Recent Happenings

• Vegetable and fruit AI slop emerged as a potential replacement to Italian brainrot. Based on how often they appear on my feed, they might be losing the race. It seems like we will not be getting vegetable slop theme parties.

• Iran has been actively engaging in meme warfare. Surprisingly, they went for LEGOs instead of Studio Ghibli. Either way, the White House is definitely not unprepared for this.

• A huge marketplace for scam services and potentially even human trafficking (as per WIRED) seems to be operating with no repercussions on Telegram. The market is easy to find, although it’s hard to verify what products actually get traction. We will continue to monitor the situation.

Now, back to our regularly scheduled programming.

I’ve been referencing Tor and the dArK w3b throughout my posts without ever dedicating a piece to it. This is that piece. What it is, who made it, what’s on it, and why it’s fading.

When you use the Internet everyday, you are using the “surface web” or the “clear web.” These are essentially all the websites that are indexed and discoverable by Google. Throughout the years, websites like Facebook and Instagram began to host more and more Internet content. Companies also began hosting their own Intranet networks. This content is typically not easily accessed externally. If you want to find an Instagram post, Google will not help you much. While I don’t like the name, these portions of the Internet which are not externally accessible, have been dubbed the “deep web.” Both the surface web and the deep web operate largely with the same underlying protocols.

The “dark web” is slightly different. People take the “dark web” to generally mean Tor hidden services (or Onion services) which are accessible through a Tor browser. Tor stands for The Onion Router because the onion analogy inspired the design of the protocol. Just like other Internet protocols, Tor came out of a military research lab.

When I say protocol, what I mean is a set of rules. Safari, Firefox, Chrome, etc. all follow a set of rules that allow them to get the content of websites. When you visit a website, it’s like you are sending a letter. You put the letter into the mail with a given address. The post office routes this letter to the destination. It’s delivered. They write a letter back with their response. The post office routes the letter… you get the point. This is how you get a website. We have protocols to send letters, packages, freight, etc. Other countries follow similar rules and so we are able to send mail internationally as well. We have protocols that let us transmit information both in the physical and the digital world.

How Tor works, roughly

The problem is that if you are doing something that requires privacy, such as sharing private state secrets or accessing nsfw pony cartoons, you may not want the post office to know that you are sending a letter to “ponyland xxx.” Tor to the rescue. To follow the Tor protocol, what you would do is:

1. Put your letter addressed to ponyland xxx in an envelope addressed to Alice (she’ll be the last recipient before ponyland).

2. Then you will put your envelope addressed to Alice in an envelope addressed to Bob.

3. And then you put everything into an outermost envelope addressed to Charlie (the first stop).

So, your letter is first sent to Charlie. Charlie knows you sent them a letter and Charlie knows to then send the letter to Bob. Bob opens the letter from Charlie and sees that it is a letter for Alice. Alice opens the letter and sees that it is a letter for ponyland xxx and sends it. In this way:

1. Charlie knows you sent them a letter and that the next destination was Bob.

2. Bob knows they received a letter from Charlie and that the next destination was Alice.

3. Alice knows they received a letter from Bob and that the next destination was ponyland xxx.

4. Ponyland only knows that Alice sent them a letter, and they return a response.

No single relay knows both who you are and where the letter is going. Charlie knows you but not the destination, Alice knows the destination but not you, Bob is in the middle and knows neither end. The response travels back through the same chain in reverse.

This idea of envelopes that you peel out is what makes this The Onion Routing protocol. Even though I left a lot of technicalities, what you need to remember is that: done well, Tor is the most private way we have to browse the Internet.

How is this different from a VPN? A VPN is like using FedEx instead of USPS––FedEx doesn’t tell the post office where your letter is going, but FedEx itself knows everything: who you are and where you’re sending mail. With Tor, no single party has both pieces.

You can use Tor to browse regular websites, as well as “hidden services.” Hidden services are websites that hide their own address the same way you hide yours. Neither side knows where the other actually is. Hidden services are what you use if you’re setting up sketchy websites so the police don’t come after you as an operator. And you use a Tor browser to access them so you evade the law as a consumer.

What goes on the Tor network, anyway

Tor’s privacy affordances made it an ideal candidate to host sites where illegal happenings took place. After a series of failed attempts on the clear web, more tech savvy users saw Tor as a viable alternative to evade law enforcement. And then, with Bitcoin’s arrival, people saw that they had a way to privately host websites, privately navigate to said websites, and a (seemingly) private way to transact online: so people began selling drugs.

If Telegram is the Wallet City of Kowloon, Tor hidden services are underground tunnels, like the ones used in the Vietnam War: large networks of websites that are hard to find, some of which have links to others, but a lot which are isolated from each other.

Whenever I used to describe my PhD work to people, more often than not people thought of weapons and hitmen, sometimes drugs. In reality, it’s just mostly about drugs. I’d venture and guess that drugs are the primary use case, followed by illegal digital goods/services (e.g., stolen data, hacking or spam services, etc.), and lastly unregulated media, mainly porn and gore.

This isn’t to say other stuff doesn’t exist; weapons and CSAM are both there. But a few things keep the dark web from becoming the lawless free-for-all people imagine. There’s the technical hump, first to access the sites and then to pay for things. There’s the clear web alternative. Most people don’t actually need Tor to find unregulated porn, fake IDs, or counterfeit goods. There’s the police, who run a major bust every couple of years and pursue the more extreme stuff aggressively enough that most sites have rules against it (better to piss off one federal agency than five). And there’s the common fear that the sketchy website you’re trying to buy drugs from is also going to give your computer a ~virus~.

It is important to mention that the Tor network has important benign uses. It allows people that really need privacy (e.g., dissidents, journalists in conflictive zones, etc.) a way to navigate the Internet. It also allows people to circumvent censorship. Unfortunately, while Tor helps hide the content you are browsing from prying eyes like your Internet service provider, it does not hide the fact that you are using Tor. The fact that “you have something to hide” in itself can attract scrutiny from law enforcement. Also, a lot of the Internet becomes less usable when you use privacy-preserving technologies; you may get infinite CAPTCHAs just trying to reach Google. This has ultimately prevented this tool from flourishing.

All of this has resulted in a network that––all things considered––is not very big. A recent paper found only ~25k unique sites. A quick skim of /r/onions reveals little activity and the same handful of websites that are worth visiting. Circa 2015 era, there were about 20ish darkweb markets operating at a given point in time. By the 2020s, you’d be pressed to find 5.

In 2026, the dark web seems to be dying.

Tor requires a dedicated browser that doesn’t run on your phone, loads slowly, and breaks on half the sites you try to reach. Many online guides will tell you to not even open it unless you are using a separate operating system. Paying for things in a private way has also gotten harder, even with cryptocurrencies, because so many crypto exchanges have implemented rules that require you to verify your identity. All of this makes it a major hassle. In a world that is increasingly mobile-first and short-attention-spanned, VPNs and Telegram are winning.

Usability alone doesn’t explain it, though. In recent projects involving the misuse of AI, both to generate deepfake pornography and to generate malware, I had little luck finding leads in the dark web. It turns out the clear web was permissive enough. The enforcement pressure that pushed illicit activity onto Tor in the first place has slackened, or at least become inconsistent enough that operators are willing to take the bet. Why offer deepfake services on the darkweb when you can do it on Fiverr? Why go to Tor for illegal goods and services when you can go to Telegram?

What’s left on Tor is what can’t be tolerated anywhere else. Which these days is not much.

Adjacent Reading

1. Jardine et al. “The potential harms of the Tor anonymity network cluster disproportionately in free countries.”

2. Leonidou et al. “A Qualitative Analysis of Illicit Arms Trafficking on Darknet Marketplaces”

3. Soska and Christin. “Measuring the Longitudinal Evolution of the Online Anonymous Marketplace Ecosystem”

Yesterday, WIRED published a piece based on a new report by AI Forensics documenting abuse on Telegram. The headline: men are buying hacking tools to use against their wives and friends. The report behind it is a serious piece of work: 57 pages, 2.8 million messages analyzed across 16 Italian and Spanish-language Telegram groups, collected over six weeks. AI Forensics is a credible organization doing important research.

If you read Part I of this series, nothing in the report will surprise you. Of course Telegram hosts groups where people share non-consensual images. Of course bots play a central role in automating and scaling operations. Of course the groups regenerate hours after being shut down. Telegram has the infrastructure for all of these things. The report documents real harm happening to real people, and the finding that most victims are ordinary women targeted by people they know––partners, ex-partners, acquaintances, colleagues, and classmates––is consistent with everything the academic literature has established about image-based sexual abuse for the past decade.

Where the report runs into trouble is not in what it found, but in what it claims to have found.

Consider the hacking services. The report documents over 18,000 references to spying or surveillance tools, and 441 references to hacking services. Screenshots show users advertising “professional hacking on commission,” promising access to phones and social media accounts. The presentation is alarming. It is also, to anyone who has spent meaningful time in these spaces, mostly theater.

The people offering to hack your wife’s iPhone for $50 are not sitting on zero-day exploit chains. They are not former NSA operators moonlighting on Telegram. They are, overwhelmingly, scammers who can take your money because you will have nobody to complain to. The misspellings are a tell. The pricing is a tell. The vagueness of the technical claims is a tell. Real offensive cyber capabilities are not sold in Telegram groups with open enrollment. At the very least, you would hope your hacking contractor uses Signal.

This does not mean spyware is absent from Telegram. Commercial stalkerware is real, genuinely harmful, and I would not be surprised if there are groups where you can find this software and help deploying it. But the report does not clearly distinguish between a scammer posting a menu of hacking services he cannot deliver and a channel distributing actual surveillance software. The screenshot gets the same evidentiary treatment either way.

The same problem appears with the report’s most alarming claims about child sexual abuse material (CSAM). The report documents folders and offers that claim to contain CSAM. The claims are real, the groups exist, the advertisements exist, the folders are labeled exactly as described. But a lot of what gets advertised in these spaces is also bait: marketing designed to extract payments. The folders can say whatever but this is no guarantee that the content exists or that the advertiser can fulfill the promise. This is not speculation on my part; it is a pattern that anyone who has done sustained fieldwork in underground Telegram communities recognizes. Scammers impersonate the flashy content (usually the worse stuff) because the flashy content commands the highest prices and the most desperate buyers.

I want to be precise about what I am and am not saying. I am not saying CSAM does not exist on Telegram. It does. I am not saying these groups are harmless. The advertisements themselves normalize the content they describe, and some percentage of what circulates is genuine. I am saying that a methodology that treats advertisements as equivalent to verified content will systematically misrepresent the scale and nature of what is actually being transacted. The same thing happened with darkweb marketplaces. People saw that weapons and hits were advertised on these markets, thought it was a common thing, and fell for it.

Here is the distinction that matters: some evidence on Telegram is self-authenticating, and some is not.

When someone posts a non-consensual intimate image in a group, the posting is the harm. The image is real, the victim is real, and the damage is done the moment the file is shared. There is no gap between the advertisement and the product. A screenshot of this is sufficient evidence because the evidence and the harm are the same object.

When someone posts a listing advertising hacking services or CSAM access, the posting is not the harm––or at least, not the harm being claimed. The harm would require the service to be real and the content to be genuine. A screenshot of a listing is evidence of demand. It is evidence that someone believes there is a market for this. It is not evidence of capability or supply.

The report’s strongest findings (the non-consensual image sharing, the nudification bots, the doxxing) are all cases where the posting is the harm. These findings are methodologically sound because they do not require the researcher to verify anything beyond what is visible. The report’s weakest findings (the hacking tools, the CSAM claims, the spyware advertisements) are all cases where the posting is an advertisement for something that may or may not exist behind it. The methodology does not change between these two categories, but it should.

This brings me to a tension I cannot resolve but it’s pervasive in this type of research.

The report’s unreliable evidence points at real problems. Telegram likely hosts spyware distribution. Telegram does host CSAM. The fact that most of the specific listings documented in this report are unverified (and possibly scams) does not mean the underlying harms are fictitious. So if a policymaker reads this report and concludes that Telegram needs stricter oversight––which is AI Forensics’ explicit recommendation, calling for Telegram to be designated a Very Large Online Platform under the DSA––they have arrived at a defensible conclusion through partially indefensible evidence.

Similarly, the WIRED headline may be true, but it is not necessarily supported by the evidence it points to. Is that acceptable? Scientifically, no. Practically, I do not know.

Policy built on misunderstood evidence can misallocate enforcement resources. If regulators believe Telegram is primarily a marketplace for sophisticated hacking tools, they could prioritize interventions for a threat that barely exists while ignoring the one that does: the low-barrier, high-volume sharing of non-consensual intimate images by ordinary men targeting ordinary women. But demanding perfect evidence before acting means never acting, because Telegram’s opacity is precisely what makes perfect evidence impossible.

We do not need to prove that Telegram hosts sophisticated spyware operations to have grounds for action or moral panic. The verified findings––that thousands of people are sharing non-consensual images of women they know, at scale, with essentially no friction––should already be enough. We do not need to reach for more.

Adjacent Reading

• Cuevas et al. Measurement by Proxy: On the Accuracy of Online Marketplace Measurements.

• Indicator. The Indicator Guide to Using Telegram in Digital Investigations.

• Campobasso et al. You Can Tell a Cybercriminal by the Company they Keep: A Framework to Infer the Relevance of Underground Communities to the Threat Landscape

• Nucleo. Telegram App Says It Prioritizes Child Safety. Its Bots Tell a Different Story

• Part I of this series: The Telegram Ecosystem.

PS: Thanks to Miranda Wei for sharing the WIRED piece and AI Forensics report.

Essentially, anybody can now prompt a model to find critical software vulnerabilities. According to keyboard pundits, we are about to be in a world of hurt. I’m willing to be a contrarian on this point and argue that nothing will fundamentally change between attackers and defenders. Finding all these vulnerabilities changes little.

Context. In February, Anthropic’s Red Team published a blog post demonstrating how Claude can, on its own, find a ton of vulnerabilities. A week ago, Nicholas gave a talk at Unprompted showing live how Claude found “zero-day vulnerabilities” in Ghost, the open source version of Substack that I didn’t want to bother setting up, and in none other than one of the most publicly scrutinized codebases: the Linux kernel.

A zero-day vulnerability is a fancy way of saying a vulnerability that no one has seen before. A vulnerability in computer security means that some piece of software has a flaw that can be exploited to do bad things. And, because no one has seen it before, defenses do not yet exist. Imagine, for example, you find a flaw in a government’s server that lets you read all the employees’ information. Or imagine you find a flaw in a company’s systems that allows you to lock all computers down and ask for money to unlock them. Or imagine you find a flaw on peoples’ phones that lets you spy on all their texts, calls, emails, etc. Because of all these crazy things that you can do with never-seen-before software vulnerabilities, protecting against them is really important.

Finding 0-day vulnerabilities was really hard, especially if it affected software that is used in a ton of devices, like the Linux kernel or iOS. Security nerds around the world dreamed of the day they would find one of these, not only because security agencies are constantly searching for top hackers, but because you’d immediately achieve tremendous aura that will have people online arguing about how you are not “some” security researcher.

So when Claude found a decently important vulnerability in the Linux kernel (an impressive feat for mere mortals that do not dream of electric sheep), doomsday predictions began. The standard conclusion is that we are entering a period where anybody will be able to find critical vulnerabilities and that we should all be tremendously worried.

I think this is mostly wrong because of two core reasons. First, attackers and defenders’ capabilities are more symmetric than painted in the current narrative. Second, for most people, the thing that prevents you from exploiting computer systems is that you could be sent to jail for a long time.

To explore these arguments, it’s useful to think of the three broad groups of attackers we might face. On one hand, you have what we like to call a “state actor” (e.g. CIA, NSA, Mossad, MI6, you get the point). You can safely assume that defending against these groups is mostly futile unless you are another state actor. If the CIA wants to get into your laptop, they can leverage a wide variety of tricks, one of which may include a zero-day exploit. And by the way, if they needed one before Claude, they could’ve just bought one, for a few million dollars––pennies on their balance sheet. Even simpler, they can also just come and take you and your laptop away.

Then, there are sophisticated for-profit criminal groups (hackers with black hoodies a la Mr. Robot). They are technically proficient but will most likely not implant secret chips at the factories where phones are made. Lastly, you have normoids (a.k.a. unsophisticated actors, such as your average Twitter tech influencer). They are proficient in vibe coding and logging into their router. Congratulations you have just done something called “threat modeling.”

Ok, back to the counterargument: if language models are good at finding vulnerabilities, they are good at the same reasoning that underlies patching them. Offense and defense are not drawing from different capability pools. They are running the same models against the same code. The question is not whether AI helps attackers––it obviously does––but whether it helps them more than it helps defenders. There is no reason to think the answer is yes. If anybody can now use Claude to find vulnerabilities to exploit, then anybody can now use Claude to find vulnerabilities to patch. Saying AI only helps attackers is like saying faster cars only help bank robbers.

The first objection against the claim above is that patching (i.e., fixing vulnerabilities) is harder than finding them. A common motto is “defenders need to be lucky every time, attackers need to be lucky only once.” On top of that, attack verification is cheaper than patch verification. When you are patching software vulnerabilities, you need to make sure you don’t accidentally mess something else up. When creating an exploit, you just need to find one thing that works. But is it that simple?

The cost of verification is also high for a successful attack campaign. Exploitation is but one step in a multi-step operation. You broke into a server, now what? If your goal is to make money, you need to find something valuable, extract it, cash out, etc. And you need to do all of this without fucking up. Because if you fail to cover your tracks and you do not fall under the category of state-sponsored actor, it’s federal prison for you.

This last point deserves more attention than it typically gets. The security conversation almost always focuses on technical capability as the binding constraint on bad behavior. But think about what actually kept script kiddies in check for the last twenty years. It wasn’t that Kali Linux was too hard to use, or that Metasploit required a PhD––two tools you can download and play with right now. It was that the FBI has a long memory, long arms, and federal prosecutors have a fondness for making examples. The casual and the not-so-casual criminal attackers newly empowered by AI still fear the law; 3D-printed guns didn’t make everybody a killer. Non-state attackers also still have to figure out how to not be idiots about attribution, lest they get extradited to the US to pay their dues.

The natural objection is to move the goal posts. “Claude is good at exploitation now but in the future it will handle the whole kill chain: reconnaissance, exploitation, exfiltration, hell, even cashing out!” Maybe. But if that day comes, the same model will also be able to patch bugs without wrecking the rest of the codebase––a lower bar to clear than the aforementioned. The capability argument cuts both ways or it cuts neither.

But all of this assumes we are transitioning from a world that was reasonably secure into one that is exploitable. The truth is the state of software security was already bad for everyone, not just for people facing nation states. Before AI, software was already outdated, unpatched, and vulnerable. People were falling for phishing links, writing passwords on sticky notes, plugging in random USB drives. Even “naïve” teenagers had access to enough tools to target high-ranking US government officials. You didn’t need a zero-day to make a mess. Arguably, there were already more vulnerabilities than anyone knew what to do with.

None of this is to discount the work that Anthropic's Red Team is doing. An autonomous agent finding and exploiting 0-days is something that, when I was an undergrad researcher, seemed so distant. It is truly remarkable. But capability claims without a threat model just result in fearmongering, the type of fodder CISOs and security startups love to feed because peddlers of software security are always incentivized to paint a bleak future; a future only they and their products can fix.

AI can now automatically create zero-days? So what, most people’s password is still their dog’s name.

Adjacent Reading

• The Untold History of America’s Zero-Day Market

• AI Finds Vulns You Can’t With Nicholas Carlini - Security Cryptography Whatever

• Bruce Schneier - New leaks prove it: the NSA is putting us all at risk to be hacked

• Andy Greenberg - The Shadow Brokers Mess Is What Happens When the NSA Hoards Zero-Days

• The Unfalsifiability of Security Claims

Telegram is an application that began as a messaging app built on an encryption promise. Today, Telegram exists in the Internet the way certain neighborhoods exist in real cities––not because anyone planned them, not because a developer filed permits and laid infrastructure, but because the land was cheap and the landlord didn’t ask questions.

Most people know Telegram houses seedy things. Fewer appreciate that it houses them at a scale and complexity that makes the word “seedy” feel quaint. What Pavel Durov built, intentionally or not, is less a messaging app than a sovereign territory with its own currency and its own infrastructure.

The platform claims over a billion users, which is a number that sounds impressive especially when you realize that a sizeable portion of them are not using it to chat with friends and family but rather to sell things that are illegal, gamble, and engage with fringe ideologies. This is not a design flaw; it is a natural progression for an application whose founder describes it as a platform for freedom of speech. This is technically accurate in the same way that the Silk Road was a free market economics experiment and a gun shop can describe itself as a platform for conflict resolution.

Telegram’s architecture is communication-centric: you can send messages that vanish and create channels that broadcast to millions with no friction. But the whole apparatus truly becomes alive thanks to the bots; they are what make it a city rather than a bulletin board. Bots are the city’s infrastructure. Some are bouncers, verifying membership before granting channel access. Some are streamers, broadcasting content continuously to passive audiences. Some are couriers, automating delivery logistics. Some are lawyers, enforcing the rules of private groups without human oversight. And yes, some are cashiers, performing every conceivable commercial function from pizza delivery to fentanyl procurement. Our pre-print on bots (to appear at ICWSM later this year) is out.

Bots, through their Turing completeness, dissolve technical constraints and extend Telegram’s functionality to whatever humans decide to want. The bots are the vending machines. The only question left is the currency.

Money is where app stores and governments can take their cut––the entities that need to look away for this experiment to continue. Telegram has engineered its own economic plumbing accordingly. Inside the app there are Stars, an in-app currency for digital transactions. Alongside it, there is a blockchain, wallets, and a suite of cryptocurrency integrations. For the privacy-conscious, there is an in-app browser pointed at decentralized websites in its very own TON network, and failing that, in-app JavaScript rendering that never requires you to surface into the visible Internet at all.

Arriving at the Walled City of Telegram is easy. Many newcomers have visited its various storefronts by deciphering QR codes posted on street lamps, or by searching for synthetic joy at a music festival.

If you don’t have a plug, finding your way around is tough. There are no sanctioned yellow pages. Google has not mapped this place out. Outside observers, don’t know how deep the tunnels are, nor how many rooms, nor how many people; only what Telegram tells us. There are third and fourth parties that have attempted walking every corridor and knocking on every door. Of course, a lot of residents want to stand out and attract your business so they put up posters and leave flyers through their very own advertising ecosystem and mini app store. But many rooms are closed to the public and many groups prefer their nooks and crannies to stay tucked away. If you know a guy that knows a guy, you might get an intro.

Telegram is self-sufficient and wants for nothing. It has its own currency. Its own blockchain. Its own advertising ecosystem. Its own browser. Its own app store. It is both externally and internally opaque. Those who wish to be found can, and those who wish to stay tucked away will. With all this infrastructure, what did you imagine people would build?

What Telegram has accidentally built, in the process of annoying the FSB and the FBI and the BKA and approximately forty other law enforcement acronyms simultaneously, is the infrastructure that Tor always promised but never delivered: a functional underground economy at consumer scale. Tor was too complicated; too easy to fuck up. It offered mathematical guarantees to people who couldn’t reliably operate a VPN. Telegram offered something more valuable than formally verified security––it offered convenience. The onboarding is an app store download. The payments are automated. You give up Tor’s cryptographic promises for Telegram’s pinky promise that they will not rat you out, and it turns out that for most people, most of the time, that trade is worth making. This is what scaling an illicit economy actually looks like: not dark, not hidden, not technically sophisticated. Just friction, methodically removed.

Adjacent Reading

• BBC. Telegram: ‘The dark web in your pocket’

• Rice Media. The Risks and Rewards of Telegram Sex Work

• Marjanov et al. Stayin’ Alive: How Global Stolen Data Markets Thrive on Telegram (Embargoed Until July 2026).

• Roy et al. DarkGram: A Large-Scale Analysis of Cybercriminal Activity Channels on Telegram

• Marechal, From Russia With Crypto: A Political History of Telegram

• Chou et al. Bots can Snoop: Uncovering and Mitigating Privacy Risks of Bots in Group Chats

AI influencers are here. This was entirely expected. Even before generative AI was a thing, we (meaning us, humans) had been toying with the idea of virtual/artificial personas, in social media and beyond, just look at Gorillaz or Hatsune Miku. But of course, much of the Internet is for prurient uses. So, it seemed like only a matter of time until we saw AI influencers used for explicit content on platforms like OnlyFans or Fanvue. Recent reporting paints these AI sex workers as a new phenomenon. But in reality “fake” accounts selling “fake” adult content were already here.

One of the most notable recent cases of a fake OnlyFans model going viral is AyannaSoBlack (now banned from Instagram). A picture of her and former-WWE-star-turned-actor John Cena at Planet Fitness accumulated hundreds of thousands of digital ogles across social media. Similar to other adult content creators, her profile invited you to know her more intimately for a low price. People were so enthralled by her allure that requests for her adult media quickly surfaced in adult piracy forums. What turned this into a fiasco was the collective realization (and disappointment) that she had been artificially generated by matrix multiplication. The account purposefully intended to deceive users. For example, the model in question would answer in Q&A style that her fascinating dark pigment was due to South Sudanese genetics. As per modern internet etiquette and morality (as well as OnlyFans guidelines): undisclosed AI use is a no-no.

Now, the first thing I want to dispel about this whole thing is that this phenomenon is somehow new. A man pretending to be a woman online for profit the oldest trick in the book.

When I was barely a teenager, I discovered MMORPGs. WoW and Ragnarok were my go-tos. While these games were instrumental in my acquisition of the English language, they also demanded copious amounts of hours doing repetitive tasks to make in-game money and to obtain cool shiny items. However, if toiling around those universes collecting minerals and such was not your calling, you could do what my friend N did: he would create a female character, befriend presumably male players, and try to convert them into patrons. And just like that, N—a then-13-year old from the middle of nowhere South America with a limited yet expanding English vocabulary—adeptly demonstrated why the FTC’s statistics on romance scams make complete sense (and, unfortunately, the stats about online grooming).

If N had not gone to college he would’ve certainly taken part in the many communities who realized that they could pretend to be women online for monetary gain. As I hinted at in the previous paragraph, romance scams are one flavor of this approach. You receive a message from an unknown number who wants to befriend you. They lead you to a Whatsapp or Telegram chat with an attractive person as a profile picture. They then try to convince you to part ways with your money with a variety of techniques, ranging from persuasion to (s)extortion. Scammers are allegedly pulling more than a billion dollars with playbooks like this.

Whereas in a traditional romance scam you build and leverage an emotional bond to extract value out of a victim, a parallel tactic involves convincing the victim to buy your spicy pictures. In 2019, Hutchings and Pastrana published a paper on what is known online as “eWhoring”: tricking people into buying adult content that you did not create. The first thing an aspiring eWhoring entrepreneur needs is the right type of content, or a “pack.” Procurement is the act of finding “packs” of pictures about the person you want to impersonate. Ideally, you want someone with a wide range of pictures (often taken from social media) who is not very known (little followers) and for whom you also have access to nude or sexual media (often obtained nonconsensually). This combination of attributes was challenging to achieve, so people in online forums also specialized in collecting and selling these packs. With a suitable pack you could begin generating leads and closing sales.

For the past 16 years, the playbook has remained relatively consistent. An account follows you on a social media platform (e.g., Instagram), and proceeds to persuade you to buy “premium” content. These sales were more ad-hoc, through something like Venmo, or in more sophisticated cases a landing page with a credit card terminal, similar to those that tried to sell you eBooks.

The advent of OnlyFans (OF) introduced a new paradigm for adult content creation, both for legitimate content creators and otherwise. OF made procurement substantially easier because it centralized a vast repository of explicit images. To create a pack, all you needed to do was to find an OF model, their social media account, and you could begin a copycat of them without them ever finding out. OF’s infrastructure made monetization easier. And lastly, their opaque external visibility made it harder for people to identify copycats: a model from Mexico would have a hard time knowing that a teen from the other side of the world was running an account with their stolen pictures.

AI has now similarly re-upended the procurement paradigm. Any person can now be a victim because AI models allow the creation of non-consensual images, explicit or otherwise. I can run an Instagram account using someone else’s legitimate pictures and sell photorealistic explicit media of them on OnlyFans. Or, I can even take it up a notch and run a completely synthetic Instagram and OF account leveraging a pre-trained AI model on their likeness. I can use this AI model to post pictures of them at school, at the beach, posing with John Cena, or performing whatever sexual acts my followers are willing to pay money for. On top of that, you can hire gig workers to help you out. To borrow a word that technoidealists love to use, AI has now democratized victimization.

When AyannaSoBlack was exposed, people were not outraged that they had paid for adult content. They were outraged that the intimacy had been fabricated, as if the intimacy was ever real. On top of that, keyboard doomers treated this phenomenon as some new dark AI-enabled innovation. But a man pretending to be a woman online for profit is, as I noted, a discovery that even a 13-year old boy makes and exploits. Performances are powerful: the best adult content creators know this. They create micro-universes in which their subscribers can dream—for 5, 10, or more dollars a pop. We are just now entering a universe in which this parasocial fantasy, this performed desire, can be executed on an office floor somewhere in Eastern Europe… wait, we were literally already there.

Adjacent Reading

• Inside the Booming AI Pimping Industry

• How AI-generated Influencers Exploit Celebrities to Sell Synthetic Nudes

• Pastrana et al. “Measuring eWhoring”

• OnlyFans Models Are Using AI Impersonators to Keep Up With Their DMs

Notes:

• I use “OnlyFans” as a blanket term for similar platforms, including Fanvue.

Source: https://www.vice.com/da/article/humans-of-the-cd-street-stall-who-still-buys-pirated-discs/

Last week we discussed why there’s a surge of gig workers that will create AI porn for you. To explain this phenomenon, I talked about money and markets. It comes as no surprise that sex and money go hand in hand. And because of this a lot of the interventions that scientists and lawmakers discuss are centered around money. Last year, a group of state Attorney Generals sent a letter to payment processors telling them to do more. Adding financial friction is powerful: you make it unprofitable and annoying to pay for something and people walk away. This is part of the reason why we are not sending each other crypto when splitting dinners.

However, the underlying assumption is that most people are primarily money-motivated (a.k.a. “finacially-motivated rational actors”). Weirdly, some people are not. Some seem to be guided by morals, values, ideologies and such. Our financial enforcement measures would work if it were not for these pesky ideas.

A Short Intro to Piracy

Somehow we landed in a reality where people pay for the right to stream music and movies. In the 2000s this seemed unconceivable, laughable even. Limewire, Ares, Bearshare, ThePirateBay, (I can keep going), provided uninhibited access to any and all digital needs. They still do. But, the hassle of figuring out how to pirate properly, the fear that you might download malware, and the worry that your Internet service provider will send you a threatening letter have pushed people to more convenient options. Piracy, though, is still alive and well, powered by a community of committed enthusiasts.

Sources: https://www.reddit.com/r/Piracy/comments/1k8jtd6/lmao/ [1]

Piracy gets a bad rep. Probably because of the edgy ad campaigns equating piracy to stealing cars and unsuspecting women. Yes, piracy can suck. It can really harm creators––especially smaller ones––of movies, music, books, etc. But piracy also has served a variety of noble goals. For example, if you grew up where I did, you just couldn’t buy certain stuff, even if you wanted to. You wanted to buy a Windows XP license? Good luck. On top of that, prices were tremendously prohibitive for us wretched and proud inhabitants of the developing world. An Adobe CS6 license would cost ~$2,600 according to this Reddit user. That was just about the minimum wage in Paraguay in 2010... for one year of work. Maybe you hold the opinion that kids from the barrios should not access digital goods they cannot afford. But those kids also wanted to play Warcraft 3, watch Full Metal Alchemist, and make beats with Pro Tools. Thank you pirates for your service.

Source: https://www.vice.com/da/article/humans-of-the-cd-street-stall-who-still-buys-pirated-discs/

A lot of pirating groups have a strong code of conduct and ethos. These groups, which roughly trace back to early hacker/technolibertarian cultures are of course not a monolith. Id est, there is no unified cultural umbrella or dogma that governs all self-declared members of the aforementioned ideologies. However, there are a few generally accepted concepts: free access to information, anti-corporate sentiment (stick it to the man but not to indie creators), archival (preservation of content), sharing as reciprocity, and technical prestige (”I pirate faster, better, quicker”). These values also exist in many other communities like open source software and open access.

Source: iykyk.

There is another highly pirated media category: porn.

Porn Piracy

As you would expect, porn is pirated because of paywalls and because studios thought that $25 dollars for movie access at a hotel made sense. When tube sites like PornHub and YouPorn launched in 2006-2007, porn studios saw their revenue collapse. These sites allowed anybody to upload content, so users began uploading pirated scenes en masse. Big Porn tried to fight tooth and nail with lawsuits and takedowns. But, like other media producers, pornographers ultimately adapted and found ways to make people open their wallets. OnlyFans as a whole grosses billions of dollars per year; top earners in the platform make millions. Of course, the same battle that porn studios fought against pirating communities are now being fought by individual content creators. Today, there are several online communities dedicated to procuring, indexing, and distributing paywalled content belonging to OnlyFans models. Where there’s paywall, there’s a leak.

Porn piracy may seem like it is primarily a financial thing. But porn is an attractive candidate for piracy not just because it is often paywalled, but because ‘til this day, porn also pushes censorship boundaries. In the US, dirty films can still be cataloged as obscene if they do not satisfy the Miller test. In Japan, porn is obscene if it displays genitalia (hence why it is blurred). In several countries, porn is outright banned. But boy, people do not like it when music/films/books are banned or censored. Take books as an example. One of the largest shadow libraries traces its roots to Samizdat––an underground movement to resist book censorship in the Eastern Bloc. Today, we still celebrate banned books week. If Sarah Maas books were banned tomorrow, the riots would be violent. When pornographic content is banned, it triggers the same ideological knee jerk reaction: people want to preserve and redistribute the content, they want to fight back, lest their freedoms be trampled.

Source: <redacted>

Porn Preservationists

Last year, HuggingFace and CivitAI suddenly started taking down AI models used to generate deepfake porn (or synthetic non-consensual explicit imagery for long). Other adjacent platforms like SeaArt and TensorArt went farther and even took down all adult-generating content. These actions came as a reaction to a period of heightened scrutiny by lawmakers: the UK began enforcing its Online Safety Act, the US passed the TAKE IT DOWN Act, journalists and scientists began demonstrating the prevalence of deepfake porn in these platforms, and so on. We published a paper on the impact of this regulatory pressure on the ecosystem of deepfake pornography. Now, what we did not capture in that paper was this underground movement that quickly took place after platforms began taking down these models. The key difference, of course, is that the content being preserved here is not Dr. Zhivago, but an AI model that can generate Hermione Granger’s nudes.

Days after the purge, I came across several initiatives oriented at preserving these porn-generating AI models that were getting taken down. It was like a natural catastrophe hit and these netizens were tasked with orchestrating a sort of humanitarian response. Volunteers emerged. Missing model posters were put up. People shared their libraries, others dedicated hard drives for storage, others offered to design databases and build the necessary tooling. And as if the library of Alexandria was in flames again, they mourned the models that had not been saved: lost treasures that future generations would never get to appreciate. They vowed this would never happen again.

Source: <redacted>

Today, one community dedicated to the preservation of deplatformed AI models has over 4.5k members. There’s a version of this story where that number stays small. But the more instructive version is the one where it doesn’t, where the same cultural infrastructure that allowed kids from Ciudad del Este to buy PlayStation games now keeps non-consensual imagery of real women circulating indefinitely, powered by people who genuinely believe they’re on the right side of a censorship fight. That belief is not entirely irrational. Enforcement has consistently struggled against ideologically motivated communities, not because the ideology is correct, but because financial friction is a weak tool against people who aren’t primarily motivated by money. The piracy wars taught us that. Here we go again.

Further Education

• A very pixelated view of Ciudad del Este from back in the day:

• A mall in Ciudad del Este:

• An English-speaking news report about Ciudad del Este.

• An FBI note with the same tone I use in these blogs: https://archives.fbi.gov/archives/news/stories/2004/may/piracy_051704

• Book: “Media Piracy in Emerging Economies”

  • “Relative to local economies a copy of Microsoft Office is 5-10 times higher than in the US or Europe”

  • I found this piece after I finished writing this blog post.

• Paper: “Studying the Online Deepfake Community”

Footnotes

[1] Apparently, the anti piracy ad shown above was not the one pirated, but the universe in which it was is funnier https://torrentfreak.com/sorry-the-you-wouldnt-steal-a-car-anti-piracy-ad-wasnt-pirated-170625/

Source: https://www.nytimes.com/2012/03/18/nyregion/from-roosevelts-new-york-lessons-in-the-futility-of-policing-vice-in-the-city.html

I’ve been looking at how people do bad things on the internet for a while. This has taken me to various communities, forums, server, chats, and other digital hangout spots where I can observe and read peoples’ behavior. This boots-on-the-ground approach helps me get a pulse of why people do what they do, how, and get a sense of what comes next. These are all useful things for policies or so called “scientific interventions.” Essentially, we want to figure out how to stop people from doing bad things, like generating and sharing synthetic nonconsensual images (”deepfake pornography” for the masses). The goal of this blog post is to try to understand our Fiverr findings by thinking about them in the same terms as other vices on the Internet.

We recently published a paper that showed how there are listings on Fiverr (paper; blog post), which is a popular gig work platform, that allows people to hire contractors to create pornographic deepfakes. That is, you can hire a freelancer to help you make AI-generated nudes of someone else on Fiverr, same as you would hire someone to help you make a logo or run online ads. When Mohamed (PhD student who led the Fiverr work) approached me and told me about these services, it felt important to document it, not just because it’s a thing that is happening, but because it tells a broader story of existing enforcement efforts.

Source: Fiverr paper linked above.

The story of drugs online provides a useful way of thinking about enforcement. During my PhD I looked at how and where people sold illicit substances online. “Darkweb marketplaces” (i.e., eBay-like websites that you access through Tor) were already mature enterprises in the 2020s, accounting for billions of dollars in revenue. They had come a long way from the moment that someone had the straightforward idea of selling drugs over this then-new thing called “the Internet.” If we trace the evolution of drug sales online, we can probably get a blueprint of what will play out with deepfake pornography.

First came the people who advertised directly on websites: “canna seeds for sale, we take western union.” Then, came the forums (e.g., “The Hive”). Afterwards, we got the first semblance of markets (e.g., “Adamflowers” then “The Farmer’s Market”). As you may imagine, the DEA, FBI, and adjacent acronyms cracked down on these sites aggressively. Eventually, came the “Silk Road” and the darkweb era facilitated by the emergence of cryptocurrencies. The way in which technological developments (like Tor and cryptocurrencies) ushered new opportunities to sell narcotics and other illegal goods is fascinating. We will tell, however, that story another day. Today, we will talk about the market pressures that pushed these websites to evolve.

In his thesis, “Outsourcing Cybercrime”, Rolf van Wegberg [1] draws from transaction cost economics to describe how cybercriminal markets increasingly become more sophisticated. One way they do so is by becoming more structured. This is most clear when you look at forums that then become marketplaces. For example, before Facebook Marketplace was a thing people used Facebook Groups like “Buy/Sell/Trade New York” to sell things, and before that, people directly posted on their profile that they were selling something. The transition from sales posts in personal profiles, to groups dedicated to buying and selling, and then a dedicated platform of sales illustrates how markets seek structure and sophistication. The same pattern plays out for drug sales: standalone websites advertising drugs, then forums, then marketplaces.

Source: https://www.aljazeera.com/news/2013/11/6/silk-road-illicit-online-market-reopens

Markets are good for vendors and buyers. A market-type-of-website makes it easier to search for products, it introduces reputation systems (e.g., reviews and ratings), standardizes payments, and introduces a mediator who can resolve disputes when things go wrong. There is also an incentive for people to create the market itself. If you are the owner of the market, you take a cut of all the deals. In the Silk Road trial, the FBI said it had seized 144,000 BTC (yes, a hundred and forty four thousand Bitcoins) from Ross Ulbricht. In 2022, the Hydra market was allegedly pulling 1 billion sovereign American dollars. Owning the platform is definitely where the money is at, so when a market disappears, another quickly steps in. The demand for drugs definitely does not go away. And you, as the market owner: all you need to do is avoid the cops and the suits [2].

Source: https://www.nbcnews.com/id/wbna6809149

But before starting a market there are alternatives to explore. Starting a market is tedious. Before LLMs, you needed at least some semblance of coding experience to get it up and running. You then needed to overcome a cold start problem and attract vendors and buyers. So instead, people tested existing markets like eBay. Vendors would advertise the sale of drug “catalogs” or “magazines” while making air quotes––”it would be a shame if someone happened to accidentally drop a vial with four carbon rings, some oxygens, and a few hydrogens originally meant for veterinary use but which gives you superior athletic performance, right?” With less frills, people also just directly sold cannabis on Facebook Marketplace.

If this post is clear, by now you should see the parallels with Fiverr.

As of last year, there were three main places where you could go to get your fix of synthetic nudity. Dedicated websites where you could upload images and perversely manipulate them yourself (e.g., nudifiers). Forums where people share their creations, commission new fakes, and share tips and tutorials (e.g. MrDeepfakes). And these part-forum, part-cloud-infrastructure, part-market platforms where you could train and share AI models, share your images/videos, and earn platform currency that enables you to generate more images/videos (e.g., CivitAI). This last one is not yet a market like eBay but has a lot of market-like characteristics. For example, you earn platform currency based on how much people interact with your model, which in turn makes model providers (think of them as vendors) to try to put out better models (think products) to attract more users (customers), like a market [3]. Given all of this, it is not surprising that people are testing the waters in established markets, like Fiverr. Economics and market dynamics demand more sophistication and structure.

The market for deepfake pornography is still finding its footing. Many peddlers of artificially generated genitalia rely on ad-hoc mechanisms to monetize their creations: they have tip jars on their profile, they create private communities and charge for access, or they rely on affiliate programs to nudification websites and such. Increasingly, though, people are trying their luck in established markets. Fiverr, OnlyFans, Fanvue, and others, have structure and sophistication. They make payments easy. They have brand reputation. They have active user bases. And they are not turning these vendors away. How long do you think anabolic steroid vendors stayed active on eBay before they were shut down?

There are many similarities in the trajectories of online drug sales and synthetically generated body transgressions. The websites, the forums, the economic pressures. These factors help us understand why these services are popping up on gig platforms and mainstream markets. But ultimately there is one crucial difference: making and commissioning deepfakes is pretty cheap. Websites with very powerful models give daily free credits for generation. For users with GPUs, they can generate so much of this stuff and they take commissions for free and with gusto. There is no incentive yet to create a marketplace for this stuff since so much of the volume is gratis!

Source: <redacted>

The low cost of production also means enforcement faces a different challenge here than it did with drugs. You cannot cut off the money if there is no money to cut off. Procuring sexually explicit videos of your colleagues, classmates, or favorite celebrity is cheap, easy to make, and easier to find. In fact, the listings we identified (and which we reported) in our Fiverr study still seem to be there. Chasing down deepfake pornographers seems like hopeless work––for every head you cut off, a new one sprouts. And then, even if you get rid of these websites on the clear web, they can migrate to encrypted chat groups or the ~dark~ web. But hear me out. One, we are a long way from that, and if these services migrate to shadier corners we will at least have a sense that enforcement is actually doing something. Two, we pursue CSAM distributors relentlessly, even despite all the constraints above. And three, come on, detecting these listings on a website like Fiverr is trivial in 2026.

If we ever see these services migrate to the shadier parts of the Internet, and if a market ever pops up exclusively dedicated to the commercialization of deepfake pornography, as bleak as it sounds, we will know we are on the right track.

Related Reading

• Plug and Prey? Measuring the Commoditization of Cybercrime via Online Anonymous Markets

• Deepfakes on Demand: The rise of accessible non-consensual deepfake image generators

• Exploring the Use of Abusive Generative AI Models on Civitai

• Analyzing the AI Nudification Application Ecosystem

Footnotes

[1] Rolf was on my thesis committee and has been a phenomenal mentor. Thanks Rolf!

[2] Fun fact, the IRS is even more interested than the FBI in whether you own the marke: https://home.treasury.gov/news/press-releases/jy0701

[3] It is important to note that CivitAI cleaned house after substantial pressure from payment processors; they introduced cryptocurrencies and a gift-card-type of payment. There was a genuine reluctance to see Visa and Mastercard go away which means that the alternatives are just not as good.