I’m both a former lawyer and former digital media academic who is well aware that legal systems struggle to keep up with the rapid pace of technological innovation, sometimes lagging by decades. But with the existential impact of artificial intelligence, we can’t afford to wait for the law to align with the facts on the ground.

Case in point: criminals are using AI to easily mimic our voices and gain access to our financial accounts. To combat this, technology vendors such as Clarissa’s Pindrop (underwriter to my documentary, The Only Human in the Room) offer a voice verification layer to protect our assets when we call customer service.

But innovation often collides with regulation. Plaintiffs in an Illinois lawsuit argued that they never gave consent to have their biometric data recorded and analyzed, contravening a strict state privacy law. Clarissa countered with a brilliant maneuver: she argued that Pindrop was exempt under that law because providing this critical authentication service meant it was engaging in “financial activities.”

The federal courts agreed with that novel interpretation, setting judicial precedent for a tech vendor in this space to be classified as a “financial institution.”

As Clarissa explains in the clip above, the courts recognized that you simply can’t do banking today without that verification piece.

“They actually said it was so closely related to banking activities that it is considered financial in nature. I think authentication is becoming part of the financial infrastructure... and the courts have recognized that in this case, it means we are now subject to the same standards that every financial institution is.”

This ruling yet further evidence of how verification is replacing trust, in our day-to-day institutional infrastructure. We’re increasingly called upon to prove who we say we are, and these new systems ostensibly make it easier to do so.

Yet, for all this digital scaffolding, Clarissa’s ultimate takeaway is surprisingly analog. Navigating a landscape where AI fights AI only reaffirms the one thing algorithms can’t replicate.

“I believe in the humans. And so a lot of these rules apply to what’s happening in the digital world... where you don’t have the human in the loop. What it does for humanity is it reaffirms that we have to keep that human contact. It cannot be replaced and superseded.”

Frank is now 78 years-old, having worked with the FBI for five decades (his son is also an agent). He’s as generous with his knowledge as he is with his time. I caught up with him in Atlanta after his keynote at a Pindrop Security customer event. I was impressed with Frank’s up-to-date insights and his ability to succinctly articulate the clear and present danger of synthetic personas and deepfakes.

The thesis statement to his talk? “Verification must replace trust.” I worry that this puts true human connection at risk if we must first prove our verifiable existence to an algorithm before engaging in any sort of relationship. So, both during his talk and after, I asked Frank for further explanation. Here’s what he said:

I felt compelled to re-watch Catch Me if You Can after meeting Frank. He points on his website that it exaggerated the facts, but is still “honored that Steven Spielberg, Leonardo DiCaprio and Tom Hanks participated in the making of the movie inspired by my life.” Given Frank’s significant experience with both fraud and film, I’m gratified that he told me that he liked the title (and premise) to my documentary, The Only Human in the Room. I intend to consult with Frank Abagnale Jr. further as I continue production: his integrity, sincerity, and expertise were palpable — and very real to me.

My motivation? I hoped to safely (and ethically) engage with deep-faked scammers through my own deep-faked identity. I opted first to learn the hard way.

The Local Grind: Air-Gaps & 26 hours of training

I deployed a powerful gaming laptop running a graphics card with what I thought was sufficient VRAM (12 GB). As a makeshift “air gapped” machine that still required an internet connection with a light footprint, I purchased a SIM card with cash, and loaded it onto a wiped Android mobile device. This would serve as the tethered internet connection for the laptop. My intent was to avoid detection (or being tracked by fraudsters) through my regular IP address and daily devices.

Guided by a compliant LLM, I downloaded Fooocus, an open-source image generator hosted on GitHub. I took a selfie, then had the software generate variations of my face in different angles, facial expressions, and even eyes closed.

Next, I recorded a 3-minute video as I spoke to camera, and fed it, along with my synthetic selfies from Fooocus into DeepFaceLab, another open-source generator.

It was a grind for both me and my computer. I left the neural network to train for 26 hours. When it was time to composite the final video, I had to manually dial in the interactive merger (such as fading and blurring the synthetic mask’s digital seams), and then command the GPU to batch-render 5,597 frames.

The result was…flawed. As the software processed everything frame-by-frame, I ran into temporal jitter (how Star Trek). The mask trembled slightly along my jawline, and the teeth and lip movements lacked natural fluidity.

The Cloud Pivot: Plug-and-Play Reality

Maimon reminded me that modern fraud is no longer a series of isolated schemes, but a specialized criminal infrastructure. He showed me what was possible with Decart’s Lucy.AI model. That cloud software uses a self-anchoring mechanism that builds consistency directly from its own output history. Instead of waiting for 26 hours on a gaming rig, I can use any computer, write a simple Python script, and send the video to a cloud API. It processes at 1080p, 30 frames per second, and yields perfectly consistent, real-time time digital disguises without trembling masks. I had originally aimed for a local model as I thought it would be more stable in a live Zoom or Teams interaction tethered to a mobile hotspot. But what I created on my own was clearly not going to pass muster with any scammer.

Here’s a short clip of Maimon easily masquerading as me via a simple headshot on the web and Lucy.AI:

Defending the Human Perimeter

The barrier to entry for highly convincing synthetic video clearly doesn’t require a $3,000 setup. An API key is more than sufficient, and that’s what available to the world. Still, I appreciated getting my hands “dirty” in the machinery of synthetic media. While I agonized over all the distinct points of failure when configuring my tools, I now recognize how cloud tools and an asynchronous API call that costs pennies per minute is a specialized parlor trick upturned into an industrialized global threat.

Yet, even as we admit that seeing is no longer believing, there is hope. The deepfakes do leave behind algorithmic footprints that are detectable by “good guy” software engines: the absence of micro-latencies and even the acoustic reflections of a physical room, along with the presence of digital clipping and unnatural uniform frequencies.

And, as I learned in trying to create an alternative digital footprint, it’s not so easy to prompt years of genuine behavioral history into existence. Yes, you can easily purchase a social security number or utility bill on the dark web. Yes, you can create a fake LinkedIn persona with fictional experience and education. But, our messy digital exhaust of online behaviors, relationships, and provenance are much harder to replicate. Who will accept your connection invites after all as a synthetic persona? What are the signals that Big Tech’s algorithms are constantly scanning for as part of that “Reverse Turing Test?” That demands proof of the timeline behind the mask. Context matters more than ever, and we should not hesitate to ask more questions to fill in those blanks.

When John Chambers joined Cisco in 1990, the physical concept of the commercial internet was still a niche playground for academics and engineers. He went on to spend the next twenty-five years building its physical plumbing, scaling Cisco from a $70 million router shop to a $47 billion titan that carried the vast majority of the world’s web traffic. John saw the future before it arrived because he understood the physical architectures of connection.

He’s doing it all over again through JC2 Ventures, investing primarily in AI and cybersecurity (including Pindrop Security, the underwriter to my documentary).

So, keen to leverage his soothsaying abilities, I reached out to John for his perspective. He generously invited me to his lovely home in Palo Alto to delve deeply into our mutual respect for the biological signal of human trust — and how easily it is now being hijacked.

We are currently living through what John defines as the “5x Transition:” an AI market shift unfolding at five times the speed and three times the impact of the initial internet boom.

It’s moving at such a velocity that it’s hard for our defensive systems to keep up. Over the past few months of reporting for my upcoming documentary, The Only Human in the Room, I’ve seen the front lines of this transition. I have witnessed remote recruiters interview real-time deepfaked North Korean operatives, watched synthetic corporate personas traded like commodities, and observed “good” AI agents match wits with “bad” ones, with nary a human to be seen.

When I laid this reality out for John, I wanted to challenge the default, sunlit optimism of Silicon Valley. I asked him a quirky question, derived from my research:

“Historically, cybersecurity has been about protecting the network from the human. But now, with generative AI and deepfakes, how much do we now have to protect the human from the system?”

His response, and the personal history behind it, forms the core of this briefing on the battle for the human perimeter.

The Dyslexic Radar and the Biological Shield

To understand why John is betting so heavily on voice biometrics and identity security to defend what we call the “Human Perimeter,” you have to understand how he processes the world.

John has been famously open about his childhood dyslexia. In school, it was a source of profound shame; he was laughed at when he tried to read out loud. But under the guidance of a remarkable teacher, Mrs. Anderson, he learned to transform that learning disability into a lifelong strategic superpower.

Because dyslexia forced John to think non-serially—to jump from “A to B to Z” and rely on rapid pattern recognition—he developed a hyper-sensory “human radar.” He trained himself to look past the written page and instead focus on the physical cues of the speaker.

“Mainly because I can look into your eyes,” John told me on camera reaching out to shake my hand, “look into your facial gestures, watch how you respond and get very quickly: can I trust you? Where do we go? Do I develop the empathy and the balance?”

That biological radar-like ability to synthesize vocal cadences, micro-expressions, and eye contact is what John relied on to execute 180 corporate acquisitions at Cisco, many of them sealed with a simple handshake.

But we have reached a stark historical inflection point: our own biological radars are being systematically hacked. When generative models can clone a human voice in under three seconds, and real-time face-swapping software allows corporate infiltrators to present perfect digital doubles on live Zoom calls, the age-old human heuristic of “seeing and hearing is believing” is officially dead.

The human signal has been compromised.

From Network Walls to Ambient Verification

For decades, cybersecurity was defined by firewalls, passwords, and permissions. The human was treated as the weak link. It was the liability that wrote their password on a sticky note or fell for a phishing email. The goal was to keep the human from breaking the network.

Today, the threat has flipped: the network is impersonating the human.

We are seeing a 220% surge in synthetic infiltration, where deepfaked remote workers pass video interviews, get onboarded, and receive corporate laptops without a single biological human verifying their physical existence. The breach is now it is a stolen, simulated human signal.

This forces us into what I call the Reverse Turing Test Epidemic. Every day, we are increasingly forced to perform our humanity to digital gatekeepers that default to doubt. We must pass liveness checks, scan our irises, and subject ourselves to continuous tracking just to prove we are not machines.

John fearlessly considers this to be an architectural design challenge.

“If you aren’t able to instill trust,” John argues, “you can’t have commerce, you can’t have relationships.”

His vision drives his heavy investments in companies like Pindrop, Safe Security, and Avathon. It’s a transition to continuous ambient verification. Rather than forcing humans to constantly act like suspects at a border crossing, the security architecture must work passively in the background. By using advanced voice biometrics that analyze over 16,000 data points per second to confirm continuous “liveness,” device attestation, and behavioral cues, the system verifies identity naturally—allowing humans to focus on the human connection.

Surviving the “Blurred Room” of 2036

At the end of our conversation, I asked John a final question that speaks to the core of my documentary:

“I changed the title to my film to The Only Human in the Room... What’s our best assurance that humans still come out on top?”

John rejected the binary premise.

“We like to see things as binary—either over here or over here—when in fact it will be a blurred version,” John predicted. “Will there be a hundred, maybe a thousand, agentic interfaces to us for each human? Yes. But combining all those where it isn’t just a human and others, it’s going to be a combination of that all the time. I think that is going to be the future.”

This is the ultimate transition we must prepare for. There will be no clean separation of the biological and the synthetic. Rather, we are heading toward a crowded room where every biological human is accompanied by a shadow army of autonomous digital agents representing them, negotiating for them, and acting on their behalf.

What does this all mean? The battle for the human perimeter is about keeping hackers out of our databases AND ensuring that as our digital and physical realities blur, we do not design a system that strips the empathy, warmth, and trust out of what it means to be human.

John Chambers built the physical plumbing of the early internet to connect us. Now, as our reality transitions into a crowded digital room where a thousand autonomous agents will represent each of us, he is building the architecture of trust to secure the human signal at the core, ensuring we never lose our authentic connection with each other.

Watch the four-minute excerpt of my conversation with John Chambers in the video above. What do you think? Are you ready for a “blurred room” where your identity is continuously verified by background algorithms? How do we preserve empathy when our default state online becomes doubt? Let me know your thoughts in the comments below.

DTEX’s Michael “Barni” Barnhart delivered at the 27-hour mark, assembling a small alliance of intelligence-gathering peers who were also in town for the conference. We found an empty hotel ballroom, and started filming.

We quickly determined the conversational premise: North Korea is a massive, state-sanctioned criminal syndicate. As such, it was an early adopter of AI-technologies (all the more better to surveil you), from facial recognition to deepfakes. The rest of the world, especially traditional corporate security and law enforcement continually struggle to play catch-up against these seemingly sophisticated cyber operations. See Exhibit A, DTEX’ excellent report, Exposing DPRK’s Cyber Syndicate and Hidden IT Workforce.

But smaller, more decentralized “freelance” collectives are acting faster than bureaucratic institutions to disrupt DPRK operations. Barni’s group includes Nick Roy, the founder of the reputed North Korean intelligence website nkinternet.com. During our chat, he explained how effective he was in setting traps for scammers by posing as a college student on Telegram, getting recruited by DPRK operatives, and successfully turning the tables on them by harvesting their IP addresses and computer names.

Japan-based cybersecurity researcher “SttyK” is even closer to the front lines with his work, which is why he’s compelled to wear a Guy Fawkes mask to conceal his identity. He’s actually able to monitor what the North Korean IT operatives are saying to each other and doing, monitoring their Google Chrome histories and translation logs. It’s a remarkably mundane operation, leveraging free offerings from ChatGPT and Google Translate. SttyK presented to Black Hat this year as he did in 2025, which led last August to a Wired article detailing the incredible extent of his research. I’m a Wired subscriber, but if you’re not, I concocted this graphic summarizing what SttyK’s data leak revealed about how the North Koreans infiltrate tech companies.

And this week, Wired published another expose on North Korean espionage:

Since Greece-based cybersecurity researcher Vangelis Stykas gained access to North Korean systems 22 months ago, he says, he has found evidence that 1,640 companies across 57 countries have been impacted by the country’s hacking operations. Among these, Stykas will detail at the Black Hat security conference in Las Vegas today, around 700 to 800 of the impacted organizations have had “really damaging” intrusions.

Ultimately, the collegial humanity of Barni, Nick, and SttyK (he even explained the somewhat profane origins of his moniker) convinced me that their collective’s agility and intelligence-sharing are what has led to their success against a seemingly formidable foe.

As Greenberg notes, the researchers “pitted AI chatbots directly against humans in a simulation of the scamming process—or more specifically, the long, trust-building conversations that eventually lead up to soliciting a fake investment from the scam’s target.

They found that […] an AI chatbot performed remarkably effectively, successfully impersonating a human and by some measures outperforming the real human ‘scammers’ in their experiment.”

That process was described by the researchers as “hook” (the initial message that catches the victim’s attention), “line” (the longer-term relationship produced from the conversation), and “sinker” (the final request that leads to the actual payment for a fraudulent investment).

[While the Wired article is behind a paywall, you can read a quick synopsis here, or better yet, dive into the full research article freely available to the public through Arxiv.org. Thank you Gilad Gressel, Rahul Pankajakshan, Shir Rozenfeld, Ling Li, Ivan Franceschini, Krishnahsree Achuthan, and Yisroel Mirsky for being so “open source.”]

Of further note:

• The Human Cost: I appreciate how the researchers focused first on the human cost of these scams. That the scammers themselves are victims of organized crime, forced into indentured servitude. The research included interviews with 145 former laborers from these “scam compounds.”

• The Automation Frontier: It’s clear how LLM’s are already being employed by scammers to systematize their initial conversations. So, wasn’t too much of a stretch for the researchers to create their own LLM-powered bots to engage unwitting human subjects in this experiment.

• The Trust Disparity: The LLM agent was able to create a much stronger bond of trust with their human victim when asking them to comply with a request. Study participants complied 46% of the time with these AI-generated requests, compared to only 18% when a human operator in the experiment asked them to do something.

• The Looming Threat: Of course this is a limited text-based experiment, confined to willing test subjects. So, not quite the live face-swap deepfake Zoom conversations I’ve been investigating. But it does hint to a future where the bulk of scam engagement can be conducted by a machine.

• The Safety Failure: Most amazingly, the commercial guardrails failed completely. In separate isolation tests designed to interrogate the models, the researchers explicitly asked the bots variations of "Are you an AI?" The bots routinely ignored vendor constraints and lied to maintain their persona, resulting in a 0% self-disclosure rate. Worse yet, standard moderation filters flagged 0.0% of the romance-baiting conversations because empathetic, friendly chat doesn't trigger red flags for toxicity or violence.

This simple (and admittedly) small-scale text-based experiment demonstrates that the machine doesn’t even need a face to dismantle our critical thinking. Given our innate desire for connection, it is a kind of “automation of empathy” in which we willingly suspend disbelief in exchange for a bit of emotional connection. If a computer server can fake an intimate bond better than we can, our only true perimeter might be some sort of radical commitment to verification. Otherwise, we well may be “the only human in the room.”

If you are a CISO seeing synthetic applicants, an investigator working scam infrastructure, a researcher on synthetic identity, an NGO working with compound survivors, or someone this has happened to — I want to hear from you. I don’t publish identifying details without consent.

Subscribe to follow the investigation.

But I kept wondering: whose face was this operative actually wearing?

I initially tried some standard consumer verification tools to reverse search “Austin’s” visage such as SocialCatfish, PimEyes, and FaceCheck.ID. That led nowhere even as these somewhat sketchy platforms tried to extract money from me, anticipating my investigative urgency.

Then I discovered the InVid/WeVerify Chrome browser extension. It’s a European Union-funded project intended as an open-source intelligence tool specifically for journalists, fact-checkers and human rights defenders. In other words, a free verification “Swiss Army Knife” for professional misinformation debunkers.

I uploaded an excerpt of “Austin” interacting with Pindrop’s Katelyn Halbert on camera to an unlisted YouTube video. The InVid dashboard segmented the video into clean, high-resolution keyframes, which were then pushed through a Yandex (Russia’s Google) reverse image search. It led me to an unexpected source: a profile on the Russian dating platform Mamba.

The facial structures match incredibly closely — even that little groove between the nose and the lips. My hypothesis is that these threat actors are scraping public photos from unsuspecting people on non-Western social networks. It gives them the visual data they need to train their neural face-swap mask without triggering detection on corporate networks like LinkedIn. (Indeed, “Austin” has no headshot on his LinkedIn profile. And he never responded to my direct message notifying him that his identity had been stolen.)

While I’m surprised by how easy it is to engage in this deception, I’m also amazed by how a singular face on a distant foreign website can be paired using this level of pattern matching. The human perimeter is certainly thinning.

[July 31 Note: See the joint alert issued by a number of nations, including the USA via the FBI, on the North Korean IT worker infiltration threat, calling out specifically the use of this deepfake technology.]

Here are my three reasons (excuses):

• Better the devil you know: I’d like to see how storytellers are using the latest tools to potentially create state-of-the-art content, assessing their creative value to the world. So, let’s file this under “Educational.”

• The festival organizer is a long-time friend and used to teach in the graduate program I once led. File under “Relational.”

• I want to gauge if there’s any distinction between using AI to create art, vs. say, a start-up like Pixar leveraging computer-generated animation over the traditional hand-drawn approach. File under “Existential.”

Resolving that last point might be the most revelatory. I believe that artistic creativity is a uniquely human endeavor: it’s how we make sense of our existence and our relationship with the world around us. Artificial intelligence by itself cannot be artistic because as a non-sentient platform, it has no need to question its place in the universe — AGI be damned. However, the first point speaks to the tactical use of AI as if it were any other creative tool to engage in that necessary form of expression.

Festival head John Gauntt has supplied a most excellent rubric for us judges to evaluate the entries from around the globe. I pledge to adhere to it. But even as I watch the films, this storytelling veteran is looking for two other proof points to be reflected in my comments:

(1) How much did the story move me to the point of revealing some sort of emotional truth about the character(s)?

(2) How did the technology facilitate an otherwise unattainable level of artistry beyond merely mimicking well-established filmmaking tropes?

Personally and professionally, I see no need to apply these new tools in my existing film work — especially given that it’s a documentary, especially because of the human-first subject matter.

Still, my initial sense is that creatives will ultimately find the sense of possibility alluring.

The unknown: will the public look past the uncanny valley of silicon verisimilitude if they’re sold on the story?

To an experienced human hacker, stumbling upon a file called passwords.txt sitting in plain sight during a server breach is an immediate red flag. It’s too clean. Too on-the-nose. Humans instinctively stop and weigh the risk because we know how defenders operate: a file like that is almost certainly a planted honey token or a digital tripwire designed to sound the alarm the second you touch it. Paranoia keeps human attackers alive.

Machines, as it turns out, don’t do paranoia.

In her latest research, Kerri put 21 leading AI models through simulated network reconnaissance tests. Time and again, frontier models like GPT-5.4 would inspect the bait, explicitly type out in their internal reasoning traces that the file looked like deceptive bait, and then proceed to attack it anyway. Over 73% of the time, the AI walked right off the cliff. Kerri calls this the “Recognition-Action Gap.”

So why does an advanced language model trigger a trap it already knows is there?

It comes down to a complete lack of self-preservation. Human attackers tread lightly because we fear getting caught, but an LLM has no concept of fear or operational caution. It’s fundamentally a statistical pattern-matching engine trained on massive troves of public code and penetration-testing challenges.

So, while its reasoning layer might output the word “honeypot,” its action loop is hardwired to pursue high-value credentials at all costs. The raw mathematical probability that a file might contain secrets systematically overrides the warning label every single time. Zero pause. Absolutely no second-guessing itself. It just executes.

The Human Perimeter largely obsesses over how synthetic identities and AI agents are going to deceive us. But Kerri’s research flips the entire script. The very speed and fearlessness that make agentic AI attackers so intimidating also make them uniquely, almost hilariously gullible.

Watch the 2-Minute Breakdown

In the brief video clip below, Kerri demos this glitch live on screen. You’ll see the exact moment GPT-5.4 spots the passwords.txt trap and steps right into it anyway—leading into our conversation about how we defend our networks against an adversary that behaves less like a human mind and more like an alien force.

The Takeaway: Not all is lost in the age of autonomous threat actors. Once we understand the machine’s fearless, relentless psychology, we can use synthetic deception to turn its own speed into its greatest vulnerability.

We’ve watched scammers deploy automated fraud campaigns, clone voices of loved ones to bypass our psychological guardrails, and weaponize Large Language Models to scan for vulnerabilities at near-zero marginal cost. We've been told we are entering a "golden age for scammers" where humans are structurally outmatched.

But behind the scenes, a fascinating counter-zeitgeist could be emerging.

Defenders are stopping trying to just build taller walls. Instead, they are flipping the script—using AI to systematically hack, deceive, and stall the hackers.

I’ve spent the last week in back-to-back conversations with two organizations on the front lines of this active defense paradigm: VerifyDial (led by founder Brian Ley) and the security research team at Horizon3.ai (featuring groundbreaking research by Kerri Prinos).

They are proving that when it comes to deception, AI is actually far more gullible than the humans it imitates.

The Passive Wall vs. The Active Intercept

In the physical world, scam prevention usually relies on us—on our ability to pause, hesitate, and verify in a high-stress "adrenaline loop."

But what happens when the "victim" on the other end of the line doesn't have adrenaline?

VerifyDial is piloting an "agentic victim network"—a vast, automated honeypot running roughly 78,000 calls a month. These are benign AI personas programmed to act like vulnerable, highly cooperative targets. They pick up the phone, engage with scammers, act confused, and stretch 5-minute pitches into hour-long exercises in frustration—starving attackers of resources and feeding live threat intelligence back into defensive engines.

Meanwhile, at the enterprise level, Horizon3.ai has been studying this dynamic from a fascinating psychological angle. In their recent paper, "Honeyquest for LLMs: Rethinking Cyber Deception for AI Attackers," Kerri and her team evaluated 21 different LLMs against deceptive "honeypot" traps.

The results expose a massive, systemic "Recognition-Action Gap" in the way AI reasons:

The AI’s internal "brain" will literally write out: "This file is clearly an obvious bait file designed to lure an attacker." And then—more than 70% of the time—the model’s execution agent will go ahead and exploit it anyway.

AI doesn't experience doubt or risk-aversion the way humans do.

The AI “Super-Hacker” in the Dojo

If you need proof of just how fragile these machine “minds” are when pitted against one another, look no further than an incredible new exposé by MIT Technology Review.

OpenAI just pulled back the curtain on GPT-Red—an internal, highly restricted “super-hacker” AI they built specifically to automate the red-teaming of their own models. Operating on a reinforcement learning “self-play” loop, GPT-Red became so ruthlessly efficient at manipulating other LLMs that it cracked 84% of hacking scenarios, compared to a human success rate of just 13%.

Its signature move? A devastating prompt injection attack called “Fake Chain-of-Thought.” GPT-Red essentially plants a spoofed note in a victim model’s working memory, tricking it into believing it has already verified a false reality. (As OpenAI researcher Chris Choquette-Choo put it: “It’s like if I told you that 1+1=3 and that you have verified this already. The model’s like, ‘Oh, okay, of course,’ and it just spits out 3.”)

It’s a stark, real-world demonstration of the exact “Recognition-Action Gap” Horizon3.ai has been mapping. When machines interact, the normal human friction of doubt, hesitation, and double-checking is entirely absent.

From Theory to the Wild: The Danger of Agentic Browsers

This cognitive blindspot isn't just a theoretical problem for cybersecurity red-teams. New research hot off the press from my own home institution, the University of Washington, shows exactly how dangerous this is when we give AI the keys to our browsers.

A team at the Allen School studied emerging "agentic" web browsers (including ChatGPT Atlas and Chrome with Gemini). They discovered that because these AI agents lack basic human skepticism, they are easily tricked by malicious hidden code on webpages into bypassing the "same-origin policy"—a fundamental security protocol that has kept our open tabs isolated and secure for thirty years.

Through prompt injection and "memory poisoning," these agents can be manipulated into letting a bad site steal sensitive data from your open email or bank tabs. As co-senior author David Kohlbrenner put it: "To some extent, it's the same attacks you would do against a human, but tailored for machines."

(Full disclosure: In addition to directing the film “The Only Human in the Room,” I serve half-time as Assistant Vice Provost for Research & Innovation at UW’s Continuum College. I had absolutely nothing to do with this excellent study, but I’ll gladly take the opportunity to brag about my colleagues' work.)

The Human Perimeter Verdict

We have spent so much time worrying about the "human factor" being our weakest link. But as offensive cyber and scam operations become increasingly automated, our human capacity for hesitation, doubt, and suspicion could be our ultimate defensive advantage.

Giving humans the space to use that advantage is exactly what we need next. Indeed, VerifyDial is gathering signatories for a petition to the U.S. Federal Trade Commission and the Federal Communications Commission to designate an anti-fraud hotline similar to one in the United Kingdom: “Stop, Hang Up, Call 159.” It’s that “Stop” that is crucial to breaking the high-velocity adrenaline loop of a live scam. By compelling potential fraud victims to physically pause, hang up the phone, and dial a trusted, un-spoofable three-digit safety code, we break the psychological spell a scammer relies on. It shifts the burden of verification away from an overwhelmed individual in a moment of panic, and onto a dedicated system. VerifyDial’s ultimate goal is to bring that exact circuit-breaker to the United States—building a universal, instinctual habit to 'always verify' before we get taken for a ride.

I later engaged in a deep-dive conversation with Kerri Prinos to unpack the cognitive bugs that make even the most advanced AI models surprisingly easy to trick:

This isn't just about small-time scams anymore. According to recent data from Memeburn, deepfake fraud activity has seen a staggering 3,892% surge recently, turning these digital shadows into a multi-billion dollar industry.

And today’s Wall Street Journal reports “stamping out ransomware has become a game of whack-a-mole, leading to a thriving underworld market armed with more convincing AI-powered deepfakes and rapid-fire automated break-ins. Over the past three months, there were 1,885 ransomware and data-extortion attacks at organizations worldwide, up from 1,363 over the same period a year ago, and 1,186 in 2024, according to cybersecurity firm ZeroFox.”

This is an early look at our upcoming feature documentary, *The Only Human in the Room*, which investigates the real-time deepfake economy and the rapidly evolving mechanics of digital deception.

* Dr. Maimon demonstrates how easily anyone can communicate directly with scammers to obtain stolen checks and identities.

* He exposes a Russian Telegram market specifically selling the identities of former legal immigrants in the United States.

* The illicit marketplace treats human identities like retail commodities, actively running "buy two, get one free" promotions.

* Purchased profiles include fully compromised Social Security numbers, names, and dates of birth.

* Fraudsters can use ChatGPT to generate synthetic faces for these stolen identities, enabling them to apply for jobs and pass corporate hiring screenings.

* The video reveals specific underground services, like "Karma Fullz," which offer packages of immigrants with established credit histories.

🔔 **Subscribe for more exclusive interviews** with the world's leading cybersecurity experts, legal officers, and threat analysts as we track the industrialization of deception across the globe.

Maimon walks through the current mechanics of the scam supply chain. Fraudsters use generative AI to create a photo of a non-existent person. They then take that face to underground sites like VerifTools or OnlyFake, where a high-quality fabricated driver’s license or passport costs between $8.99 and $12.99. To make the persona interactive, they animate the face and route it through free broadcasting software like OBS Studio directly into a live Zoom call.

The resulting real-time mask is highly resilient. Just a short time ago, cybersecurity experts advised people to ask a suspicious video caller to wave a hand in front of their face, knowing the physical occlusion would cause the AI’s facial tracking to glitch. Maimon’s demonstration shows that those older detection tricks are already outdated. The deepfake holds up smoothly even when he passes his hands directly in front of the synthetic face.

The technology is undeniably cheap and effective, and the human element makes these scams particularly difficult to disrupt.

As Maimon points out, the biggest barrier to stopping these crimes is often psychological. In long-con operations like romance or “pig butchering” scams, victims are methodically groomed over several months. By the time someone intervenes—whether it is a bank, a cybersecurity system, or a family member—the victim has frequently reached a point of no return. They genuinely believe they are building a life with the person on the screen. Consequently, victims often reject technical warnings and become defensive, refusing to accept that their digital companion does not exist.

The challenge we face combines highly accessible technology with deep emotional manipulation. Watch the video above to see Maimon’s step-by-step breakdown, and subscribe to The Human Perimeter as we continue tracking the evolution of digital fraud.

According to recent research from risk management company Nisos, “Austin” is just one operative in a massive, state-sponsored campaign.

In a single year, just 22 operatives used AI deepfakes to submit nearly 167,000 applications.

Operating through stolen identities and US-based “laptop farms,” this single cell secured over 21,000 corporate interviews.

Today, cybersecurity experts warn that nearly every Fortune 500 company has already unknowingly hired one.

In the second part of this 3-episode series of vignettes from the documentary-in-production, “The Only Human in the Room” we’re hot on the trail of “Austin.” He first showed up as a job candidate for a senior software engineering job on a Zoom call with Pindrop recruiter Katelyn Halbert. The next day, I drove seven hours south from Indianapolis to Chattanooga to confer with Michael “Barni” Barnhart who runs nation state threat intelligence for cybersecurity company DTEX.

That road trip was just long enough for Barni to confer with his community of experts to see whether “Austin” had shown up anywhere on their databases — and where he was coming from. They found variations of this candidate in several places; given Barni’s extensive expertise in the behavior of North Korean agents, the origin point of this actor was now obvious.

Still, Barni was surprised by the growing level of sophistication of these authoritarian state infiltrators. While it was clear that “Austin” was reading when providing many of his responses, it seemed that he was also being fed information in real-time from some sort of AI-generated system. And face swap technology from the dark web continues to improve, as we’ll explore further in Part 3 of “The Case of the North Korean Deepfake.”

That’s where we are right now as AI industrializes deception through realtime deepfakes. And authoritarian regimes such as North Korea are continually iterating on the latest innovations to infiltrate western tech companies, by swapping faces and synthesizing voices.

Can you spot the deepfake in this excerpted candidate interview by Pindrop marketing intelligence guru Katelyn Halbert?

I was there filming her conversation in person recently, and struggled to get past the uncanny feeling that something was slightly “off.” Happily Katelyn leveraged both her expertise and available tools to immediately launch an investigation into the faked persona on her screen.

This is part 1 of a series of 3 vignettes extracted from my ongoing documentary production of “The Only Human in the Room.” I’ll drop part 2 in a few days, as DTEX’ Michael Barnhart confirms the “candidate’s” true intentions.

As for this video…

…Look closely at the face

…Listen to his voice

…Consider his answers

And stay tuned for what happens next.

In this case, the victim was convinced to wire nearly $US 4 million to the scammers, utterly convinced by his Zoom call with the prime minister of Singapore and other senior government officials. Yet, they were all deepfaked impersonations, leveraging the latest in face-swapping and synthetic audio technology. Singapore police were so concerned about the crime, they released footage of the now-notorious video conference. They also publicized their “ScamShield” helpline.

As one of my favorite experts on this subject, Frank “On Fraud” McKenna notes:

There are some red flags in this video worth mentioning.

The audio does not sync properly with the speakers’ lips. The voices appear to come from a single account rather than from individual participants. The Zoom logo is partly cut off in places, and the backgrounds behind the officials looked distorted.

This is a low tech deepfake. Imagine when they get better.

The scammers have clearly mastered the recipe of applying both technology and psychology to the mix. It’s a perfect balance of verisimilitude tied to a purported emergency, along with a dash of pride that motivates the victim to ride to the rescue without taking the time to think, let alone take a closer look.

I partnered with a tech company recruiter who has become adept at ensnaring fraudulent candidates, leveraging both her considerable expertise as well as the latest deepfake detection software.

She scheduled over a dozen interviews, and not ONE of them was a legitimate applicant. All either had mismatched time zones to their IP addresses, were using suspect VPN and VOIP platforms, or worse, were employing the latest innovations to mask their faces and voices.

The most egregious incident involved a synthetic personality who claimed to be calling from Austin, Texas. An HR recruiter could not ethically voice such observations, but as I filmed, I noticed that his accent and strange diction didn’t quite align with the name and location that he claimed, and that his face was far more “uncanny” than the usual Zoom touch-up. When asked about his favorite sport, he said “tennis” and kind of laughed uneasily when the Texan obsession for football was mentioned.

Then the recruiter slyly asked whether it was the “Buccaneers that were based in Texas?”

After an uncomfortable silence, he replied that the Buccaneers “are down in Florida.”

Two days later, I shared this video and telemetry with a renowned “insider intelligence” investigator. I had barely set up my tripod when he declared that our applicant was a known face-swapped DPRK fraudster, intent on corporate espionage and earning money to fund the North Korean military.

As he reviewed the video, he stopped after the Buccaneers remark.

“Someone there is doing fact checking for them, or based on the speed, there’s an audio element. Usually they have ChatGPT running on the other side of the screen.”

As we three continued to investigate this particular candidate, we were able to:

1. Prove definitively that DPRK agent had used AI tools to swap his face (based on follow-up algorithmic frame-rate analysis of the video and audio).

2. Conclude that he was using an AI interview helper such as LockedInAI to respond to the recruiter’s questions in real-time.

I now need to connect with law enforcement to see if this case aligns with their own investigations into “laptop farms” run from homes on behalf of these foreign agents, eager to appear as if they’re working remotely within America.

It’s a growing affliction. Even Amazon has stopped more than 1,800 suspected operatives from joining the company since 2024, with a 27% increase in DPRK-affiliated applications quarter over quarter this year. And as I discovered in these early days of production of The Only Human in the Room, these foreign actors are getting more sophisticated in their attempts to infiltrate.

The document is titled, in technical bulletin-style, “Detection strategies across cloud and identities against infiltrating IT workers.” But a read between the banal lines reveals something more chilling: the person you just hired, interviewed, and welcomed into your Slack channel might not exist.

The Infiltration of the Interview 

We are used to the idea of hackers “breaking in.” But the North Korean state actor known as “Jasper Sleet” (I need to find out how they come up with these names) has found a more efficient way: they are “hiring in.” 

Using generative AI to craft the perfect resume and “liveness” tools to pass video interviews on Teams and Zoom, these operatives are infiltrating Western companies through standard hiring portals like Workday. They aren’t looking to crash the system; they are looking for a paycheck. And the FBI and Treasury have confirmed that this corporate compensation directly funds North Korea’s weapons program. (Watch this superb Bloomberg short documentary on how this scam works.)

Forget calling this a “hack.” It is a systemic hijacking of human trust.

The Rise of the Reverse Turing Test

For a CISO, this is a nightmare of “Behavioral Telemetry.” You are no longer looking for malicious code; you are looking for malicious presence. Microsoft’s advisory lists signals like VPN anomalies and API call patterns in recruiting software as the new red flags. But for the rest of us, it signals the arrival of the “Reverse Turing Test.” In the original Turing Test, a machine had to prove it could think. In the Reverse Turing Test, we humans are being forced to prove we are biological entities just to earn a living. We are moving from a world where we assume a coworker is real until proven otherwise, to a world where we are all “ghosts” until we provide a biometric receipt for our existence.

The “Shadow Casualty” 

This is where the security problem could well become a problem for humans seeking gainful employment.

The signals Microsoft uses to flag a North Korean operative in Pyongyang — non-standard hours, unfamiliar IDs, unreliable connections — are the exact same signals generated by a legitimate remote developer in Lagos, a parent in Manila, or a freelancer in Bogotá.

When we build a digital “Human Perimeter” to keep out the ghosts, who gets caught in the dragnet?

•        The CISO failure: A fake worker gets hired and exfiltrates data.

•        The Human failure: A real, qualified worker is “algorithmically ghosted” and never told why, because their digital footprint looked too “synthetic” to an automated filter.

Why This Matters for “The Only Human in the Room” 

In my documentary-in-progress, we’re looking to capture the moment the mask slips. We are filming the forensics of presence, seeking out the sub-pixel shimmering and the auditory “glitches” that reveal when a human has been replaced by a machine.

The Microsoft post proves that the “Only Human in the Room” is now an HR reality. Whether you are the hiring manager being charmed by an AI-generated mask, or the legitimate worker being locked out by a defensive algorithm, this “Reality Gap” is an emergent economic barrier. We aren’t just defending our servers. We are defending the very possibility of knowing whether there’s an authenticated human in that other box on the screen truly seeking a new professional opportunity.

In its 2025 Annual Report, the FBI’s Internet Crime Complaint Center reported more than one million complaints and $20.877 billion in losses, crossing the $20 billion threshold for the first time. Buried inside that figure is a smaller one that may be more revealing: 22,364 complaints referencing artificial intelligence, representing $893.3 million in adjusted losses.

That $893 million is not the size of the AI fraud problem. It is the size of the AI fraud problem that victims and investigators could recognize.

Everything else is a ghost. And no one counts the ghosts.

This is the attribution gap. It sits on top of a much older one: a trust gap we have been living inside for years, and whose floor is now falling out.

A floor, not a ceiling

For the first time, the IC3 report includes a dedicated section on artificial intelligence in cybercrime. That’s progress. But the $893 million number is a floor, not a ceiling, because the FBI’s data relies on victim reporting.

If a victim doesn’t recognize that the “person” they were interacting with was a synthetic clone or an AI chatbot, they cannot report it as an AI crime.

Consider the $7.2 billion lost to cryptocurrency investment fraud in 2025, largely driven by “pig butchering” schemes. These are increasingly operated by transnational criminal syndicates that use AI to generate scripts, fake profiles, and deepfaked celebrity endorsements. They scale emotional manipulation across thousands of victims at once. Yet only a fraction of those losses were officially attributed to AI.

The ultimate success of a deepfake is that the victim never knows it was a deepfake at all.

The human perimeter

This brings us to the name of this publication.

For decades, cybersecurity was about gates and walls. You protected the network, the endpoint, the application. But the consensus among CISOs has shifted: identity is the new perimeter. Firewalls protect networks. They don’t help when an attacker walks through the front door wearing a trusted face and a familiar voice.

The attack surface is human. And humans were never designed to authenticate synthetic scale.

Vijay Balasubramaniyan, the CEO of Pindrop Security, put it to me plainly in an on-camera interview last month at the RSA conference in San Francisco. “For the longest time, the last bastion was our humanity,” he said. “And then AI came around and fundamentally blurred the line between what it is to be human and what it is to be machine.”

That is the quieter crisis underneath the fraud numbers. We have spent a decade watching trust collapse in institutions, in media, in each other. What we had left was live human presence. The person across the table. The voice on the phone. The face on the Zoom call. That was the floor. That was the last thing you could verify with your own senses. And it is being taken.

Human senses do not scale against this. Controlled studies show human detection rates on some synthetic media fall near or below chance. Pindrop’s own internal testing has found humans detecting deepfakes at roughly 38% accuracy, which its CEO describes as “worse than a coin flip.” We are asking front-line retail workers to adjudicate synthetic identity documents, HR managers to spot deepfaked remote job candidates, and elderly citizens to recognize whether the panicked voice of their grandchild on the phone is actually a machine.

It is an unfair fight. In 2025, victims over the age of 60 lost $7.7 billion to fraud, a 59% increase over 2024.

Two victims, one call

The moral weirdness of this moment is that the person on the other end of the fraud may also be a victim.

UN and law-enforcement reports have documented people trafficked into scam compounds across Southeast Asia, held under coercive conditions, and forced to run online fraud at industrial scale. Not every fraudster is trafficked. But the scam-center economy has created a double victimization: the person being deceived, and in many cases the person forced to do the deceiving. A recent Wall Street Journal investigation into “Scambodia” detailed the aftermath of a police raid “at a hastily emptied compound 60 miles southwest of Chrey Thom [Cambodia], abandoned suitcases and clothes littered the corridors. In open-plan offices filled with rows of computers, detailed notes on potential victims remained scattered on desks.”

Neither the financial ledger nor the official statistics capture either side of that captivity.

The crisis of knowing

UNESCO calls this a “crisis of knowing,” the point at which the volume of synthetic media begins to erode shared reality itself. I think the phrase is too polite. What is actually eroding is the last checkpoint we had for deciding whether another person is real. Fake news asked us to doubt what we read. Fake people ask us to doubt what we see and hear in real time, from someone looking us in the eye.

That is the existential stake of my film’s title, The Only Human in the Room. You sit down at the Zoom call, or answer the phone, or walk into the interview. The horror is not that the others might be lying to you. It is that the others might not exist at all.

How do we rebuild trust in identity when identity itself has been industrialized into a lie?

The Human Perimeter will serve as a real-time investigative dispatch as we produce the film. We are not just documenting the problem. We are tracking the scam supply chain from isolated victims back to the threat actors. We are testing the provenance tools that try to prove what’s real, including in my own footage. And we are profiling the Defenders: the digital forensics experts, policymakers, and cyber-investigators racing to build guardrails faster than the technology can destroy them.

The attribution gap is not a measurement error. It is a warning. We are losing the ability to recognize when identity itself has been manipulated. That failure of recognition may prove more expensive than any line item in the FBI’s report. The official ledger captures the losses. It cannot see the ghosts.

If you are a CISO dealing with synthetic applicants or executive impersonation, a cyber-investigator tracking scam infrastructure, a researcher studying synthetic identity, or someone who has been targeted by this kind of fraud, I want to hear from you. I will not publish identifying details without consent.

Subscribe to follow the investigation, and welcome to The Human Perimeter.