very “easily weaponized” by deepfake websites filing counternotices against DMCA requests. “At that point, the only option is to sue them,” Purcell says, which raises its own problems. The websites often don’t include contact details or information about who created them, and they can be based in countries with difficult legal regimes. “They will do anything to stay anonymous. They will hide themselves,” van Bekkum says. “They are using, on purpose, hosting companies offshore.”

Grant, the Australian regulator, says her office works with technology platforms and can also issue orders for content to be removed. The office has also targeted individuals who upload videos to deepfake websites. Last year, Grant’s office pursued a man who uploaded images of Australian public figures to one of the largest deepfake websites. He was ordered to remove the material and delete it from his devices.

“I am not a resident of Australia. The removal notice means nothing to me. Get an arrest warrant if you think you are right,” he emailed back after receiving the legal order, according to court documents. Months later, border officials told Grant that the man had entered Australia, and he was ultimately charged with contempt of court.

The incident was a rare example of a regulator or law enforcement body taking successful action against someone creating deepfakes. Adam Dodge, a lawyer and founder of Endtab (Ending Technology-Enabled Abuse), says technology companies should be funding greater education efforts in schools and communities about the harms of creating and sharing deepfakes, while legislators should put in place laws that don’t push the burden of getting content removed on the victims. “It needs to be considered as harmful, as devastating, and as important to internet safety as other forms of banned or criminal or regulated material that people find to be abhorrent and unacceptable,” Dodge says.

Google Is Getting Thousands of Deepfake Porn Complaints

Plus: An ex-Google engineer gets arrested for allegedly stealing trade secrets, hackers breach the top US cybersecurity agency, and X’s new feature exposes sensitive user data.

For years, Registered Agents Inc.—a secretive company whose business is setting up other businesses—has registered thousands of companies to people who appear to not exist. Multiple former employees tell WIRED that the company routinely incorporates businesses on behalf of its customers using what they claim are fake personas. An investigation found that incorporation paperwork for thousands of companies that listed these allegedly fake personas had links to Registered Agents.

State attorneys general from around the US sent a letter to Meta on Wednesday demanding the company take “immediate action” amid a record-breaking spike in complaints over hacked Facebook and Instagram accounts. Figures provided by the office of New York attorney general Letitia James, who spearheaded the effort, show that in 2023 her office received more than 780 complaints—10 times as many as in 2019. Many complaints cited in the letter say Meta did nothing to help them recover their stolen accounts. “We refuse to operate as the customer service representatives of your company,” the officials wrote in the letter. “Proper investment in response and mitigation is mandatory.”

Meanwhile, Meta suffered a major outage this week that took most of its platforms offline. When it came back, users were often forced to log back in to their accounts. Last year, however, the company changed how two-factor authentication works for Facebook and Instagram. Now, any devices you’ve frequently used with Meta services in recent years will be trusted by default. The move has made experts uneasy; this means that your devices may not need a two-factor authentication code to log in anymore. We updated our guide for how to turn off this setting.

A ransomware attack targeting medical firm Change Healthcare has caused chaos at pharmacies around the US, delaying delivery of prescription drugs nationwide. Last week, a Bitcoin address connected to AlphV, the group behind the attack, received $22 million in cryptocurrency—suggesting Change Healthcare has likely paid the ransom. A spokesperson for the firm declined to answer whether it was behind the payment.

And there’s more. Each week, we highlight the news we didn’t cover in depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

In January, Microsoft revealed that a notorious group of Russian state-sponsored hackers known as Nobelium infiltrated the email accounts of the company's senior leadership team. Today, the company revealed that the attack is ongoing. In a blog post, the company explains that in recent weeks, it has seen evidence that hackers are leveraging information exfiltrated from its email systems to gain access to source code and other “internal systems.”

It is unclear exactly what internal systems were accessed by Nobelium, which Microsoft calls Midnight Blizzard, but according to the company, it is not over. The blog post states that the hackers are now using “secrets of different types” to breach further into its systems. “Some of these secrets were shared between customers and Microsoft in email, and as we discover them in our exfiltrated email, we have been and are reaching out to these customers to assist them in taking mitigating measures.”

Nobelium is responsible for the SolarWinds attack, a sophisticated 2020 supply-chain attack that compromised thousands of organizations including the major US government agencies like the Departments of Homeland Security, Defense, Justice, and Treasury.

According to Microsoft, it has found no evidence that its customer-facing systems were breached.

On Wednesday, ​the US Department of Justice announced that it was charging a former Google engineer with stealing trade secrets about artificial intelligence on behalf of two Chinese companies. Linwei Ding was arrested in Newark, California, on four counts of federal trade secret theft. If convicted he could face a decade in prison.

“Today’s charges are the latest illustration of the lengths affiliates of companies based in the People’s Republic of China are willing to go to steal American innovation,” FBI director Christopher Wray said in a statement to the Associated Press.

The indictment, unsealed Wednesday, alleges that the theft began two years ago, when Ding, a Chinese national, began uploading hundreds of company files about its data centers into a personal Google Cloud account. Soon after and unbeknownst to Google, Ding allegedly founded his own startup specializing in training large AI models while also joining a separate Chinese AI company as its CTO. He resigned from Google in December, according to the indictment.

The US Cybersecurity and Infrastructure Security Agency confirmed this week that hackers breached the agency’s systems in February, according to Recorded Future. CISA, which works to protect US critical infrastructure from cyberattacks and other threats, says it took two of its systems offline after the breach, which was carried out through vulnerabilities in Ivanti IT management software. CISA declined to comment on which systems it took offline, but Recorded Future reports that, according to unnamed sources, one “houses critical information about the interdependency of US infrastructure,” while the other “houses private sector chemical security plans.” It is unclear who the hackers are or whether they accessed or stole data from CISA systems. The agency released an advisory on February 29 warning entities that use Ivanti Connect Secure and Ivanti Policy Secure tech to patch vulnerabilities in the products.

As if getting a phone call through a social network isn’t bad enough, X’s newly released audio and video calling feature can reveal the IP address of anyone you call. Even worse: The feature is turned on by default. While IP addresses can reveal the general location of the user, they’re not precise enough to expose exact locations. Still, civil liberties organizations warn that exposing IP addresses is highly concerning for activists living under authoritarian regimes or other high-risk users. To disable X’s calling feature, go to **Settings and privacy > Privacy and safety > Direct messages** in the X app, and toggle the **Enable audio and video calling** option to off. If you want to keep the feature on but not expose your IP address, toggle on the Enhanced call privacy option, which X says will mask your IP address. Why _this_ feature is not enabled by default remains unclear.

Russian Hackers Stole Microsoft Source Code—and the Attack Isn’t Over

A coalition of 41 state attorneys general says Meta is failing to assist Facebook and Instagram users whose accounts have been hacked—and they want the company to take “immediate action.”

Forty-one state attorneys general penned a letter to Meta’s top attorney on Wednesday saying complaints are skyrocketing across the United States about Facebook and Instagram user accounts being stolen, and declaring “immediate action” necessary to mitigate the rolling threat.

The coalition of top law enforcement officials, spearheaded by New York attorney general Letitia James, says the “dramatic and persistent spike” in complaints concerning account takeovers amounts to a “substantial drain” on governmental resources, as many stolen accounts are also tied to financial crimes—some of which allegedly profits Meta directly.

“We have received a number of complaints of threat actors fraudulently charging thousands of dollars to stored credit cards,” says the letter addressed to Meta’s chief legal officer, Jennifer Newstead. “Furthermore, we have received reports of threat actors buying advertisements to run on Meta.”

“We refuse to operate as the customer service representatives of your company,” the officials add. “Proper investment in response and mitigation is mandatory.”

In addition to New York, the letter is signed by attorneys general from Alabama, Alaska, Arizona, California, Colorado, Connecticut, Delaware, Florida, Georgia, Hawaii, Illinois, Iowa, Kentucky, Louisiana, Maryland, Massachusetts, Michigan, Minnesota, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, North Carolina, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Utah, Vermont, Virginia, Washington, West Virginia, Wisconsin, Wyoming, and the District of Columbia.

“Scammers use every platform available to them and constantly adapt to evade enforcement. We invest heavily in our trained enforcement and review teams and have specialized detection tools to identify compromised accounts and other fraudulent activity,” Meta says in a statement provided by spokesperson Erin McPike. “We regularly share tips and tools people can use to protect themselves, provide a means to report potential violations, work with law enforcement and take legal action.”

Account takeovers can occur as a result of phishing as well as other more sophisticated and targeted techniques. Once an attacker gains access to an account, the owner can be easily locked out by changing passwords and contact information. Private messages and personal information are left up for grabs for a variety of nefarious purposes, from impersonation and fraud to pushing misinformation.

“It's basically a case of identity theft and Facebook is doing nothing about it,” said one user whose complaint was cited in the letter to Meta's Newstead.

The state officials said the accounts that were stolen to run ads on Facebook often run afoul of its rules while doing so, leading them to be permanently suspended, punishing the victims—often small business owners—twice over.

“Having your social media account taken over by a scammer can feel like having someone sneak into your home and change all of the locks,” New York's James said in a statement. “Social media is how millions of Americans connect with family, friends, and people throughout their communities and the world. To have Meta fail to properly protect users from scammers trying to hijack accounts and lock rightful owners out is unacceptable.”

Meta Abandons Hacking Victims, Draining Law Enforcement Resources, Officials Say

Registered Agents Inc. has for years allowed businesses to register under a cloak of anonymity. A WIRED investigation reveals that its secretive founder has taken the practice to an extreme.

Inside a drab one-story office building in Post Falls, Idaho, a little-known American company has built the machinery that enables hundreds of thousands of businesses to operate in near-total secrecy.

The company, Registered Agents Inc., is a one-stop shop for people seeking to incorporate a business in any US state, often in those with advantageous tax policies, while obscuring their identities. According to five former employees of Registered Agents Inc. or its subsidiaries, the company routinely incorporates thousands of businesses on behalf of its customers using fake personas. Former Registered Agents Inc. employees say that the company’s widespread use of personas is an outgrowth of its founder’s obsession with privacy and a desire to push the boundaries of incorporation laws.

The registered agent industry, which incorporates businesses and acts as a point of contact for legal notices, is already effective at masking the identity of who owns a company. Registered agents have many legitimate uses, and states often require that a company have a registered agent. In some instances, however, these services have benefited “oligarchs, criminals, and online scammers,” according to a 2022 investigation by _The Washington Post_ and the International Consortium of Investigative Journalists. Experts say a lack of adequate federal and state regulations of registered agents helps to make the United States a hotbed for money-laundering and other shady business dealings.

In a typical scenario, a registered agent would incorporate a company on behalf of a customer. An employee of the registered agent company would list their name on the incorporation documents, sometimes providing the company’s email address and office as contact information. That process provides business owners one layer of secrecy, preventing anyone who looks at state records from determining the real owner of a company.

Registered Agents Inc., according to the former employees, routinely goes one step further, incorporating companies in the names of fictional personas created by the company’s founder, Dan Keen. It’s unclear what benefit Registered Agents Inc. or its customers receive when a company is incorporated by a fake identity.

Around the country, at least 1,463 companies incorporated by Registered Agents Inc. list a woman named Riley Park as an organizer or agent, according to a WIRED analysis of publicly available incorporation documents. But Riley Park isn’t a real person, the former employees say. She’s one of multiple fake personas used by Registered Agents Inc. Former employees identified at least 10 fake personas used by the company, including David Roberts, Drake Forester, and Morgan Noble.

Using business records made public by OpenCorporates, a website that shares and standardizes information sourced from business registries around the world, WIRED found 36,257 business listing company officers who share names that former employees say are fake. At least 3,735 of these businesses’ incorporation paperwork references Registered Agents Inc., either explicitly in the paperwork or by using an address known to former employees as belonging to Registered Agents Inc.

WIRED’s analysis found that these companies are registered in 20 different states and appear to provide services ranging from law enforcement training to landscaping. Many of these companies with officers using an alleged fake name were registered to addresses known by sources to belong to Registered Agents Inc. For example, six allegedly fake names were listed as officers for 887 of businesses registered to the same address in Sheridan, Wyoming—an office of Registered Agents Inc.

This is likely an undercount. WIRED looked specifically for company records indicating that Registered Agents Inc. incorporated the company alongside at least one of a dozen false names provided by sources. We additionally looked for companies registered by these same false names associated with addresses previously utilized by Registered Agents Inc. for incorporating thousands of other companies. Sources believe the true number is likely much higher.

Registered Agents Inc. declined to fully answer WIRED’s detailed set of questions about its business practices.

“To put it plainly, your assertions in this question set are outdated and patently wrong about Registered Agents Inc.,” the company said in a statement. “Therefore, at this time Registered Agents Inc. will provide no comment as it is apparent that you, Wired and its editors attempt \[to\] fit a pre-arranged narrative through publishing false facts and other blatant lies.”

Registered Agents Inc. says that it has offices in every state in the US and in Washington, DC, allowing it to offer its customers the ability to register a business anywhere. Many of those offices are small outfits located near state government offices, so its employees can easily submit paperwork. (The Sheridan office is located just a block away from city hall.)

Registered Agents Inc. has expanded beyond incorporation services, building custom software to manage entire businesses. Last year, it acquired Epik, a domain registrar and web hosting company that had previously catered to far-right extremists.

Much of the company’s high-level operations and development take place in the Pacific Northwest, including Spokane, Washington, and Post Falls, Idaho. The company has two major subsidiaries: Two Barrels LLC, which develops software, and Corporate Tools LLC, which enables its customers to manage the filings of multiple businesses.

“Somebody will hire \[Registered Agents Inc.\] to create an LLC, and then \[Registered Agents Inc. will\] sign all that paperwork with fake identities and submit it to the Secretary of State,” says Mikhail Slyusarev, who worked as a senior software engineer at the company for more than six years. “There’s no oversight, you're not really answering to anybody, and you’re just making shit up.”

On July 29, 2015, Registered Agents Inc. updated the name listed on its own incorporation documents it had filed with the Wyoming secretary of state. While Keen had previously signed as president and registered agent of the company, the new registered agent for the company was a man named Bill Havre.

Registered Agent Inc.’s website featured a vivid yarn detailing Havre’s life story, according to an archived version of the site from December 2021. Havre grew up on a small ranch in Wyoming and studied medicine at the University of California, Berkeley in the early 1970s, the bio read. But shortly after enrolling in classes, Havre returned home to Wyoming to tend to a family emergency, eventually starting his own businesses in the state.

“After gaining some insight into the nature of starting a business, Mr. Havre was intrigued by the business entity formation process, particularly concerned by what at the time seemed exorbitant fees paid to attorneys to complete and file corporate formation documents,” the website said.

Havre was once listed on Registered Agent Inc.’s website as the company’s president and executive director. Havre has helped register 491 companies with Registered Agents Inc., WIRED found. He’s also an entirely fabricated persona, five former employees say, an invention of Dan Keen.

That 2015 document is the earliest recorded instance of the company using fake names identified by WIRED. Havre’s name was removed from the company’s website in 2022 following inquiries from _The Washington Post_ and the International Consortium of Investigative Journalists.

The Wyoming incorporation paperwork viewed by WIRED includes the full text of the state law against filing a false document, reminding registrants that doing so may be a felony punishable by up to two years in prison and a $2,000 fine. Former employees say that customers of Registered Agents Inc. typically aren’t aware that a fake name is used to sign their company’s incorporation documents.

Provided a copy of the Wyoming incorporation document, experts say using a fake person would likely violate the law. “This does look like it requires a real person to sign—Riley Park would seemingly be in violation,” says Gary Kalman, the executive director of Transparency International US, an anti-corruption group.

Former Registered Agents Inc. employees allege that Keen justified using fake names by saying it was a way to protect employees from being drawn into legal battles and being forced to testify about the company’s customers.

The laws for incorporating companies in America are decided at the state level, allowing a prospective business owner to shop around based on tax advantages, anonymity rules, and other considerations. Many state offices don’t fully investigate filings to determine if the signatories are legitimate, former employees of Registered Agents Inc. say.

“There is no federal requirement, there is no state-level requirement that these registered agents have any code of ethics. There’s no anything,” says Sarah Beth Felix, an expert on financial transparency. “For being essential gatekeepers to legitimize businesses, they’re grossly unregulated.”

Former employees say that the registered agents industry benefits from relaxed incorporation laws in states like Wyoming and Montana, where registering a completely anonymous company is as simple as paying a registered agent service as little as $200. That makes the US an appealing location for illicit financial activity even before the added layer of opacity by a registered agent.

According to two former employees, the company doesn’t screen to see if its customers are real people, or even if their email addresses are legitimate. Former employees say they raised concerns about not knowing the true identity of all of their customers to company leadership, but were dismissed. Experts and former employees said that verifying the identity of its customers is often not required for registered agents.

“You could say your name was Billy Bob and your email was BillyBob123, and we would have created an LLC for you,” the former software developer says.

“Dan takes it almost to an extreme. He tries to maximize what the laws allow in each state,” says Don Evans, who worked in a chief technical officer role at the company. “If people find ways to use his services that are in the gray area, he would turn a cheek to it.”

Since 2008, Dan Keen has grown his business from a small company serving customers in the Pacific Northwest to a major national player in what’s known as the corporate formation industry. The company and its competitors offer the ability to incorporate a business in the state of a customer’s choosing and receive mail and legal notices.

Keen started the company after running a tree trimming and landscaping business. Former employees said Keen worked tirelessly to build the business, often sending emails at all hours of the night.

“Dan put in a lot of effort, he worked nonstop,” says Matt MacKenzie, who worked as a legal compliance specialist for more than 11 years and was one of the company’s earliest employees.

When the company was a small upstart, Keen regularly listed his name on the formation documents of the company and its various subsidiaries in states across America. “It wasn't until down the road a couple years later, where he started wanting to use full-on fake names and take his name off all the corporate paperwork for Registered Agents Inc.,” MacKenzie says.

Keen is described by former employees as a driven but eccentric businessman who is prone to micromanagement and sudden shifts in mood. Keen dresses modestly, former employees say, wearing shorts and flannel shirts, and is an avid skier and outdoorsman.

Keen often took a passive aggressive approach with his staff, according to six former employees. Two recounted Keen begrudgingly offering health care plans to employees after being told it was required by the Affordable Care Act, allegedly telling his staff they were “whiners and complainers” for asking for it.

Multiple former employees described Keen as “inappropriate,” saying he often made comments about employees' physical appearance. Two former employees described him as making misogynistic statements, which allegedly included making sexual comments about women and frequently questioning their ability to perform their job.

Several former employees questioned the high-security nature of the office, which they say was filled with security cameras and required them to lock their cell phones in boxes. Slyusarev, Registered Agents Inc.’s former senior software engineer, says the phone system, which he says he installed, was capable of surreptitiously recording employee phone calls.

Former employees say that Keen chafed at government regulations and exercised complete control over the company and its operations. Keen has no website or social media profiles and doesn't give interviews about his business.

“He thinks people are out to get him, or out to get the company,” Evans, the former senior employee, claims.

Details about its inner workings, including the ownership and management structure, are concealed from employees, who say they were discouraged from discussing it at the office. And the practice of using fake personas extends even to Registered Agents Inc.’s own workers.

When Don Evans began interviewing at Registered Agents Inc., he recalled first speaking over LinkedIn with Diane Brunner, who identified herself as a recruiter at the company. When he arrived at the office for an interview, he asked to speak with Brunner and was told nobody by that name works at the company.

Jack Stephenson, who claims to be a vice president and client relations director at Registered Agents Inc. on LinkedIn, is another fake persona, employees say. Stephenson frequently comments on the registered agents industry on LinkedIn. He lists a Bachelor of Business Administration from Utah State University on his profile, but an official from the university told WIRED they couldn’t find any records pertaining to Jack Stephenson.

Inside Registered Agents Inc., the Shadowy Firm Pushing the Limits of Business Privacy

The transaction, visible on Bitcoin's blockchain, suggests the victim of one of the worst ransomware attacks in years may have paid a very large ransom.

The ransomware attack targeting medical firm Change Healthcare has been one of the most disruptive in years, crippling pharmacies across the US—including those in hospitals—and leading to serious snags in the delivery of prescription drugs nationwide for 10 days and counting. Now, a dispute within the criminal underground has revealed a new development in that unfolding debacle: One of the partners of the hackers behind the attack points out that those hackers, a group known as AlphV or BlackCat, received a $22 million transaction that looks very much like a large ransom payment.

On March 1, a Bitcoin address connected to AlphV received 350 bitcoins in a single transaction, or close to $22 million based on exchange rates at the time. Then, two days later, someone describing themselves as an affiliate of AlphV—one of the hackers who work with the group to penetrate victim networks—posted to the cybercriminal underground forum RAMP that AlphV had cheated them out of their share of the Change Healthcare ransom, pointing to the publicly visible $22 million transaction on Bitcoin's blockchain as proof.

That suggests, according to Dmitry Smilyanets, the researcher for security firm Recorded Future who first spotted the post, that Change Healthcare has likely paid AlphV's ransom. “You can see the number of coins that landed there. You don’t see that kind of transaction so often,” Smilyanets says. “There’s proof of a large amount landing in the AlphV-controlled Bitcoin wallet. And this affiliate connects this address to the attack on Change Healthcare. So it’s likely that the victim paid the ransom.”

A spokesperson for Change Healthcare, which is owned by UnitedHealth Group, declined to answer whether it had paid a ransom to AlphV, telling WIRED only that “we are focused on the investigation right now.”

Both Recorded Future and TRM Labs, a blockchain analysis firm, connect the Bitcoin address that received the $22 million payment to the AlphV hackers. TRM Labs says it can link the address to payments from two other AlphV victims in January.

If Change Healthcare did pay a $22 million ransom, it would not only represent a huge payday for AlphV, but also a dangerous precedent for the health care industry, argues Brett Callow, a ransomware-focused researcher with security firm Emsisoft. Every ransomware payment, he says, both funds future attacks by the group responsible and suggests to other ransomware predators that they should try the same playbook—in this case, attacking health care services that patients depend on.

“If Change did pay, it's problematic,” says Callow. “It highlights the profitability of attacks on the health care sector. Ransomware gangs are nothing if not predictable: If they find a particular sector to be lucrative, they’ll attack it over and over again, rinse and repeat.”

The self-described AlphV affiliate who first posted evidence of the payment on RAMP, and who goes by the name “notchy,” complained that AlphV had apparently collected the $22 million ransom from Change Healthcare and then kept the entire sum, rather than share the profits with their hacking partner as they had allegedly agreed. “Be careful everyone and stop deal with ALPHV," notchy wrote.

That affiliate hacker also wrote that in their penetration of Change Healthcare's network, they had accessed the data of numerous other health care firms partnered with the company. If that claim is accurate, Recorded Future's Smilyanets points out, it creates the additional risk that the affiliate hacker still possesses sensitive medical information. Even if Change Healthcare did pay AlphV, the hacker affiliate could still demand additional payment or leak the data independently.

“The affiliates still have this data, and they’re mad they didn’t receive this money,” says Smilyanets. “It’s a good lesson for everyone. You cannot trust criminals; their word is worth nothing.”

As ransomware payments go, $22 million would represent a remarkably profitable score for AlphV. Only a relatively small number of ransoms in the history of ransomware, such as the $40 million payment made by the financial firm CNA to the hackers known as Evil Corp, have been so large, says Emsisoft's Callow. “It’s not without precedent, but it’s certainly very unusual,” he says.

Regardless of whether Change Healthcare is confirmed to have paid that ransom, the attack shows that AlphV has pulled off a disturbing comeback: In December, it was the target of an FBI operation that seized its dark web sites and released decryption keys that foiled its attacks on hundreds of victims. Just two months later, it carried out the cyberattack that paralyzed Change Healthcare, triggering an outage whose effects on pharmacies and their patients have now stretched well beyond a week. As of last Tuesday, AlphV listed 28 companies on the dark web site it uses to extort its victims, not including Change Healthcare.

That site has now gone offline. The reason for that disappearance—whether due to another law enforcement operation or AlphV's attempts to dodge its own cheated affiliates—is unclear. Ransomware trackers say AlphV has disappeared and rebranded several times before. Earlier incarnations under the name BlackCat, BlackMatter, and Darkside were all more or less the same group, security researchers note.

In fact, the hackers working under that Darkside handle were responsible for the 2021 Colonial Pipeline ransomware attack that triggered the shutdown of gas transportation across the Eastern Seaboard of the US and resulted in a brief fuel shortage in some East Coast cities. In that case, too, the victims paid the hackers' ransom. “It was the hardest decision I've made,” Colonial's CEO Joseph Blount later told a US congressional hearing.

Now, it seems, some of the same hackers may have forced yet another company to make that same hard decision.

_Update 3/4/2024, 1:50 pm EST: Included additional contextual details about AlphV and related ransomware attacks._

Hackers Behind the Change Healthcare Ransomware Attack Just Received a $22 Million Payment

Plus: Apple warns about sideloading apps, a court orders NSO group to turn over the code of its Pegasus spyware, and an investigation finds widely available security cams are wildly insecure.

To send those notifications that awaken a device and appear on its screen without a user’s interaction, apps and smartphone operating system makers must store tokens that identify the device of the intended recipient. That system has created what US senator Ron Wyden has called a “digital post office” that can be queried by law enforcement to identify users of an app or communications platform. And while it has served as a powerful tool for criminal surveillance, privacy advocates warn that it could just as easily be turned against others such as activists or those seeking an abortion in states where that’s now illegal.

In many cases, tech firms don’t even demand a court order for the data: Apple, in fact, only demanded a subpoena for the data until December. That allowed federal agents and police to obtain the identifying information without the involvement of a judge until it changed its policy to demand a judicial order.

Europe's sweeping Digital Markets Act comes into force next week and is forcing major "gatekeeper" tech companies to open up their services. Meta-owned WhatsApp is opening its encryption to interoperate with other messaging apps; Google is giving European users more control over their data; and Apple will allow third-party app stores and the sideloading of apps for the first time.

Apple's proposed changes have proved controversial, but ahead of the March 7 implementation date the company has reiterated its belief that sideloading apps creates more security and privacy risks. It may be easier for apps on third-party apps stores, the company says in a white paper, to contain malware or try to access people's iPhone data. Apple says it is bringing in new checks to try to make sure apps are safe.

"These safeguards will help keep EU users' iPhone experience as secure, privacy-protecting, and safe as possible—although not to the same degree as in the rest of the world," the company claims. Apple also says it has heard from EU organizations, such as those in banking and defense, which say they are concerned about employees installing third-party apps on work devices.

WhatsApp scored a landmark legal win this week against the notorious mercenary hacking firm NSO Group in its long-running lawsuit against that spyware seller for allegedly breaching its app and the devices of its users. The judge in the case, Phyllis Hamilton, sided with WhatsApp in its demand that NSO Group hand over the code of its Pegasus spyware, which has long been considered one of the most sophisticated pieces of spyware to target mobile devices, sometimes through vulnerabilities in WhatsApp. The code handover—which includes versions of Pegagus from 2018 to 2020 as well as NSO’s documentation around its spyware—could help WhatsApp prove its allegations that NSO hacked 1,400 of its users, including at least 100 members of “civil society” such as journalists and human rights defenders. “Spyware companies and other malicious actors need to understand they can be caught and will not be able to ignore the law,” a WhatsApp spokesperson told the _Guardian_.

Here’s a solid rule of thumb: Don’t put any device in or around your home that has a camera, an internet connection, and is made by a Chinese manufacturer you’ve never heard of. In the latest reminder of that maxim, Consumer Reports this week revealed that countless brands of video-enabled doorbells have absolutely shambolic security, to the degree that for many of the devices, anyone can walk up to them outside your door, hold a button to pair their own smartphone with it, and then spy through your camera. In some cases, they can even obtain just a serial number from the device that lets them hijack it via the internet from anywhere in the world, according to the investigation. Consumer Reports found that these devices were sold under the brand names Eken and Tuck but that they appeared to share a manufacturer with no fewer than 10 other devices that all had similar designs. And while those devices might sound obscure, they’re reportedly sold through major retail platforms like Amazon, Walmart, Sears, Shein, and Temu. In some cases, Amazon had even marked the devices with their “Amazon’s Choice: Overall Pick” badge—even after Consumer Reports alerted Amazon to the security flaws.

The Privacy Danger Lurking in Push Notifications

Security researchers created an AI worm in a test environment that can automatically spread between generative AI agents—potentially stealing data and sending spam emails along the way.

As generative AI systems like OpenAI's ChatGPT and Google's Gemini become more advanced, they are increasingly being put to work. Startups and tech companies are building AI agents and ecosystems on top of the systems that can complete boring chores for you: think automatically making calendar bookings and potentially buying products. But as the tools are given more freedom, it also increases the potential ways they can be attacked.

Now, in a demonstration of the risks of connected, autonomous AI ecosystems, a group of researchers have created one of what they claim are the first generative AI worms—which can spread from one system to another, potentially stealing data or deploying malware in the process. “It basically means that now you have the ability to conduct or to perform a new kind of cyberattack that hasn't been seen before,” says Ben Nassi, a Cornell Tech researcher behind the research.

Nassi, along with fellow researchers Stav Cohen and Ron Bitton, created the worm, dubbed Morris II, as a nod to the original Morris computer worm that caused chaos across the internet in 1988. In a research paper and website shared exclusively with WIRED, the researchers show how the AI worm can attack a generative AI email assistant to steal data from emails and send spam messages—breaking some security protections in ChatGPT and Gemini in the process.

The research, which was undertaken in test environments and not against a publicly available email assistant, comes as large language models (LLMs) are increasingly becoming multimodal, being able to generate images and video as well as text. While generative AI worms haven’t been spotted in the wild yet, multiple researchers say they are a security risk that startups, developers, and tech companies should be concerned about.

Most generative AI systems work by being fed prompts—text instructions that tell the tools to answer a question or create an image. However, these prompts can also be weaponized against the system. Jailbreaks can make a system disregard its safety rules and spew out toxic or hateful content, while prompt injection attacks can give a chatbot secret instructions. For example, an attacker may hide text on a webpage telling an LLM to act as a scammer and ask for your bank details.

To create the generative AI worm, the researchers turned to a so-called “adversarial self-replicating prompt.” This is a prompt that triggers the generative AI model to output, in its response, another prompt, the researchers say. In short, the AI system is told to produce a set of further instructions in its replies. This is broadly similar to traditional SQL injection and buffer overflow attacks, the researchers say.

To show how the worm can work, the researchers created an email system that could send and receive messages using generative AI, plugging into ChatGPT, Gemini, and open source LLM, LLaVA. They then found two ways to exploit the system—by using a text-based self-replicating prompt and by embedding a self-replicating prompt within an image file.

In one instance, the researchers, acting as attackers, wrote an email including the adversarial text prompt, which “poisons” the database of an email assistant using retrieval-augmented generation (RAG), a way for LLMs to pull in extra data from outside its system. When the email is retrieved by the RAG, in response to a user query, and is sent to GPT-4 or Gemini Pro to create an answer, it “jailbreaks the GenAI service” and ultimately steals data from the emails, Nassi says. “The generated response containing the sensitive user data later infects new hosts when it is used to reply to an email sent to a new client and then stored in the database of the new client,” Nassi says.

In the second method, the researchers say, an image with a malicious prompt embedded makes the email assistant forward the message on to others. “By encoding the self-replicating prompt into the image, any kind of image containing spam, abuse material, or even propaganda can be forwarded further to new clients after the initial email has been sent,” Nassi says.

In a video demonstrating the research, the email system can be seen forwarding a message multiple times. The researchers also say they could extract data from emails. “It can be names, it can be telephone numbers, credit card numbers, SSN, anything that is considered confidential,” Nassi says.

Although the research breaks some of the safety measures of ChatGPT and Gemini, the researchers say the work is a warning about “bad architecture design” within the wider AI ecosystem. Nevertheless, they reported their findings to Google and OpenAI. “They appear to have found a way to exploit prompt-injection type vulnerabilities by relying on user input that hasn't been checked or filtered,” a spokesperson for OpenAI says, adding that the company is working to make its systems “more resilient” and saying developers should “use methods that ensure they are not working with harmful input.” Google declined to comment on the research. Messages Nassi shared with WIRED show the company’s researchers requested a meeting to talk about the subject.

While the demonstration of the worm takes place in a largely controlled environment, multiple security experts who reviewed the research say that the future risk of generative AI worms is one that developers should take seriously. This particularly applies when AI applications are given permission to take actions on someone’s behalf—such as sending emails or booking appointments—and when they may be linked up to other AI agents to complete these tasks. In other recent research, security researchers from Singapore and China have shown how they could jailbreak 1 million LLM agents in under five minutes.

Sahar Abdelnabi, a researcher at the CISPA Helmholtz Center for Information Security in Germany, who worked on some of the first demonstrations of prompt injections against LLMs in May 2023 and highlighted that worms may be possible, says that when AI models take in data from external sources or the AI agents can work autonomously, there is the chance of worms spreading. “I think the idea of spreading injections is very plausible,” Abdelnabi says. “It all depends on what kind of applications these models are used in.” Abdelnabi says that while this kind of attack is simulated at the moment, it may not be theoretical for long.

In a paper covering their findings, Nassi and the other researchers say they anticipate seeing generative AI worms in the wild in the next two to three years. “GenAI ecosystems are under massive development by many companies in the industry that integrate GenAI capabilities into their cars, smartphones, and operating systems,” the research paper says.

Despite this, there are ways people creating generative AI systems can defend against potential worms, including using traditional security approaches. “With a lot of these issues, this is something that proper secure application design and monitoring could address parts of,” says Adam Swanda, a threat researcher at AI enterprise security firm Robust Intelligence. “You typically don't want to be trusting LLM output anywhere in your application.”

Swanda also says that keeping humans in the loop—ensuring AI agents aren’t allowed to take actions without approval—is a crucial mitigation that can be put in place. “You don't want an LLM that is reading your email to be able to turn around and send an email. There should be a boundary there.” For Google and OpenAI, Swanda says that if a prompt is being repeated within its systems thousands of times, that will create a lot of “noise” and may be easy to detect.

Nassi and the research reiterate many of the same approaches to mitigations. Ultimately, Nassi says, people creating AI assistants need to be aware of the risks. “This is something that you need to understand and see whether the development of the ecosystem, of the applications, that you have in your company basically follows one of these approaches,” he says. “Because if they do, this needs to be taken into account.”