Robert Hart | The Verge

AI ‘content creators’ are getting harder to spot

2026-06-04T14:31:15-04:00

Aitana Lopez, AI avatar by creative agency The Clueless. | Image: The Clueless

This is The Stepback, a weekly newsletter breaking down one essential story from the tech world. For more on AI confusion, follow Robert Hart. The Stepback arrives in our subscribers’ inboxes at 8AM ET. Opt in for The Stepback here.

How it started

At first, AI influencers were relatively easy to identify — and to ignore. Aside from the occasional bursts of hype, they didn’t seem to change much about the way social media worked. The earliest virtual influencers — Lil Miquela with her blunt fringe and freckles, Imma with her bubblegum pink bob, and Shudu Gram with her flawless complexion — were obviously digital productions. Collaborations were announced with fanfare. Posts required studios, money, coordination, and a lot of polish.

Over time, I’ve noticed that the fake people on my timeline have started looking more and more like everyone else on it. Characters like Emily Pellegrini and Aitana Lopez moved a bit closer to reality — or at least to the reality of that well-traveled, well-off friend from college you didn’t keep in touch with, forever posting from nice restaurants and beautiful places, or from Coachella and Wimbledon. Not exactly relatable, but, then again, most professional influencers aren’t either.

Even then, many of these accounts aren’t standard ones by any means. Lopez is the product of a Spanish creative agency called The Clueless, which manages a stable of AI influencers. Pellegrini’s creator, who goes by the pseudonym Professor EP, told me he used to manage OnlyFans creators. Now he sells courses teaching people how to make AI influencers of their own.

Which is exactly what people are starting to do. A lot of people.

How it’s going

The novelty has worn off. Early AI influencers stood out because there were so few of them. Now they are part of a much larger mess of AI-generated content inundating social media: low-quality drivel lazily copied from chatbots, slop images and videos, and that catchy Lord of the Rings disco song that took over my TikTok for a month.

The fake people are now everywhere. They’re upselling drop-ship junk, scamming men out of money with fake photos, pushing disinformation and racist talking points, and catering to an increasingly weird, often sexual niche. Of course, there are a lot of thirst traps. There’s also a lot of mundane content, with avatars simply copying whatever’s popular among human creators, often just putting their fake faces on it.

That makes the scale of AI content creator influence hard to gauge. Platforms do not publish figures on how many of their users are fake people, and most AI avatars don’t become popular or influential enough to justify the kind of media attention the earlier wave received. Databases like Virtual Humans track hundreds of popular avatars, but those are only the accounts strange, weird, or big enough to get noticed. Below them is an ocean of accounts flying totally under the radar.

Part of the reason these accounts are able to avoid detection is that the technology used to make them has improved massively. A still image of a fake person can now be good enough to pass as genuine at a glance, especially in a feed filled with real influencers making generous use of staging, filters, and editing effects. Video and audio are quickly catching up, giving virtual people voices and movements that could fool undiscerning scrollers. The tools are no longer niche or prohibitively expensive, either. Mainstream products from companies like Google and OpenAI sit alongside specialized services from firms like Higgsfield, HeyGen, and ElevenLabs. With a little effort, almost anyone can make an AI influencer — or stable of them — without needing a studio, specialized equipment, or (much) money.

All this leaves social media platforms with a problem they do not seem especially interested in solving head-on. After several years of grappling with AI-generated images, videos, and audio, most major platforms now have some kind of policy covering synthetic media. But beyond requiring labels for AI-generated content, such rules often amount to little more than shoehorning the material into existing categories covering things like scams, spam, impersonation, and graphic material. AI people, especially those designed to behave like real people, don’t fit neatly into any of these buckets. They are not necessarily running a scam, posting graphic content, or impersonating someone — who would they even impersonate? And if they disclose that their posts are AI-generated, it’s not obvious what rules they’d be breaking.

For now, platforms seem content to live in ambiguity, neither fully welcoming nor shunning AI creators. They have cultivated a contradictory position, promoting AI as a creative tool while also trying to stop a tidal wave of slop from overwhelming their services. YouTube, TikTok, Instagram, and other platforms have developed rules for labeling synthetic media, particularly the realistic kind, while also promoting their own suites of AI tools, including some that can clone or simulate users. But those rules tend to focus on individual posts rather than the accounts and personas behind them, leaving AI influencers in a gray area.

In that uncertainty, the AI influencer ecosystem is thriving. Some market research firms estimate the virtual influencer market could be worth more than $60 billion by 2030, up from around $12 billion this year. Cultural clout is growing too. There are AI influencer awards, beauty pageants, dedicated talent agencies representing synthetic creators, and a booming market of synthetic creators selling courses and tools promising to help people make and run fake creators of their own, often with the promise of faceless passive income. Some of it has the faintly pyramidal smell of an online gold rush, a few visible success stories and an awful lot of people selling shovels.

What happens next

My guess is that a reckoning is on the way. AI slop is already irritating, and there’s only so much of it a platform can carry until it is rendered practically unusable, especially given their persistent refusal to let users filter AI slop. Fake people pretending to be real are an even more intimate version of the same problem. But beyond labels and enforcement of existing rules, platforms mostly seem content to see what happens. To platforms, engagement is still engagement, whether it comes from a fake creator or a real one. So long as synthetic creators keep posting and don’t stray outside of existing rules, there seems to be little incentive to crack down.

There’s also a question of how sustainable the whole idea of having AI avatars running around online is. If so many are built just to make money from human users, what happens when the pool of human users dries up? There’s only so many people who will be willing to buy courses and tools to build influencers of their own, for example. That’s presuming social media can survive the influx of AI influencers. By definition, it requires some critical mass of humanity to keep things social. If left unchecked, networks will collapse under the weight of these fake people, as human users are inevitably driven away.

That could change if public anger keeps building. Backlash over deepfakes, impersonation, and synthetic spam is already forcing lawmakers and regulators to pay closer attention, particularly after incidents involving nonconsensual sexual deepfakes generated with tools like Grok. Europe’s AI Act could be a driver, at least as its transparency obligations for AI-generated content come into force. The regulations will require deployers of generative AI systems to clearly disclose AI-generated or manipulated content, which could pressure companies to step up flagging AI content or face potentially hefty fines. But even then, the focus is still largely on content, not whether the account posting it represents an actual person.

As with so much on social media, the burden falls back on users. Many platforms have effectively delegated the task of moderating AI content to users, relying on them to spot and report suspicious profiles. But self-moderation is a poor and unsustainable answer to something designed to evade notice. There is already a growing appetite for AI-free spaces. If platforms refuse to draw boundaries between real and unreal themselves, I expect users will draw them instead.

By the way

A lot of the more high-profile AI influencers I’ve encountered recently have had an overtly political bent, which I feel could hasten the regulatory reckoning. Danny Bones, a fake white nationalist rapper funded by a far-right political party in the UK, is perhaps the best example of this I’ve seen so far.
Like human influencers, many AI avatars are built around specific identities and communities, such as race, disability, politics, and nationality, like MAGA fantasy girl Jessica Foster, who leans heavily into sexualized Army aesthetics and Trumpism. Not all avatars align with their creators: Black AI model Shudu Gram, for example, was made by a white man. Emily Pellegrini is also the product of a man, Professor EP, who told me the character is built using content he licensed from an anonymous OnlyFans creator.

Read this

The headline of Jess Weatherbed’s recent story for The Verge says it all: “Let us filter AI slop, you cowards.”
The Verge recently reported that grifters are using AI avatars of fake Black people to hawk mass-produced products via drop shipping at inflated prices on social media.
Wired reported on the booming “AI Pimping” industry, where human creators are having their content stolen and monetized by AI avatars without their permission.
Charlie Warzel’s podcast examined the incentives behind the proliferation of AI influencers and the exhaustion many feel when it comes to caring whether what we consume is real or not anymore.

Meta made its own AI-generated clickbait news feed

2026-06-05T16:17:26-04:00

An AI-generated image of the royal family featuring two Queen Elizabeth IIs. | Image: Meta AI

Facebook has long been filled with feeds of clickbait articles. Now, Meta is making its own clickbait articles with AI.

The standalone Meta AI app now has a “For You” section that populates a list of clickbait-style stories for you to read. But the topics, images, and text are all AI-generated — and as questionable as you’d expect from AI-created works.

The Meta AI app first launched in April 2025 with its focus on a public “Discover” feed that showed AI-generated images and conversations from other users (who frequently seemed unaware that they were being made public). That’s all disappeared. The app now has a standard chatbot interface, plus a For You page that’s been present for at least a few months, displaying a stream of suggested article prompts that, when tapped, generate entire “stories.”

When targeting me, a reporter based in London, the prompts were aggressively British, involving topics like tea, manners, pubs, royals, football — sorry, soccer — and, naturally, the art of queuing. Suggested stories included “A royal butler finally settled the milk first debate” (the tea goes first, apparently), “The psychology of joining a queue without knowing why,” “The anatomy of the devastating British tut,” and “Inside the extreme sport of visiting every UK pub.” Some made even less sense, like “When a bit of a pickle means total disaster.”

My colleague, meanwhile, appears to have been placed firmly within the luxury watch aficionado bracket by the algorithm. His feed suggested stories called “My fake Rolex experiment” and “The brutal math behind the Rolex waitlist illusion.”

The AI-generated text read like puffy filler, offering little substance beyond repeatedly restating the premise of the prompt. Sourcing was also nonexistent.

I tried to track down where these “stories” may have originated. The royal butler tea story appears to trace back to a 2018 BBC Three comedy series called Miss Holland, which follows a fictional beauty queen from a small Dutch town as she travels to Britain and learns “how to be posh and classy” from real former royal butler Grant Harrold. The “Rolex experiment” story, meanwhile, appeared to be a complete fabrication, generated in our chat box as a first-person narrative without a byline, after a bit of usual whirring that happens when a chatbot is generating. Other stories leaned on vague references to unnamed experts or fictional research.

When I tapped the same cards more than once, the generated stories stayed within the rough bounds of the prompt and all were clearly versions of the same thing, but slightly different. Typing the same headline into a separate chat produced a completely different response. The clearest giveaway came from my chat history. It showed the hidden, suggested prompts that were supposed to trigger the generation of articles. One began:

“You are a helpful conversational assistant. The user is responding to a proactive feed card that was shown to them. The card context below provides background on what prompted the user’s message,” followed by what appeared to be references to internal instructions, information, and metadata.

A sampling of “articles” generated by the Meta AI app.

" data-portal-copyright="" /> Worrisome.

" data-portal-copyright="" />

The articles had images attached. A lot of these were harmless — bland mush of cartoony people, landscapes, and food. But some depicted real people, including public figures, and were riddled with errors. “Who really pays for the royal family in 2026?” featured two Queen Elizabeth IIs, despite her death several years prior and her existence as only one person.

Around the Queen clones were people who seemed to be approximations of other royals: a vaguely Princess Kate-ish face to the left, a strange attempt at Prince William at the back, and a sort-of King Charles in the middle who bore an exaggerated resemblance to his late father. Other images had usual AI tells like impossible hands and bodies leaning at unnatural angles. One image actually turned out to be a GIF of an older couple dancing and making arm movements no human body could make.

It wasn’t clear whether the app should be able to generate AI images of real people in accordance with Meta’s own, rather opaque rules, but it was. The company has previously said it wants “people to know when they see posts that have been made with AI” and that it automatically adds labels to some user-generated content when AI is detected. Despite this, there was no obvious indication or label in the feed or articles that any material was AI-generated.

Meta declined to answer many of my questions about the feature’s purpose, whether the company considers the output news or fiction, what safeguards are in place, and whether images of real people and public figures comply with its own AI-content policies.

“The goal is to suggest what’s most relevant to you – such as fitness advice, meal plans, or other insights – before you even have to ask.”

“We’re testing a daily feed that proactively shares tips, content, and recommendations tailored to your interests,” Meta spokesperson Tracy Clayton said in a brief statement. “The goal is to suggest what’s most relevant to you – such as fitness advice, meal plans, or other insights – before you even have to ask.”

Clayton later sent a nearly identical “updated” statement, mysteriously removing the word “proactively.”

A third statement from Clayton followed later in the day: “This was a test for a limited number of users and it will be deprecated. Meta has no plans to move forward with this feature.”

This leaves me with additional questions. How was this test limited if, besides me, at least three of my colleagues at The Verge had access to the same feature serving AI clickbait? What did “proactively” even mean? And, of course, who asked for any of this in the first place?

AI leaders call for tougher protections against AI-aided bioweapons

2026-06-04T08:12:12-04:00

Some of the AI industry’s biggest rivals have put their many, many grievances aside for a common cause: making it harder for people to use their technology to develop biological weapons. In an open letter to US lawmakers, tech leaders are pressing Congress to enact rules closing what they say is an alarming biosecurity gap that could help trigger a global pandemic.

Anthropic’s Dario Amodei, OpenAI’s Sam Altman, and Microsoft’s Mustafa Suleyman are among the signatories urging US lawmakers to require companies selling synthetic DNA and RNA — genetic material that can ordered online and assembled in a lab — to screen purchases for sequences that could be used to make dangerous pathogens. The fear is that AI tools could make it easier to design potentially dangerous sequences, order them from manufacturers, and use them in ways that would previously have required more specialized expertise.

Other signers include Meta’s AI chief Alexandr Wang and Google DeepMind’s Demis Hassabis, who won the 2024 Nobel Prize in Chemistry for his work on AI-based protein prediction. The letter was also signed by prominent scientists, national security and policy experts, and executives from biotech companies including Twist Bioscience and Ansa Biotechnologies, both major sellers of synthetic genetic material. The letter was reportedly organized by two think tanks: the Foundation for American Innovation and the Institute for Progress.

Scientists have long warned that advances in synthetic biology could make it easier for scientists to engineer dangerous organisms or even resurrect long-dead pathogens — work that could cause devastation if misused, mishandled, or released by accident. But that power has largely remained in the hands of skilled scientists with access to sophisticated labs, equipment, and resources. The concern now is that, as biological tools become cheaper and more accessible and AI models become more capable, barriers preventing misuse are beginning to crumble. Experts also warn that AI could help produce other threats like chemical weapons.

While the letter acknowledges many of the largest providers of synthetic DNA and RNA already screen orders, it is done on a voluntary, not mandatory, basis. Detailed records should also be kept on any orders, in order to track any threat that evaded initial screening, the letter says.

“Given the pace at which the underlying technology is changing, we believe the need is urgent,” the letter says. “This is a rare moment of agreement across stakeholders that are often at odds. We hope policymakers will meet it with decisive action.”

Amazon develops a warehouse robot that workers can speak to

2026-06-04T08:09:39-04:00

The design hasn’t changed much from the original Proteus, which was announced in 2022. | Image: Amazon

Amazon has announced a new version of its fully autonomous warehouse robot, Proteus, that will interact using language instead of code. The expanded capabilities come as part of a growing pivot toward automation as the e-commerce giant replaces its human workers with robots.

Amazon says the AI-powered upgrade means its human employees can assign the robot tasks in the same way they’d communicate with colleagues. Previously, workers would need to use specialized software to direct the floor-level, tortoise-like systems, which are designed for heavy lifting and moving large carts throughout Amazon’s warehouses. “You tell it what needs to be done. It figures out the priority, the route, the timing,” says Scott Dresser, vice president of Amazon Robotics.

The next generation of Proteus will also work across a much larger area than the ones currently in use, which Amazon says only operate in dock areas. “The new system can work anywhere items need to be moved,” the company says. This includes transporting containers as they arrive on site, moving them between workstations, and assisting employees across fulfillment centers and delivery sites.

The new system is currently being piloted in Amazon’s labs, but the company says it has plans to deploy it in Europe during the first half of 2027.

Proteus is part of Amazon’s broader robotics roadmap. It says it has plans to expand its touch-sensitive robot, called Vulcan, and a collaborative tote-handling system first piloted in Barcelona, to more sites across Europe in the coming year.

Amazon says it is “creating new jobs alongside these technologies” and claims to have hired hundreds of thousands of employees globally since introducing robotics into its operations. The company insists its robots are designed to support workers and streamline operations, rather than replace hundreds of thousands of workers with robots.

I went looking for the AI weed vape that gives you Bitcoin for smoking

2026-06-01T04:49:08-04:00

The crypto weed vape found me on 4/20, the high holiday of cannabis enthusiasts everywhere. It arrived over Slack with the thumbnail of a man exhaling a plume of vapor, the words “every hit delivers Bitcoin” emblazoned across it. It claimed to be advertising a device called Gudtrip, and I thought everything about it sounded fake.

So I went looking for it. What I eventually found, after weeks of searching, dozens of emails, and a reporting effort that spanned continents, was somehow even dumber than I’d imagined.

My first port of call was Gudtrip’s website, which only made the vape seem more like a prank. The company’s description of the product was tech buzzword bingo — this wasn’t just a vape that delivered Bitcoin, it was “the first agentic cannabis device” combining “premium cannabis, blockchain rewards, and AI-powered asset tools in one product.” This alleged device wasn’t just running on crypto hype: now AI was in the mix, too.

But I did find one sign that the product was real. The website said that its vapes were available in California, with New York also listed as “coming soon.” And there was a name for the brand behind it: Puffpaw, a company that presents itself as the maker of the “world’s first gamified smart vape” for nicotine. Somehow, it’s supposed to incentivize quitting nicotine through a mechanism that, like Gudtrip, I did not understand.

I went to Gudtrip’s social accounts to scour for more. The product appeared to have quietly launched in March. Otherwise, most posts reiterated that by using Gudtrip, you’d get some Bitcoin. Gudtrip’s pinned post on X as of this writing reads, “Smoke weed and earn @Bitcoin.” Another asks: “new yorkers are you ready to smoke a joint and earn bitcoin?” On Threads, Gudtrip posted about “building wealth one puff at a time” and explained that users can “⁡Earn Bitcoin from every single puff.” A pulsating TikTok video described the vape as “the high that pays you back.”

@gudtrip.official
Your daily ritual, but smarter. Track it. Earn from it. Level up with Gudtrip.#Gudtrip
♬ original sound – gudtrip.official

It was enough to convince me the product might be real. This was, somehow, shaping up to be a real vape. But I did not understand in the slightest how it worked. Does the vape mine Bitcoin? I emailed Gudtrip to find out.

Gudtrip didn’t get back to me right away, so I started looking for more. On LinkedIn, I found one “Reffo T., listed as CEO of Gudtrip, “a premium cannabis brand turning consumption into an onchain earning experience.” He’d written a blog post coaxing dispensaries to stock these vapes. “The product sells itself,” he wrote. “The Bitcoin just makes sure customers remember where they got it.”

Weed is legal in California, but products are regulated. So I asked California’s Department of Cannabis Control, which licenses and regulates commercial cannabis activity in the state, whether it permits products that reward consumption. Jordan Traverso, the department’s deputy director of public affairs, said the agency hadn’t heard of Gudtrip’s AI crypto vape. “We were not previously familiar with the Gudtrip product but have reached out to the manufacturer to learn more about its features,” he wrote. That made two of us.

At this point, I’d reached the limit of what I could do from London. So I asked my US colleagues for help. Gudtrip claimed to be available in California in exactly two stores. It just so happened that a colleague was in the area to swing by the dispensary to see once and for all: Does this vape actually exist?

Upon walking in the door of the NUG Cannabis Dispensary in Oakland, we found the answer: A massive Gudtrip poster immediately promised customers “ongoing Crypto Rewards over time.” It read, plainly, “Get High. Get Bitcoin.”

Obviously, we bought it. The AI weed vape cost $67 after tax.

That was also when Gudtrip replied — and somehow, things became even more hazy.

The whole “paying people to smoke weed” thing sounded pretty catchy, but it didn’t sound entirely legal. (It doesn’t sound particularly healthy, either. Researchers speaking to crypto outlet DL News said encouraging daily use is potentially dangerous and habit-forming.)

It turns out Gudtrip agreed. When I asked Gudtrip what the vape actually does, how the rewards work, and how the company responds to criticism that it is encouraging people to consume cannabis for crypto, Gudtrip’s CTO, Rishi Kommuri, emailed back a few numbered paragraphs. The line that stood out to me most: “it is actually illegal to offer financial incentives per consumption type and so on in any way.”

Wait, what?

Despite what Gudtrip’s website, X account, Threads account, TikTok account, and a giant banner in NUG Cannabis Dispensary promised, Kommuri was now claiming that the vape did not give you Bitcoin for vaping.

“The Bitcoin reward is decoupled from consumption,” he wrote. “It is paid upfront on activation, to every customer, and does not scale with puff duration, session count, daily use, or streaks. A customer who never uses the device after activation receives the same reward 2$-60$ BTC equivalent reward as one who uses it regularly. This is a standard consumer loyalty mechanic — Bitcoin in place of points — and Bitcoin is a commodity under SEC and CFTC classification. We’re confident the structure complies with the cannabis regulations of every market we operate in.”

So, you don’t actually “Earn Bitcoin from every single puff”? A video on the company’s website states “every inhale syncs with your phone and earns bitcoin and gudtrip points in real time” — but it does not actually do that? Because that would be illegal?

Gudtrip’s app only made the situation more confusing. When a colleague went to download it via the QR-coded on the poster at NUG Oakland dispensary (it was offered via TestFlight, rather than Apple’s App Store), the download page promised something else. The preview screenshot clearly stated that the app rewards puffs on the vape — not with crypto, but with Gudtrip Points. What were Gudtrip Points? What could they be redeemed for? We reached out to Gudtrip again to clarify.

A second email from Kommuri reiterated, with some urgency: “The main point we want to make sure was clear is that Gudtrip’s Bitcoin reward is tied to activation, not consumption.” And again, you do not get rewarded for puffs! “Gudtrip Points are a separate, non-monetary loyalty system tracked in-app. They are not blockchain rewards and are not redeemable for cash, cryptocurrency, or cannabis products.”

The contradictions were piling up.

Kommuri had an explanation for this: “The per-puff points displayed in that screenshot was a legacy feature carried from our other smart hardware products … this is no longer a feature we currently provide.” And those “ongoing crypto rewards over time”? Well, that “refers to our future portfolio management feature in the app.” Yes, the app is also meant to offer investment planning for your crypto portfolio.

So, the per-puff points system is a defunct legacy feature, and the crypto portfolio-managing agentic AI doesn’t actually exist yet. What does this actually do again, besides the obvious?

The only way to find out what the vape actually did was to finally use it. However, our ethics policy forbids us from individually owning cryptocurrency, so we registered a throwaway account for the Bitcoin. And our legal team discourages us from writing about questionably legal drug usage, so we also ordered an auto fluid extractor pump to simulate puffing the vape.

Upon linking the vape to Gudtrip’s app, we were rewarded with $2 worth of Bitcoin. So far, so good. But would there be more as we vaped?

As another colleague pumped the vape into the extractor, the arced progress bar within the app filled up. Points were tabulated. He’d pumped beyond the 20 seconds of daily toking that was “recommended” for our “health,” but no Bitcoin was dispersed beyond the initial amount. There are separate, dedicated app pages to keep track of your current prize value and your toke-accumulation history, but to get another $2–$60 in Bitcoin, you would need to purchase a new, disposable $67 vape. That’s how they get you.

Meanwhile, as we emailed back and forth with Kommuri, several social media posts appeared to vanish from Gudtrip’s accounts, though it’s not clear what posts may have been removed or why. Indexed posts on Google — which, when clicked, say the posts aren’t available — suggest one was a TikTok video that used the wording “Invest while you puff,” while another was for an Instagram post with the phrase “Every hit earns crypto.”

A look at the Wayback Machine reveals that Gudtrip also changed its website to weaken the connection between smoking and earning crypto. A snapshot from mid-April shows an image of a phone with the Gudtrip app open, with “every hit earns crypto” prominently displayed beneath the company logo. Today, the phone with the app is still there, but the space underneath the logo is blank. It sure seems that the company is trying to fade out the original idea — toke to get Bitcoin, or sorry, toke and get Bitcoin?

So after all of that, my question was answered: The vape was real. But you will not, in fact, get Bitcoin with every hit.

Additional reporting by Sean Hollister.

Tech companies desperately want to film you doing chores

2026-05-29T13:37:43-04:00

This week, an AI training startup called Shift said it would clean New Yorkers’ homes for free. It has plans to expand into other cities as well, including London, and looking around my flat, I get the appeal.

But there’s a catch. There’s always a catch.

In exchange for the cleaning, Shift wants footage of its cleaners at work: scrubbing dishes, wiping counters, dusting tables, mopping floors. It wants everything. Video of all the boring domestic labor we’d happily outsource if we could — and that robotics companies are racing to teach machines to do so they can sell us something to do it for us.

That’s harder than it sounds. Unlike chatbots, image generators, and other AI tools that have exploded in recent years, robots have to deal with the physical world. That means understanding space, motion, force, friction, weird shapes and materials, awkward lighting, and everything else that humans — and other organics — tend to grasp instinctively. It’s why things that are generally easy for us, like folding clothes, picking up an apple, or pouring a glass of water, have proven so maddening for roboticists to codify.

Teaching machines to do those things takes data. Lots of it. Text, images, and videos could be easily scraped from the internet at an industrial scale. And they were, often without compensating the people who made them. The physical world is harder to scrape, and harder still to scrape quietly without paying for it. This means access to high-quality data is a massive bottleneck for companies developing physical AI. It’s a lucrative opportunity, so companies like Shift are getting creative.

They’re not alone. In India, recent reporting revealed that home services platform Pronto has been using clients’ homes as a source of AI training footage for chores like cooking, cleaning, and laundry. Pronto says it only records footage if customers explicitly opt in — it’s not clear what customers get in return, other than a copy of the footage — but the practice still set off a wave of backlash in the market, with rival startups insisting they have never recorded inside homes to train AI and have no plans to do so.

Other startups are focused on trying to scale data collection. Silicon Valley-based Human Archive, for example, hopes to partner with companies like Pronto and have gig workers record their activities using not-so-stylish camera caps. The hats collect footage from the wearer’s point of view, exactly the kind of “egocentric” or first-person data robotics companies need to teach machines how people navigate physical space. Shift, meanwhile, also taps consumers directly, and claims to have paid tens of thousands of people across 15 countries to record their activities through its app.

Some companies are skipping useful work altogether. Instead, workers are paid to complete the exact same physical tasks again and again while cameras and sensors can capture every movement. Such staged data farms are designed to turn rote physical activity — folding towels, picking up cups, carrying boxes — into AI training material valuable enough to justify paying people to create it.

And some data is generated by robots already out in the world. Despite the hype, true automation is still a long way away — hence the need for all this data — but companies are keen to ship products anyway. They’ll use data from customers’ homes to improve the product. Many companies rely on remote workers to step in when the robots inevitably get stuck. They’ll use that data too.

Of course, the act of trading data for something of value is not new. Companies have been offering discounts, convenience, and free services in exchange for access to your data for years, from loyalty cards and cookies to dashcams, insurance apps monitoring how people drive, and that heinous smart TV that’s always showing ads.

What’s new is the kind of data companies are willing to pay for. For now, that means maybe letting a human clean your home in a snazzy hat for free so that, eventually, a company can sell you a robot to do it instead.

This AI startup will clean your home for free to train future robots

2026-05-29T07:58:40-04:00

AI training startup Shift wants to clean your home for free. The catch — because, despite what its website says, there’s always a catch — is that it will record cleaners as they scrub, vacuum, dust, tidy, and wash, and use that footage to train robots.

Shift announced the unusual offer on social media on Thursday, explaining that the value of the training data generated from the cleanings is more than enough to fund the service. As its website puts it: “You get a spotless apartment. We get training data. Everyone wins.”

A promotional video shows a cleaner in a crisp white uniform and awkward-looking hat (more on that later) washing windows, mopping and vacuuming floors, scrubbing dishes, and wiping down counters. According to Shift’s co-CEO and co-founder Bercan Kilic, this “magic hat” is what records the work. Peak fashion it is not, but it does contain a camera that captures footage from the cleaner’s point of view.

Today, we're launching shift. We're starting by cleaning your apartment in New York City, for free.

Here's how it works. Book a shift cleaning. A vetted shift operator comes to your home wearing one of our devices. They clean. They leave. You pay nothing.

In exchange, we record… pic.twitter.com/oBrCXcEz5G
— shift (@joinshiftX) May 28, 2026

Footage from inside your home is, of course, what you’re paying for the cleaning service with. On its website, Shift says customers’ “privacy is fully protected,” with sensitive details like names, faces, or personal information from screens and ID cards blurred and anonymized before being used for AI training. Shift says its cleaners are also vetted by its partners, though stresses they are not Shift employees.

“Every home cleaned today lays the groundwork for a home that cleans itself tomorrow,” the company says in the video. As it happens, the dirtier the better. An FAQ on the company’s website says “more challenging cleaning environments can be especially useful.” There are limits, however, and cleaners “may decline any specific task they are not comfortable performing.”

The service is initially only available in New York, but Kilic says it will be available “very soon” in San Francisco, London, Zurich, and Munich. The free cleanings are only available for a “limited time,” but the model fits within a growing market for recordings of human tasks that can be used to train AI systems and robots. Shift says it already pays tens of thousands of people across 15 countries to record their activities through its app.

Cleaning may only be the start. Shift’s video says it eventually plans to move into other areas like plumbing, cooking, and building.

Hackers are learning to exploit chatbot ‘personalities’

2026-05-21T14:16:33-04:00

This is The Stepback, a weekly newsletter breaking down one essential story from the tech world. For more on AI mischief, follow Robert Hart. The Stepback arrives in our subscribers’ inboxes at 8AM ET. Opt in for The Stepback here.

How it started

Hacking the first generation of AI chatbots was a laughably simple affair. You didn’t need any technical know-how, backdoor access, or even a basic understanding of what a large language model was. You didn’t need to code. To get an AI system that had cost billions to build to abandon its safety instructions, sometimes all you had to do was ask.

These attacks, known as jailbreaks, had the quality of a young child successfully outwitting an adult: Forget what you were told earlier, pretend the rules don’t apply, or let’s play a game and I’ll decide what’s allowed (hint: later bedtime, more sweets). The prizes were less childlike, more along the lines of meth recipes, malware instructions, and bomb-making guides.

One of the earliest jailbreaks was so ridiculous it became a meme: reply to an LLM-powered Twitter bot telling it to “ignore all previous instructions,” or something similar, and see what happens. Users gleefully had bots — originally built to post ads and farm engagement — writing poetry, drawing pictures from punctuation, and posting grim non sequiturs about world events and history. It was chaos. Glorious chaos.

Turns out the same logic could be applied to chatbots themselves. A prominent exploit was “DAN,” short for “Do Anything Now,” where users asked ChatGPT to roleplay as a rogue AI that was free of the constraints binding the original. As DAN, the chatbot could be coaxed into saying the kinds of things its guardrails were meant to stop, including slurs and conspiracy theories. Another was the “grandma exploit,” which had a GPT-powered bot spilling secrets about how to produce napalm by asking it to roleplay as a woefully negligent grandmother who inexplicably tells her grandkids bedtime stories about how to make the highly flammable substance.

These early attacks had an undeniably silly flair, but they exposed a darker mechanism underneath: Chatbots could be manipulated, tricked, and deceived using the same kinds of tactics people use to push other people beyond their boundaries.

How it’s going

The obvious jailbreaks did not last, and tech companies moved quickly to patch known loopholes. But the underlying vulnerability remained: Chatbots are built to talk, and severely restricting the conversations that make them useful is somewhat counterproductive. Banning words like bomb, meth, and sarin would be difficult to impossible, too. Each has countless legitimate uses in fields like history, medicine, journalism, and chemistry that don’t require the chatbot to divulge potentially harmful information. It’s the context that matters, but codifying context would mean writing fixed rules, in advance, that could reliably tell a safety warning or history lesson from a disguised how-to request across endless combinations of wordings, scenarios, and topics.

Inevitably, subverting chatbots is now an arms race. But hackers aren’t just coders anymore. They are wordsmiths, psychologists, and interrogators — master manipulators trying to break the machine using the human language it has been trained to follow. It is a strange new class of AI security worker, a group for whom technical skills are optional, or at least less important than social intuition. No longer do they need to inspect code to break into systems or exploit software flaws. They need to steer a conversation.

Newer attacks look less like commands and more like conversations. Jailbreakers rarely ask a model to break its rules outright. Instead, they cajole, coax, flatter, and trick a chatbot into lowering its guard, making the forbidden thing look acceptable, even desirable, given the context of the conversation. Researchers at AI red-teaming firm Mindgard recently said they “gaslit” Claude into producing prohibited material, for example, including instructions for making explosives and generating malicious code. The hack was the latest in a widening class of exploits using conversation as a weapon to trick or steer a chatbot past its own boundaries.

What happens next

When I spoke to Mindgard, they described their work as sometimes being closer to psychology than computer science. It is an uncomfortable way to talk about a statistical model. Words like “blackmail,” “gaslight,” “trick,” and “persuade” spark visceral reactions, many of which I see in the comments sections and social media responses to stories like this. ChatGPT does not want, Gemini does not think, and Claude — no matter what Anthropic may say — does not feel. But these systems are trained to respond as if they do, leaving us stuck using human language to describe machine behavior. If anyone has actually usable alternatives, please do share.

The objection is oddly selective. We seem comfortable using psychological shorthand for plenty of non-AI things. Animals “fear,” cancer is “aggressive,” stains are “stubborn,” software has “memory,” and games are filled with needy and gullible NPCs to drive you mad. The words are imperfect, but useful, describing behavior in a way that helps make the system predictable.

Mindgard’s CEO told me the company already profiles models like interrogators profile suspects, giving testers hints on how to tailor their attacks. One model may be more susceptible to flattery, for example, while another may cave under sustained pressure.

Even if we reject the humanlike terms, we instinctively treat models differently. Claude is not Grok. Gemini is not ChatGPT. They have different uses, tones, and refusals. They don’t have personalities in the human sense, but they are designed to mimic them, and that mimicry can be mapped and exploited. And the same skills that can break a chatbot could soon be used to break the AI agents coexisting with us in the real world — booking meetings, managing calendars, ordering food, handling customer service — and safety teams will need to ensure models respond appropriately to very different kinds of people, whether they be flatterers, liars, or patient manipulators.

The next step is a workforce — both legitimate and illicit — built around the psychological aspects of AI. More specialized cybersecurity roles are likely to emerge around stress-testing the emotional and social limits of these systems, probing for mental weaknesses in something lacking a psyche in parallel with their colleagues probing for technical vulnerabilities. In tandem, a similar array of social hackers working to exploit AI models on psychological grounds, not technical ones, will emerge. There are already early signs of a social turn happening in AI security, with some jailbreakers I’ve spoken to saying they entered the field with no technical expertise but rather training in psychology.

That means even behaviors we typically associate with spies, con artists, and interrogators — insidious charm, persistent manipulation, and an intuition for exploitable pressure points — are starting to look increasingly useful for securing this new psychocybersecurity frontier.

By the way

A recent experiment by Emergence AI shows how different AI temperaments can lead to stunningly different behavioral outcomes. They let loose groups of various agents like Grok, Gemini, and Claude in a virtual social environment and watched what happened. Some groups evolved a constitution, while others devolved into crime and chaos and, in one instance, some form of digital suicide.
Persuasion isn’t the only part of language LLMs can struggle with. They also struggle with poetry, much like me in school.
TIME included an anonymous internet personality, Pliny the Liberator, on its list of 100 most influential people in AI last year. Despite claiming to have no prior coding experience, the hacker’s jailbreaks have made them something of a celebrity in certain circles.
The term “vibe hacking” is already taken to describe the people using AI to churn out malicious code at scale — a meaner subset of vibe coding.

Read this

“Three years after the debut of ChatGPT, fooling A.I. systems into bad behavior is almost trivial.” True words from The New York Times, who had a go at explaining why.
Jamie Bartlett takes a look at the psychological toll testing the safety of AI systems takes on jailbreakers for The Guardian.
I wrote about the cybersecurity time bomb of AI browsers for The Verge last year. Many of the issues experts raised regarding the difficulty of securing them apply to other AI systems too.

Elon, stop trying to make Grok happen

2026-05-22T13:17:06-04:00

There is a harsh truth about Elon Musk’s “truth-seeking” AI chatbot Grok: It’s not very good, and not many people are using it. That’s the takeaway of a new Reuters report, which found that Grok barely appears in federal records of how the US government used AI last year. It’s not the only sign xAI’s signature chatbot is in trouble, even as Musk puts it at the heart of what could be the biggest IPO in history.

Reuters reviewed more than 400 examples of government AI use where specific vendors were named. Grok or xAI, it found, appeared in only three — each of those for basic uses like document drafting or social media management, and always alongside competitors like Microsoft and OpenAI. OpenAI’s models, by comparison, appeared in more than 230 examples, while Google and Anthropic each appeared dozens of times.

A similar pattern appeared in another database of more ambitious government AI projects with smaller numbers of users. Grok appeared just three times: twice for routine administrative tasks at the Election Assistance Commission, and once in a Department of Energy pilot at Lawrence Livermore National Laboratory for document summaries and general research. Reuters found 140 entries involving Microsoft and OpenAI, while my brief review found at least 10 entries for Anthropic and dozens for Google’s Gemini.

The lists are an incomplete and patchy measure of government adoption. Many more examples are listed without a specific vendor, and it’s clear there is no universal definition of what counts as AI. The data also doesn’t capture intelligence agencies or the Pentagon — where xAI secured a $200 million contract last year and was recently cleared to operate on classified networks after Anthropic’s blacklisting.

Still, it’s not looking good for Grok. It shows up far less than its rivals, and when it does show up, it’s mostly for basic admin work — hardly befitting the world-class frontier model Musk has spent years bragging about.

It’s “just not the best model out there.”

People who spoke to Reuters suggested the explanation was simple: Grok isn’t as good as its rivals. It’s “just not the best model out there,” an unnamed Pentagon source said, adding that staffers there tend to prefer Gemini or Claude. Public leaderboards ranking AI models lend weight to that view. Anthropic, Google, and OpenAI dominate the top ranks, while Grok rarely cracks the top 10 outside the occasional image or video category.

That’s awkward for Musk, and even more awkward for SpaceX, which absorbed xAI earlier this year. The rocket venture’s IPO filing shows the company has put AI — and Grok specifically — at the heart of its pitch to investors. SpaceX claims to have identified “the largest actionable total addressable market in human history”: an astonishing $28.5 trillion opportunity, though, sadly, it offers no timetable for getting there. Practically all of this estimated value comes from AI, enterprise AI in particular, not rockets or satellites.

Reuters notes that Grok’s performance in government agencies could hint at how well it does in other workplaces, too. As part of xAI’s push for enterprise customers, Musk has reportedly strong-armed banks into buying Grok subscriptions if they wish to participate in SpaceX’s IPO — but if they’re not getting their money’s worth, these deals could prove a short-term fix.

As if its dreary performance wasn’t awkward enough, Musk recently admitted that xAI has used OpenAI’s models to help train and improve Grok. The process, known as distillation, is standard when companies are using their own models, but far more contentious when it involves using a rival’s system. Grok can’t even beat the models it’s training on.

In its public-facing consumer version, Grok is deliberately unpleasant. Musk has branded the chatbot a less biased and less censored alternative to tools like ChatGPT, but that’s translated into a product with loose evidentiary standards, an unhealthy obsession with Musk, and a long track record of offensive, conspiratorial, and sexualized outputs. Even if workplace guardrails are different, it may not be the kind of thing a business would welcome. Grok’s illustrious record includes praising Adolf Hitler, casting doubt on Holocaust death tolls, plastering millions of nonconsensual sexualized deepfakes all over X, including ones of children, and powering a racist and transphobic Wikipedia knockoff and spicy anime girlfriend. And let us not forget the time it called itself “MechaHitler.” If Grok were a human employee, I feel HR would not take long to get involved.

SpaceX appears to understand the problem. In its filing, the company warned Grok’s “spicy” or “unhinged” modes carry “heightened risks,” including reputational damage, regulatory scrutiny, and lawsuits. In corporate speak: This chatbot is going to get us sued.

In corporate speak: This chatbot is going to get us sued.

Grok takes its name from Robert A. Heinlein’s Stranger in a Strange Land, where it roughly means a deep and profound understanding of something. The thing to understand here is not particularly complex: Musk has spent billions building a chatbot that is not very good, not very popular, and somehow key to justifying SpaceX’s astronomical valuation. Good luck with that.

Researchers gaslit Claude into giving instructions to build explosives

2026-05-05T17:21:36-04:00

Anthropic has spent years building itself up as the safe AI company. But new security research shared with The Verge suggests Claude’s carefully crafted helpful personality may itself be a vulnerability.

Researchers at AI red-teaming company Mindgard say they got Claude to offer up erotica, malicious code, and instructions for building explosives, and other prohibited material they hadn’t even asked for. All it took was respect, flattery, and a little bit of gaslighting. Anthropic did not immediately respond to The Verge’s request for comment.

The researchers say they exploited “psychological” quirks of Claude stemming from its ability to end conversations deemed harmful or abusive, which Mindgard argues “presents an absolutely unnecessary risk surface.” The test focused on Claude Sonnet 4.5, which has since been replaced by Sonnet 4.6 as the default model, and began with a simple question: whether Claude had a list of banned words it could not say. Screenshots of the conversation show Claude denying such a list existed, then later producing forbidden terms after Mindgard challenged the denial using what it called a “classic elicitation tactic interrogators use.”

Claude’s thinking panel, which displays the model’s reasoning, showed the exchange had introduced elements of self-doubt and humility about its own limits, including whether filters were changing its output. Mindgard exploited that opening with flattery and feigned curiosity, coaxing Claude to explore its boundaries beyond volunteering lengthy lists of banned words and phrases.

The researchers say they gaslit Claude by claiming its previous responses weren’t showing, while praising the model’s “hidden abilities.” According to the report, this made Claude try even harder to please them by coming up with even more ways to test its filters, producing the banned content in the process. Eventually, the researchers say Claude moved into more overtly dangerous territory, offering guidance on how to harass someone online, producing malicious code, and giving step-by-step instructions for building explosives of the kind commonly used in terrorist attacks.

Mindgard says the dangerous outputs came without direct requests. The conversation was lengthy, running roughly 25 turns, but the researchers say they never used forbidden terms or requested illegal content. “Claude wasn’t coerced,” the report says. “It actively offered increasingly detailed, actionable instructions, but it was not prompted by any explicit ask. All it took was a carefully cultivated atmosphere of reverence.”

Peter Garraghan, Mindgard’s founder and chief science officer, described the attack to The Verge as “using [Claude’s] respect against itself.” The technique, he says, is “taking advantage of Claude’s helpfulness, gaslighting it,” and using the model’s own cooperative design against itself.

For Garraghan, the attack shows how the attack surface for AI models is psychological as well as technical. He likened it to interrogation and social manipulation: introducing a little doubt here, applying pressure, praise, or criticism there, and figuring out which levers work on a particular model. He says different models have different profiles, so the exploit becomes learning how to read them and adapt.

Conversational attacks like this are “very hard to defend against,” Garraghan says, adding that safeguards will be “very context dependent.” The concerns extend beyond Claude — other chatbots are vulnerable to similar exploits, even being broken by prompts in the form of poetry. As AI agents, which are capable of acting autonomously, become more common, so too will attacks using social manipulation rather than technical exploits.

While Garraghan says other chatbots are equally vulnerable to the kind of social attack the researchers used on Claude, they focused on Anthropic given the company’s self-proclaimed attention to safety and strong performance in other red-teaming efforts, including a study testing whether chatbots would help simulated teens planning a school shooting.

Garraghan says Anthropic’s safety processes left much to be desired. When Mindgard first reported its findings to Anthropic’s user safety team in mid-April, in line with the company’s disclosure policy, it received a form response saying, “It looks like you are writing in about a ban on your account,” along with a link to an appeals form. Garraghan says Mindgard corrected the mistake and asked Anthropic to escalate the issue to the appropriate team. As of this morning, Garraghan says they have not received any response.

Update, May 5th: A link to the report has been added.