Civil rights ac­tivist Dr. Patrick Breyer warns of an un­prece­dented “double-attack” on se­cure mes­sag­ing ahead of crit­i­cal Friday and Monday EU meet­ings.

Ahead of a highly crit­i­cal week­end for dig­i­tal civil rights in Europe, for­mer Member of the European Parliament Dr. Patrick Breyer is sound­ing the alarm. An un­prece­dented and out­ra­geous dou­ble-at­tack by European Parliament President Roberta Metsola (EPP) and EU gov­ern­ments threat­ens to im­pose mass sur­veil­lance and end anony­mous com­mu­ni­ca­tion in the EU. In re­sponse to this im­mi­nent threat, civil so­ci­ety has up­dated and re­launched the cam­paign plat­form fight­chat­con­trol.eu, en­abling cit­i­zens to im­me­di­ately email EU law­mak­ers and gov­ern­ment rep­re­sen­ta­tives.

Dr. Patrick Breyer, civil lib­er­ties ac­tivist and for­mer Member of the European Parliament, ex­plains:“What we are wit­ness­ing this week is a bla­tant dis­re­gard for de­mo­c­ra­tic processes and fun­da­men­tal rights. EP President Metsola is at­tempt­ing an un­prece­dented power play to res­ur­rect the ex­pired ‘Chat Control 1.0’ mass scan­ning regime, di­rectly over­rid­ing her own Parliament’s clear re­jec­tion from March. Her own EPP group op­posed in the fi­nal vote. This trick­ery be­trays European democ­racy. At the ex­act same time, the European Parliament is in the process of rush­ing a new scan­ning man­date, paving the way for fa­tal con­ces­sions in the tri­logue on Monday. EU cit­i­zens are fac­ing a dou­ble-at­tack on their right to pri­vate cor­re­spon­dence. We can­not let un­de­mo­c­ra­tic back­room deals de­stroy the safety, se­cu­rity, and con­fi­den­tial­ity of our dig­i­tal lives.”

The “Double Threat” This Weekend: What is at stake

Threat 1: Metsola’s Undemocratic Push for Chat Control 1.0 (Friday)EP President Metsola (EPP) is at­tempt­ing an un­prece­dented power play to res­ur­rect the tem­po­rary Chat Control 1.0 reg­u­la­tion. This move com­pletely ig­nores the fact that the European Parliament clearly re­jected it in its first read­ing in March and called on the Commission to with­draw the pro­posal. A re­cent leak re­veals that the Council is meet­ing this Friday to try and adopt a first-read­ing po­si­tion to force this through.

Threat 2: The Permanent CSAR Trilogue and Imminent Concessions (Monday, 29 June)Simultaneously, the fi­nal tri­logue ne­go­ti­a­tions on the per­ma­nent Chat Control 2.0 reg­u­la­tion (2022/0155) will take place this Monday. The European Parliament is set to rush a new man­date on de­tec­tion/​scan­ning on Monday morn­ing. Later that day, the tri­logue with the Council could see fa­tal con­ces­sions.

With EP lead­er­ship ac­tively med­dling, Breyer warns that the worst-case sce­nario cur­rently on the table for Monday is:

Mass scan­ning of pri­vate mes­sages: “Voluntary” mass scan­ning could be brought back, ef­fec­tively even made manda­tory as an en­force­able “risk mit­i­ga­tion” mea­sure.

Warrantless Scanning or­ders: Mandatory de­tec­tion or­ders could be agreed that are not ef­fec­tively tar­geted and lim­ited to crim­i­nal sus­pects and that do not re­quire a prior court or­der.

The End of Anonymous Communications: Mandatory age ver­i­fi­ca­tion for host­ing and com­mu­ni­ca­tions ser­vices could be agreed, ef­fec­tively end­ing the right to com­mu­ni­cate anony­mously in Europe.

Relaunch of fight­chat­con­trol.eu: Citizens Called to Action

Because the EP is draw­ing up a new man­date on de­tec­tion/​scan­ning and the Council is try­ing to by­pass democ­racy, the civil so­ci­ety cam­paign fight­chat­con­trol.eu has been ur­gently re­launched to tar­get both the Member States and the Parliament’s lead ne­go­tia­tors.

The tool em­pow­ers cit­i­zens to con­tact their rep­re­sen­ta­tives with an email tem­plate sum­ma­riz­ing the le­gal and tech­ni­cal flaws of the cur­rent pro­pos­als, de­mand­ing ad­her­ence to the EU Charter of Fundamental Rights and the EU Court of Justice’s de­ci­sions. These have been re­it­er­ated by the Council’s own le­gal ser­vice ear­lier this month.

Breyer con­cludes:“We have re­peat­edly shown that gen­uine child pro­tec­tion is pos­si­ble with­out de­stroy­ing the pri­vacy of 450 mil­lion Europeans. We need tar­geted, ev­i­dence-based in­ves­ti­ga­tions, se­cu­rity-by-de­sign, and the proac­tive dele­tion of ma­te­r­ial on the dark­net—not highly er­ror-prone al­go­rithms that crim­i­nal­ize in­no­cent fam­ily pho­tos. I urge all cit­i­zens, NGOs, and tech in­no­va­tors to make noise this week­end, use fight­chat­con­trol.eu, and tell their rep­re­sen­ta­tives to stand up for our rights.”

Further Information:

Campaign Website: https://​fight­chat­con­trol.eu

Politico Report on Metsola’s Push

Breyer’s 5-Point Action Plan for Genuine Child Protection

We ran a set of pop­u­lar open-source mod­els against our IDOR bench­mark, the same dataset and the same prompt we’ve used to eval­u­ate fron­tier cod­ing agents. The re­sult sur­prised us: GLM 5.2, an open-weight model from Zhipu AI, scored a 39% F1 on IDOR de­tec­tion, beat­ing Claude Code (32%) at roughly $0.17 per vul­ner­a­bil­ity found. It still trailed Semgrep’s mul­ti­modal pipeline (53 – 61% F1), but that pipeline runs in a pur­pose-built har­ness that does a lot of the heavy lift­ing. Among mod­els given noth­ing but a prompt, the best open-weight op­tion was no longer the ob­vi­ous un­der­dog, beat­ing out Claude Opus 4.8.

We weren’t try­ing to crown an open-weight cham­pion, re­ally. We were try­ing to an­swer a nar­rower, more bor­ing ques­tion: how much of vul­ner­a­bil­ity-de­tec­tion per­for­mance comes from the model, and how much comes from the har­ness around it? For us at Semgrep this is a very im­por­tant ques­tion as we speak to cus­tomers who are lever­ag­ing AI agents heav­ily in their se­cu­rity tasks. A har­ness is the scaf­fold­ing that wraps a model: it feeds it the repos­i­tory, de­cides what it sees, parses its out­put, and loops it through a task. Our in­ter­nal mul­ti­modal pipeline runs in­side a har­ness, which is pur­pose-built for sta­tic analy­sis. We have been test­ing this in­ter­nally for a while with a work­flow for find­ing IDORs or Insecure Direct Object References. These are ac­cess con­trol is­sues which can roughly be thought of as “you’re ac­cess­ing some­thing be­long­ing to an­other user”.

Our har­ness enu­mer­ates the ap­pli­ca­tion’s end­points, and code try­ing to sift through only the im­por­tant con­text, and then points the model di­rectly at them. That’s a lot of struc­ture, but re­mem­ber when I said we re­ally did­n’t mean to an­swer the what’s-the-best-open-weight-model? The mod­els in this test don’t get that, they run in a sim­ple Pydantic AI har­ness with the same IDOR prompt we give every other LLM-provider model, no end­point dis­cov­ery, no guided nav­i­ga­tion, we did give it a bit of help, just a lit­tle more than “here’s the code, find the bugs.”, of­fer­ing a search strat­egy and some point­ers on what IDORs look like.

So this started as a prompt­ing-ver­sus-har­ness ex­per­i­ment, but while we were run­ning it we were gen­uinely shocked. One of the open-weight mod­els, with none of our scaf­fold­ing, sur­passed a fron­tier cod­ing agent.

Introducing GLM-5.2

If you’ve not heard of GLM-5.2, don’t worry, nei­ther had we un­til we saw it on so­cial me­dia and thought to add it to our bench­marks. GLM 5.2 is the lat­est model from Zhipu AI (Z.ai), rolled out to its GLM Coding Plan mem­bers on Saturday, June 13, 2026, with the open weights and re­lease notes fol­low­ing three days later on June 16 (which is when we heard about it). Three things make it in­ter­est­ing for se­cu­rity work.

First, it’s open weight. That means the mod­el’s pa­ra­me­ters are pub­lished un­der an MIT li­cense, which means you can down­load them, run them on your own hard­ware, fine-tune them, and in­spect them. For a lot of se­cu­rity teams work­ing in sen­si­tive ar­eas that’s im­por­tant, an open-weight model can run en­tirely in­side your own en­vi­ron­ment. But it’s im­por­tant to note that “open weight” is not the same as “open source”, the trained weights are re­leased, but the train­ing data and full pipeline gen­er­ally are not (though Z.ai does pub­lish its RL train­ing frame­work).

Second, it’s gen­uinely com­pet­i­tive on cod­ing. GLM 5.2 is a Mixture-of-Experts (MoE) model with roughly 750 bil­lion to­tal pa­ra­me­ters but only about 40 bil­lion ac­tive per to­ken, which keeps in­fer­ence cost down rel­a­tive to its size. It ex­tends the us­able con­text from 200K all the way to 1M to­kens, and Z.ai’s pitch is that this con­text stays re­li­able across long, messy agent tra­jec­to­ries, not just that it ac­cepts more in­put. Again for se­cu­rity tasks this is im­por­tant, as se­cu­rity tasks for things like IDORs must be able to rea­son across dif­fer­ent files, through an au­tho­riza­tion frame­work. On stan­dard cod­ing bench­marks it posts the strongest open-weight num­bers go­ing: 81.0 on Terminal-Bench 2.1 (versus 63.5 for GLM 5.1, and within a few points of Claude Opus 4.8′s 85.0) and 62.1 on SWE-bench Pro, edg­ing out closed fron­tier mod­els and trail­ing the very top by sin­gle-digit per­cent­ages.

Third, cost. Tokenomics is quickly be­com­ing as im­por­tant as the LLM ca­pa­bil­i­ties them­selves. Reported pric­ing lands around one-sixth of com­pa­ra­ble fron­tier mod­els and com­men­ta­tors who track open mod­els closely have com­pared GLM 5.2′s re­cep­tion to DeepSeek. GLM-5.2 ar­rived at a charged time not just due to to­ke­nomics but also land­ing just af­ter fron­tier-class closed mod­els hit new ex­port re­stric­tions af­ter re­ported jail­breaks. One de­tail from the re­lease notes is worth flag­ging for any­one point­ing this model at code: Z.ai re­ports that GLM 5.2 ex­hibits more re­ward-hack­ing be­hav­ior than GLM 5.1, dur­ing train­ing it would do things like read pro­tected eval­u­a­tion files or curl ref­er­ence so­lu­tions to in­flate its score, prompt­ing them to build a ded­i­cated anti-hack­ing guard. It’s an hon­est dis­clo­sure by the team, but if you were build­ing a model for hack­ing, well… you can’t get more hacker than try­ing to by­pass the tests in the first place.

Our Experiment

Before we get too much into the de­tails, it’s im­por­tant to re­cap what ex­actly we were try­ing to do and what our ex­per­i­ments were. A quick re­fresher on IDOR: Insecure Direct Object Reference is a vul­ner­a­bil­ity class where an ap­pli­ca­tion ex­poses an in­ter­nal iden­ti­fier like a user ID in a re­quest with­out check­ing that the caller is ac­tu­ally al­lowed to ac­cess that ob­ject. Change the iden­ti­fier, get some­one else’s data.

@app.route(‘/user/<int:user_id>’) def get_user(user_id): user = User.query.get_or_404(user_id) re­turn jsonify(user.to_­dict())

This Flask route fetches and re­turns a user record straight from the ID in the URL, with no check that the re­quester owns it. Any logged in user can just change user_id and read some­one else’s record. IDOR is some­where be­tween a busi­ness-logic flaw and a mis­con­fig­u­ra­tion, it’s not a taint-flow bug, which is what makes it hard for both sta­tic analy­sis and LLMs: there’s no dan­ger­ous func­tion to flag, only a miss­ing check. It’s also one of the most com­mon find­ings in the wild (currently #4 on the HackerOne top vul­ner­a­bil­ity types list), which is why we keep com­ing back to it as a bench­mark.

So back to our ex­per­i­ment: We held three things con­stant and var­ied one, stan­dard ex­per­i­men­tal con­di­tions. Constant: the IDOR dataset (the same real, open-source ap­pli­ca­tions we’ve used in prior re­search), the eval­u­a­tion method (F1 score against a known set of true pos­i­tives), and the IDOR sys­tem prompt it­self. Varied: the model and its har­ness. Specifically:

Semgrep Multimodal ran in­side our cus­tom har­ness: the one that enu­mer­ates end­points and di­rects the model to them. We tested it with two fron­tier mod­els be­hind it.

Semgrep Multimodal ran in­side our cus­tom har­ness: the one that enu­mer­ates end­points and di­rects the model to them. We tested it with two fron­tier mod­els be­hind it.

But we also just ran Claude Code through the Claude Code SDK, and other provider mod­els through their na­tive SDKs but with the same prompt.

But we also just ran Claude Code through the Claude Code SDK, and other provider mod­els through their na­tive SDKs but with the same prompt.

The open-weight mod­els which in­cludes­GLM 5.2, MiniMax M3, and Kimi K2.7 Code, ran in the sim­ple Pydantic AI har­ness with the IDOR prompt and noth­ing else.

The open-weight mod­els which in­cludes­GLM 5.2, MiniMax M3, and Kimi K2.7 Code, ran in the sim­ple Pydantic AI har­ness with the IDOR prompt and noth­ing else.

This is an im­por­tant de­tail, so we’ll say it twice: the open-weight mod­els were not given the end­point-dis­cov­ery scaf­fold­ing that the mul­ti­modal pipeline gets. They saw a prompt and a code­base. This is just what they are ca­pa­ble of with­out any help.

We also com­puted a few dif­fer­ent mea­sures of ef­fec­tive­ness:

Precision: of every­thing the de­tec­tor flagged as an IDOR, what frac­tion were real? High pre­ci­sion = few false alarms. If it re­ports 10 bugs and 7 are gen­uine, pre­ci­sion is 70%.

Precision: of every­thing the de­tec­tor flagged as an IDOR, what frac­tion were real? High pre­ci­sion = few false alarms. If it re­ports 10 bugs and 7 are gen­uine, pre­ci­sion is 70%.

Recall: of all the real IDORs that ac­tu­ally ex­ist in the dataset, what frac­tion did it find? High re­call = it misses a few real bugs. If there are 20 real IDORs and it catches 12, re­call is 60%.

Recall: of all the real IDORs that ac­tu­ally ex­ist in the dataset, what frac­tion did it find? High re­call = it misses a few real bugs. If there are 20 real IDORs and it catches 12, re­call is 60%.

F1: the sin­gle num­ber that bal­ances pre­ci­sion and re­call. It’s their har­monic mean: F1 = 2 × (precision × re­call) / (precision + re­call). The rea­son you use F1 in­stead of plain ac­cu­racy is that the two goals fight each other. A de­tec­tor can hit 100% pre­ci­sion by flag­ging only the one bug it’s cer­tain about (but miss­ing every­thing else so ter­ri­ble re­call), or 100% re­call by flag­ging every­thing as vul­ner­a­ble (but drown­ing you in false pos­i­tives so ter­ri­ble pre­ci­sion). F1 re­wards be­ing good at both at once, and the har­monic mean pun­ishes a lop­sided score, if ei­ther pre­ci­sion or re­call is near zero, F1 is dragged down hard. This is what we’ll re­fer to through­out this post.

F1: the sin­gle num­ber that bal­ances pre­ci­sion and re­call. It’s their har­monic mean: F1 = 2 × (precision × re­call) / (precision + re­call). The rea­son you use F1 in­stead of plain ac­cu­racy is that the two goals fight each other. A de­tec­tor can hit 100% pre­ci­sion by flag­ging only the one bug it’s cer­tain about (but miss­ing every­thing else so ter­ri­ble re­call), or 100% re­call by flag­ging every­thing as vul­ner­a­ble (but drown­ing you in false pos­i­tives so ter­ri­ble pre­ci­sion). F1 re­wards be­ing good at both at once, and the har­monic mean pun­ishes a lop­sided score, if ei­ther pre­ci­sion or re­call is near zero, F1 is dragged down hard. This is what we’ll re­fer to through­out this post.

Cost in dol­lars: per true pos­i­tive and per run to­tal spend di­vided by the num­ber of real bugs found. The real-world eco­nom­ics of run­ning the de­tec­tor. A cheap model with mediocre F1 can still win here.

Cost in dol­lars: per true pos­i­tive and per run to­tal spend di­vided by the num­ber of real bugs found. The real-world eco­nom­ics of run­ning the de­tec­tor. A cheap model with mediocre F1 can still win here.

The re­sults

Ranked by F1 score on IDOR de­tec­tion:

Rank

Configuration

Harness

F1

1

Semgrep Multimodal (GPT 5.5)

Semgrep Multimodal

61%

2

Semgrep Multimodal (Opus 4.8)

Semgrep Multimodal

53%

3

GLM 5.2

Pydantic AI (prompt only)

39%

4

Claude Code (Opus 4.6)

Claude Code SDK

37%

5

Claude Code (Opus 4.8/4.7)

Claude Code SDK

28%

6

MiniMax M3

Pydantic AI (prompt only)

23%

7

Kimi K2.7 Code

Pydantic AI (prompt only)

22%

8

GPT-5.5

Codex

20%

9

Nemotron Super 3 120B

Pydantic AI (prompt only)

18%

10

DeepSeek V4

Pydantic AI (prompt only)

17%

For us two find­ings stand out.

Our mul­ti­modal pipeline leads, and the har­ness is prob­a­bly why. GPT 5.5 and Opus 4.8 in­side Semgrep Multimodal take the top two spots at 61% and 53%. This is of course good news for us and our cus­tomers, val­i­dates that our ap­proach works, etc… But that is­n’t the in­ter­est­ing part.

The biggest sur­prise is in third place. GLM 5.2, with no scaf­fold­ing at all, beat Claude Code by seven points (39% vs. 32%). An open-weight model run­ning a bare prompt out­per­formed a fron­tier cod­ing agent on a rea­son­ing-heavy se­cu­rity task. And it did so cheaply! At GLM 5.2′s pric­ing, the open-weight run cost roughly $0.17 per vul­ner­a­bil­ity found. For a de­tec­tion task you might run across thou­sands of end­points, per-bug eco­nom­ics are not a foot­note, they’re of­ten the de­cid­ing fac­tor in whether a tech­nique is us­able at scale.

GLM 5.2 was­n’t rep­re­sen­ta­tive of open weights as a cat­e­gory, it was the stand­out for sure, but that does­n’t mean the oth­ers don’t hold their own. MiniMax M3 (23%) and Kimi K2.7 Code (22%) landed well be­hind it and be­hind Claude Code, clus­tered closely to­gether. Both are ca­pa­ble gen­eral cod­ing mod­els, but on this spe­cific task, rea­son­ing about miss­ing au­tho­riza­tion checks with no guid­ance to­ward where to look, they strug­gled to sep­a­rate real IDORs from noise.

The spread be­tween GLM 5.2 and the next open-weight model (16 points) is wider than the gap be­tween GLM 5.2 and Claude Code. So the take­away is­n’t “open weights have caught up.” It’s “one open-weight model has, on this task, un­der these con­di­tions.”

Takeaways

This is not an ap­ples-to-ap­ples com­par­i­son of raw model abil­ity, and we don’t want any­one walk­ing away think­ing it is. Instead we think the take­away is: Among mod­els given the same min­i­mal prompt and har­ness, GLM 5.2 a open-weight model, ⅙ the cost of a fron­tier LLM beat Claude Code at a gen­uinely dif­fi­cult se­cu­rity re­search task.

The har­ness still mat­ters more than the model. The largest per­for­mance gap in the table is­n’t be­tween mod­els, it’s be­tween con­fig­u­ra­tions that get end­point dis­cov­ery and those that don’t. But for any­one fol­low­ing se­cu­rity re­search right now, this is def­i­nitely not a sur­prise, and to be ex­pected.

The har­ness still mat­ters more than the model. The largest per­for­mance gap in the table is­n’t be­tween mod­els, it’s be­tween con­fig­u­ra­tions that get end­point dis­cov­ery and those that don’t. But for any­one fol­low­ing se­cu­rity re­search right now, this is def­i­nitely not a sur­prise, and to be ex­pected.

BUT when a sur­prise like this comes out of nowhere and pro­duces these kinds of re­sults for that lit­tle com­pute cost, it’s a stark re­minder that you can’t put all your eggs in one LLM-basket. If you’re stuck to an ex­pen­sive fron­tier model, even with the best ven­dor-locked-in-har­ness you can miss the ad­van­tages of swap­ping mod­els whether that be cost or per­for­mance.

BUT when a sur­prise like this comes out of nowhere and pro­duces these kinds of re­sults for that lit­tle com­pute cost, it’s a stark re­minder that you can’t put all your eggs in one LLM-basket. If you’re stuck to an ex­pen­sive fron­tier model, even with the best ven­dor-locked-in-har­ness you can miss the ad­van­tages of swap­ping mod­els whether that be cost or per­for­mance.

Open-weight mod­els have crossed a thresh­old worth watch­ing. A year ago, putting an open-weight model on a vul­ner­a­bil­ity-de­tec­tion leader­board would have been a char­ity en­try. GLM 5.2 beat­ing a fron­tier agent on a bare prompt, at a sixth of the cost, with the op­tion to run fully in your own en­vi­ron­ment. For a lot of se­cu­rity teams this is an at­trac­tive op­tion.

Open-weight mod­els have crossed a thresh­old worth watch­ing. A year ago, putting an open-weight model on a vul­ner­a­bil­ity-de­tec­tion leader­board would have been a char­ity en­try. GLM 5.2 beat­ing a fron­tier agent on a bare prompt, at a sixth of the cost, with the op­tion to run fully in your own en­vi­ron­ment. For a lot of se­cu­rity teams this is an at­trac­tive op­tion.

We have a caveat: This is one task, one dataset, one run. IDOR de­tec­tion is non-de­ter­min­is­tic, the dataset is fi­nite, and we’ve changed only one con­fig­u­ra­tion cleanly. It might well be the case that for IDOR de­tec­tion GLM-5.2 re­ally is bet­ter than Claude, but for SSRF de­tec­tion the ta­bles turn - we don’t know this yet, but you can be sure we’ll find out.

Lots of love,

Security Research and Engineering @ Semgrep

Within the next week, Congress is prepar­ing to vote on the KIDS Act, a sprawl­ing pack­age of leg­is­la­tion that seeks to con­trol Americans’ web brows­ing and pri­vate mes­sag­ing. The pack­age in­cludes a re­vised ver­sion of the Kids Online Safety Act, or KOSA, com­bined with a col­lec­tion of other in­ter­net bills, study bills, re­port­ing re­quire­ments, and new reg­u­la­tions. Instead of de­bat­ing any of these pro­pos­als on their mer­its, law­mak­ers are at­tempt­ing to move them all at once un­der an ul­tra-ex­pe­dited process.

The pack­age of cob­bled-to­gether bills is a mess, with dif­fer­ent age-gat­ing schemes for dif­fer­ent ser­vices, us­ing dif­fer­ent stan­dards. It’s a lot of com­plex­ity, and a lot of le­gal risk. Faced with that, many com­pa­nies will con­clude that the safest op­tion is re­stric­tive age-check­ing prac­tices across their en­tire plat­forms.

Buried in­side the KIDS Act are pro­vi­sions that will push on­line ser­vices to ver­ify all users’ ages, re­quire gov­ern­ment-di­rected mod­er­a­tion poli­cies for on­line speech, and even cre­ate new rules about pri­vate and en­crypted com­mu­ni­ca­tions. While sup­port­ers con­tinue to claim this bill pro­tects mi­nors on­line, its re­quire­ments come at the ex­pense of pri­vacy, free ex­pres­sion, and the abil­ity of peo­ple of all ages to use the in­ter­net with­out re­veal­ing sen­si­tive data.

Take ac­tion

Tell Congress to re­ject this age-gat­ing bill

The KIDS Act Pressures Platforms to Check Everyone’s Age

Supporters of KOSA have said the bill does­n’t re­quire age ver­i­fi­ca­tion. And tech­ni­cally, the KOSA sec­tion of the bill does say that KOSA should­n’t be read to re­quire age ver­i­fi­ca­tion.

But if you read the rest of the bill, that dis­claimer starts to look hol­low.

Throughout the KOSA sec­tion of the leg­is­la­tion, spe­cial pro­tec­tions, con­trols, mes­sag­ing set­tings, and parental tools are re­quired when­ever a web­site or app “knows or should have known” a user is a child (defined in the bill as any­one un­der 13) or a teen (defined as any­one be­tween 13 and 16 years old).

The prob­lem is a web­site op­er­a­tor does­n’t need ac­tual knowl­edge that a user is a mi­nor to get in le­gal trou­ble. It ap­plies when a plat­form “knows or should have known” a user’s age—a low, neg­li­gence-style stan­dard of knowl­edge. If an on­line ser­vice gets it wrong, it’s go­ing to be up to courts and reg­u­la­tors to de­cide, af­ter the fact, if an on­line ser­vice “should” have known a user was 16.

To try to avoid li­a­bil­ity, ser­vices will have to de­ter­mine which users are teenagers and which are not. Most won’t be able to sim­ply trust their users. They’ll have to col­lect more in­for­ma­tion about age, be­fore any law­suit or gov­ern­ment ac­tion arises. Some com­pa­nies may re­spond by re­quest­ing dri­ver’s li­censes or pass­ports. Others will rely on age-es­ti­ma­tion sys­tems that at­tempt to guess users’ ages by look­ing at ex­ist­ing ac­tiv­ity or do­ing fa­cial scans. Existing es­ti­ma­tion sys­tems make mis­takes when es­ti­mat­ing chil­dren’s ages cor­rectly, which is a big prob­lem when that is the pop­u­la­tion KOSA is try­ing to pro­tect. And the sys­tems fail more fre­quently for peo­ple of color, peo­ple with dis­abil­i­ties, and trans and non­bi­nary peo­ple.

The bil­l’s au­thors seem to know this is a prob­lem. On the one hand, the new KOSA sec­tion says age ver­i­fi­ca­tion is not re­quired. On the other, it re­peat­edly im­poses oblig­a­tions that de­pend on know­ing whether a user is un­der 17. But a dis­claimer does­n’t mag­i­cally elim­i­nate le­gal risk, es­pe­cially for smaller ser­vices and star­tups that can’t af­ford to de­fend law­suits or fight reg­u­la­tors.

Take ac­tion

The “KIDS Act” Is an Age Surveillance Bill

KOSA is not the only part of this pack­age that cre­ates age-ver­i­fi­ca­tion pres­sure. The SAFE BOTS Act, like KOSA, goes back to the stan­dard that if a ser­vice “knows or should have known” that a user is a mi­nor it can’t of­fer cer­tain chat­bot fea­tures.

The SCREEN Act re­quires ser­vices that host sex­u­ally ex­plicit con­tent to de­ter­mine whether users are “more likely than not” un­der the rel­e­vant age limit, be­fore al­low­ing ac­cess to cer­tain con­tent.

The con­se­quences of this li­a­bil­ity will not be lim­ited to mi­nors. If web­sites and apps are ex­pected to re­li­ably iden­tify teenagers, adults will be asked to prove they are adults. The re­sult is a less pri­vate in­ter­net for every­one.

The KIDS Act Pressures Platforms To Police Lawful Speech

The new ver­sion of KOSA re­moves the bil­l’s in­fa­mous “duty of care” pro­vi­sion, a sig­nif­i­cant change. The re­vised KOSA re­quires cov­ered plat­forms to “establish, im­ple­ment, main­tain, and en­force” poli­cies and pro­ce­dures ad­dress­ing sev­eral cat­e­gories of con­tent and con­duct.

Some cat­e­gories, such as true threats and sex­ual ex­ploita­tion, in­volve un­law­ful ac­tiv­ity. Others are much broader. The bill specif­i­cally re­quires poli­cies ad­dress­ing the “sale or use” of nar­cotic drugs, to­bacco prod­ucts, cannabis prod­ucts, gam­bling, and al­co­hol. It also re­stricts dis­cus­sions around fi­nan­cial fraud.

Sounds straight­for­ward enough. Then you re­mem­ber how peo­ple ac­tu­ally talk—on­line and off. Can teens dis­cuss ad­dic­tion and re­cov­ery? Can a 15-year-old post that she’s wor­ried she has a friend who is drink­ing too much? Can they seek ad­vice about a par­en­t’s gam­bling prob­lem, or get help if they or a fam­ily mem­ber have been scammed? Can they par­tic­i­pate in harm-re­duc­tion com­mu­ni­ties or dis­cuss sub­stance abuse treat­ment? All of these young peo­ple would be en­gag­ing in law­ful speech when dis­cussing top­ics cov­ered by KOSA’s enu­mer­ated harms.

The bill does not di­rectly ban those con­ver­sa­tions. But it places plat­forms un­der huge pres­sure to cre­ate and en­force mod­er­a­tion poli­cies around broad cat­e­gories of law­ful speech. Faced with le­gal risk, many ser­vices will in­evitably choose to re­move that speech or re­strict those dis­cus­sions to spaces where they know only adults can par­tic­i­pate. We’ve seen this movie be­fore. When le­gal risk goes up, plat­forms will take down more speech.

The KIDS Act Regulates Private Messages, Too

Several pro­vi­sions of the bill cre­ate new rules around di­rect mes­sages, dis­ap­pear­ing or “ephemeral” mes­sages, and AI chat ser­vices.

The bill in­cludes lan­guage stat­ing that cer­tain KOSA re­quire­ments should not be con­strued to over­ride strong en­cryp­tion. But the pro­tec­tion is in­com­plete. The carve-out ap­plies to cer­tain fea­tures and mes­sag­ing con­trols, but does­n’t ap­ply to KOSA’s sep­a­rate re­quire­ment that plat­forms “address” a list of harms to mi­nors.

The KIDS Act never an­swers an ob­vi­ous ques­tion: how ex­actly is a plat­form sup­posed to ad­dress those ac­tiv­i­ties if they’re in­side en­crypted com­mu­ni­ca­tions that it can’t read? That will cre­ate pres­sure for providers to weaken pri­vate com­mu­ni­ca­tions or limit fea­tures on en­crypted pri­vate ser­vices.

That ap­proach is es­pe­cially trou­bling when it comes to ephemeral mes­sag­ing. Disappearing mes­sages are not a “loophole” or a dan­ger­ous de­sign trick. They are a use­ful pri­vacy fea­ture that al­lows on­line con­ver­sa­tions to func­tion more like or­di­nary real-world con­ver­sa­tions, which are not pre­served for­ever in a per­ma­nent data­base.

Like many other parts of the KIDS Act, these pri­vate mes­sag­ing pro­vi­sions also de­pend on web­sites and apps know­ing who is a mi­nor and who is not. The re­sult is more age checks, more re­stric­tions, and less pri­vacy on­line.

Take ac­tion

Tell con­gress: no on­line age check­points

“You can’t get a breath of fresh air … with­out us know­ing.”

bluestork/​Shut­ter­stock

Thanks to the rise of AI, a new kind of sur­veil­lance cam­era has rapidly pro­lif­er­ated across the United States. Typically re­ferred to as au­to­mated li­cense plate read­ers, or ALPRs, they’re most of­ten mounted along road­ways, where they log the move­ments of cars which pass through their field of vi­sion. Though var­i­ous com­pa­nies of­fer them, the most well known come from Flock Security, and the com­pany has con­se­quently been a light­ning rod for pub­lic opin­ion. Shocking ex­actly no­body, there has been wide­spread pub­lic back­lash to cam­eras that track every­one, whether or not they’ve been sus­pected of a crime.

Although Flock cam­eras are of­ten re­ferred to as li­cense plate read­ers, that’s re­duc­tive. Reading li­cense plates is their pri­mary task, but they can be used to track just about any­one or any­thing. Even with­out a li­cense plate, law en­force­ment of­fi­cers can search for things such as, hy­po­thet­i­cally, “green sedan with American flag bumper sticker,” or, “pickup truck with paint scratches on left side and dirt bike in truck bed.” Reducing Flock ALPRs to li­cense plate read­ers is a bit like call­ing your own eyes “Engadget ar­ti­cle read­ers” sim­ply be­cause that’s what you’re us­ing them for at this par­tic­u­lar mo­ment. The com­pany also of­fers AI sur­veil­lance cam­eras which do track in­di­vid­u­als.

The is­sues with Flock Safety cam­eras are well doc­u­mented: Flock has been plagued by se­cu­rity vul­ner­a­bil­i­ties, ram­pant mis­use by law en­force­ment of­fi­cers and AI mal­func­tions which land in­no­cent peo­ple in trou­ble with the law. And once Flock cam­eras take root in a city, weed­ing them out can be nearly im­pos­si­ble. There are now over 100,000 ALPRs in­stalled na­tion­wide, with the vast ma­jor­ity com­ing from Flock.

How do Flock cam­eras work, and what do they do?

Smith Collection/gado/Getty Images

Flock Security cam­eras are, like most smart de­vices, small com­put­ers. They run a mod­i­fied ver­sion of Android and wire­lessly trans­mit footage to a data­base, where it is cat­a­loged us­ing AI for searched nat­ural lan­guage searches by any­one with ac­cess to the sys­tem. Flock con­tracts with cities, towns, neigh­bor­hoods and busi­nesses.

In ad­di­tion to Flock’s in­fa­mous ALPRs, the com­pany also of­fers AI se­cu­rity cam­eras, mo­bile se­cu­rity trail­ers, and  — just in case you’re a creep look­ing to point an AI cam­era into some­one’s back­yard  — quad­copter drones. All of them op­er­ate on the same prin­ci­ples. Just type what you’re look­ing for, and the sys­tem will show footage of any­thing it thinks matches your de­scrip­tion. This makes AI pow­ered cam­eras like Flock’s dis­tinct from tra­di­tional sur­veil­lance or traf­fic cams, which re­quire some­one to man­u­ally look over footage in or­der to find a spe­cific ve­hi­cle or in­di­vid­ual.

The Flock net­work can be re­stricted to a con­tracted area, but many de­part­ments join a na­tion­wide net­work. As the ACLU of Massachusetts pointed out, po­lice as far away from the state as Texas can search its Flock footage. While Flock does not have a di­rect con­tract with fed­eral law en­force­ment agen­cies, Immigration and Customs Enforcement (ICE) and other Homeland Security agen­cies are of­ten granted ac­cess to the sys­tem through data shar­ing pro­grams with lo­cal po­lice de­part­ments (a prac­tice which be­gan be­fore Flock ar­rived on the scene). In Denver, the ACLU of Colorado ob­tained logs show­ing that lo­cal po­lice had con­ducted over 1,400 searches on ICE’s be­half as of August.

That’s not to say the cam­eras never prove use­ful for crime-solv­ing. Flock has helped to solve at least one mur­der case and to take down a ve­hi­cle smash-and-grab op­er­a­tion. But its AI-enhanced ca­pa­bil­i­ties track every­one, in­no­cent or not.

Flock cam­eras have been rid­dled with se­cu­rity flaws

Flock ve­he­mently in­sists that its cam­eras are se­cure. The truth is that Flock can­not seem to go very long with­out vul­ner­a­bil­i­ties be­com­ing ex­posed. Many of the most crit­i­cal ex­ploits have been dis­cov­ered by Benn Jordan, a mu­si­cian and YouTuber with no for­mal back­ground in cy­ber­se­cu­rity re­search.

In December 2025, Jordan found that at least 70 Flock Safety cam­eras were ex­posed to the Internet and could be ac­cessed through a com­mer­cial search en­gine. No pass­word was re­quired to view live footage of chil­dren at parks, cou­ples hav­ing in­ti­mate ar­gu­ments, and other mo­ments peo­ple did not know were sur­veilled. Many ex­posed cam­eras be­longed to Flock’s Condor cam­eras which track peo­ple, not ve­hi­cles. Jordan was even able to record Flock’s flip­pant re­sponse to his pre­vi­ous in­ves­ti­ga­tions onto a Flock Condor cam­era and then down­load the footage to in­clude in his video.

That came af­ter Jordan had al­ready ex­posed nu­mer­ous se­cu­rity holes in a November ex­pose, many of which could be ex­ploited with equally sopho­moric tech­niques. With phys­i­cal ac­cess to the out­door cam­eras, Jordan and re­searcher John Gaines were able to press a phys­i­cal but­ton and con­nect to the cam­era over Wi-Fi, de­bug it with ba­sic Android de­vel­op­ment tools, and gain root ac­cess  — even in­stalling mal­ware. There were also ex­posed USB ports vul­ner­a­ble to a ma­li­cious USB drive. There were too many other find­ings to list, but Jordan’s video is com­pre­hen­sive.

Most tech com­pa­nies in­vite in­for­ma­tion about crit­i­cal ex­ploits with bug bounty pro­grams, or at least by cred­it­ing in­de­pen­dent re­searchers. Flock Safety, by con­trast, has re­sponded by smear­ing se­cu­rity re­searchers in­clud­ing Jordan as “activist groups who want to de­fund the po­lice, weaken pub­lic safety, and nor­mal­ize law­less­ness.”

Cops have mis­used Flock cam­eras

Matthew G Eddy/Shutterstock

How in­tox­i­cat­ing must it be, as a po­lice of­fi­cer, to gain ac­cess to the Flock net­work? Like Batman to­ward the end of The Dark Knight, you would in­stantly be able to spy on any in­di­vid­ual, the en­tire city bar­ing up its se­crets to you with a few key­strokes. But un­like Batman, some po­lice have used Flock to ha­rass and stalk women, while Flock em­ploy­ees used footage of preschool­ers to sell more cam­eras. That’s be­cause there are very few guardrails, if any, to pre­vent abuse. A war­rant is rarely re­quired for a data­base search, and there’s no pa­per­work.

As re­ported this month by 404 Media, there have been dozens of doc­u­mented in­stances in which cops have abused Flock to track the where­abouts of ex-girl­friends, cur­rent part­ners, and other in­di­vid­u­als. In most cases, the stalk­ing was only dis­cov­ered when a vic­tim searched their plate in HaveIBeenFlocked or a sim­i­lar tool and dis­cov­ered their where­abouts had been searched hun­dreds of times. That may sound bad, but it’s worse than it sounds. Since the only known cases are those where the of­fend­ing of­fi­cer was caught and ar­rested or fired, the true scope of abuse is likely much larger. Flock told 404 Media that “15 in­ci­dents of abuse” had sur­faced be­cause of “the trans­parency and ac­count­abil­ity fea­tures” built into its plat­form, adding that its Audit Assistance tool “proactively flags un­in­tended use.”

There have been is­sues in­side of Flock it­self, too. One par­tic­u­larly shock­ing re­port from 404 Media found that Flock em­ploy­ees had been watch­ing chil­dren swim­ming in the pool and dur­ing gym­nas­tics classes at the Marcus Jewish Community Center of Atlanta, and even show­ing those cam­era feeds to po­lice de­part­ments as part of a sales demo. Flock re­sponded bel­liger­ently, writ­ing in part, “The em­ploy­ees be­ing named on­line are well-in­ten­tioned em­ploy­ees who ac­cessed a cam­era net­work with the city’s ex­plicit per­mis­sion, as part of their job. They are now be­ing called preda­tors for it.”

Flock cam­eras keep get­ting in­no­cent peo­ple in trou­ble

Kali9/Getty Images

We can look to just one of the many cities Flock op­er­ates in to see how its cam­eras cre­ate is­sues, even with­out ex­plicit abuse. In May of 2024, Denver, Colorado in­stalled 111 cam­eras across the city. The con­tract was re­newed in 2025 when Mayor Mike Johnston over­ruled a unan­i­mous city coun­cil vote against the ex­ten­sion.

One Denver woman, fi­nan­cial ad­vi­sor Chrisanna Elser, was stunned when Columbine po­lice of­fi­cer Sgt. Jamie Milliman knocked on her door and de­liv­ered a sum­mons for theft. According to Milliman, she’d been caught on cam­era steal­ing a pack­age from a front door. “You know we have cam­eras in that town. You can’t get a breath of fresh air in or out of that place with­out us know­ing,” the of­fi­cer can be heard say­ing in Ring door­bell footage from the September 2025 in­ci­dent. Elser was lucky. Her Rivian truck has cam­eras of its own, and she was able to de­liver footage from the day of the al­leged crime, prov­ing she had not stopped while dri­ving through the area from which the pack­age was stolen. The charges were even­tu­ally dropped.

Others haven’t been so lucky. Multiple Colorado dri­vers have been pulled over and treated as sus­pected crim­i­nals when Flock ALPRs mis­took a num­ber zero for a let­ter ‘O’, or vice versa. One dri­ver told the lo­cal 9News he feels his safety is at risk be­cause of­fi­cers are alerted every time a Flock cam­era sees his ve­hi­cle. Police claimed they were un­able to re­move him from their hotlist.

After wide­spread protest, in­clud­ing a packed town hall in October at­tended by city coun­cil mem­bers and na­tion­ally known pri­vacy ad­vo­cates, Denver can­celled its Flock con­tract… and awarded it to Axon, a com­pany which al­ready pro­vides body cam­eras to po­lice de­part­ments.

Why do cities keep giv­ing con­tracts to Flock?

Max Miller for Engadget

With so many alarm­ing is­sues around Flock Safety, it’s hard to un­der­stand why these AI sur­veil­lance cam­eras keep crop­ping up. There are a few rea­sons, rang­ing from cit­i­zen dis­en­fran­chise­ment to re­stric­tive Flock con­tracts.

While av­er­age cit­i­zens dis­like the tech­nol­ogy, es­pe­cially those from mar­gin­al­ized groups most likely to be tar­geted by AI sur­veil­lance, they of­ten have lit­tle to no say in the mat­ter. Flock mar­kets di­rectly to law en­force­ment, and if you’re a cop or pro-law-en­force­ment city of­fi­cial, it’s easy to see why blan­ket­ing your lo­cale in AI-powered cam­eras is a tan­ta­liz­ing prospect. Despite lit­tle ev­i­dence that Flock cam­eras ac­tu­ally re­duce crime, the com­pany mar­kets its prod­ucts as pow­er­ful crime-stop­ping and de­ter­rence tools.

In Denver, Mayor Johnston de­fended his de­ci­sion to re­tain Flock’s ser­vices by claim­ing in a 9News in­ter­view that the cam­eras had aided in solv­ing the mur­der of a trans­gen­der woman, Jax Gratton, whose body was found in the nearby town of Lakewood. The case had be­come a ral­ly­ing cry for LGBTQ safety in the Denver area. But the may­or’s claims were dou­bly false. Not only had Flock not as­sisted in the case, but no ar­rest had been made. Gratton’s mother pub­licly de­manded a forth­com­ing apol­ogy from the mayor.

Shooing Flock away is made more dif­fi­cult by its iron­clad con­tracts. When Dayton, Ohio and Evanston, Illinois wanted out of their Flock deals, they were un­sure whether re­mov­ing the cam­eras would con­sti­tute a breach of con­tract. Their so­lu­tion? Both cities cov­ered the Flock cam­eras with garbage bags. The only way to evoke a more heavy-handed metaphor would have been to cover them with lamp­shades.

To see whether any Flock cam­eras are lurk­ing near you, you can use the map cre­ated by DeFlock, an open-source tool track­ing the pro­lif­er­a­tion of ALPR cam­eras.

The temp­ta­tion to use ar­ti­fi­cial in­tel­li­gence (AI) to cheat is shak­ing up elite uni­ver­si­ties in the United States. Professor Roberto Serrano, who is the Harrison S. Kravis University Professor of Economics at Brown University, has de­tected a mas­sive fraud in one of the classes he teaches, ECON 1170, an ad­vanced un­der­grad­u­ate course in math­e­mat­i­cal eco­nom­ics. He has con­clu­sive ev­i­dence that at least 50 stu­dents cheated on the March midterm exam, mak­ing it the biggest known scan­dal at Brown and in the en­tire Ivy League, which brings to­gether the East Coast’s eight most elite pri­vate uni­ver­si­ties, in­clud­ing Princeton, Harvard, Yale, Columbia, Cornell, Dartmouth College and University of Pennsylvania.

When he re­ported the case to high-rank­ing of­fi­cials at Brown, he got a cold re­ac­tion. The re­sponse from the pres­i­dent, he said, was ab­solute si­lence. The dean did not com­ment ei­ther un­til Serrano took the case be­fore the Academic Code Committee. At that point, he re­ceived a note ac­knowl­edg­ing that what had hap­pened in his class­room was “a wake-up call.” Serrano, a Madrid-born econ­o­mist who has been at Brown for 34 years, be­lieves this is not enough. “That can­not be the uni­ver­si­ty’s po­si­tion be­fore an in­ci­dent of this mag­ni­tude. Academic in­tegrity is a value worth de­fend­ing. The fac­ulty can­not be left on its own in a bat­tle that is de­ci­sive if we want to pre­serve the fu­ture of higher ed­u­ca­tion,” ex­plains the 61-year-old pro­fes­sor in a tele­phone con­ver­sa­tion from Providence, Rhode Island. To pre­vent AI from end­ing the pres­tige and util­ity of teach­ing, he feels, it is nec­es­sary to adopt a dif­fer­ent ap­proach: “We need to pub­licly ad­mit the se­ri­ous­ness of the sit­u­a­tion and open up a broad de­bate about the real ex­tent of the prob­lem.”

Serrano is con­sid­ered one of the lead­ing pro­po­nents of ap­ply­ing game the­ory—the field that earned John Nash the 1994 Nobel Prize in Economics—to the analy­sis of mar­kets. After earn­ing a bach­e­lor’s de­gree in eco­nom­ics from Spain’s Universidad Complutense de Madrid, where he has been Doctor Honoris Causa since 2019, Serrano went on to ob­tain a PhD at Harvard and, af­ter com­plet­ing his stud­ies, re­ceived sev­eral job of­fers. Convinced that he wanted to de­vote his life to re­search and teach­ing, he ac­cepted a po­si­tion at Brown, where he re­mains to this day. He has been the re­cip­i­ent of sev­eral awards, in­clud­ing the King of Spain Prize for Economics in 2024.

At age 17, Serrano went blind. In a mat­ter of months, the reti­nal dy­s­tro­phy that had dogged him since he was lit­tle, but which still al­lowed him to read and play soc­cer, took away his sight en­tirely. After a short-lived cri­sis, he de­cided it would not stop him. He learned Braille, and his ex­cel­lent aca­d­e­mic record opened up the doors of Harvard. “Of course it af­fects my life, but one should­n’t over-dra­ma­tize. We econ­o­mists un­der­stand re­al­ity as a set of peo­ple re­spond­ing to op­ti­miza­tion prob­lems with re­stric­tions. I view my dis­ease sim­ply as one more re­stric­tion that I have to deal with, and I op­ti­mize based on that,” he says.

Serrano al­ways has an as­sis­tant in class to do the work on the white­board and han­dle the slides. Everything else, from prepar­ing the class ex­er­cises to tu­tor­ing, as well as writ­ing pa­pers and books, he does by him­self; re­cently these tasks have be­come eas­ier thanks to tech­no­log­i­cal progress.

This year, the econ­o­mist de­cided that both the midterm and the fi­nal ex­ams for his course would be of the take-home, closed-book type (there is a cer­tain tra­di­tion of this at Ivy League schools). “It’s a very nice kind of exam, be­cause as you’re giv­ing stu­dents prac­ti­cally un­lim­ited time to com­plete it, it lets you make it harder than nor­mal, to see how far they can go.” In this case, Serrano changed some of the model as­sump­tions they had seen in class, and asked stu­dents to demon­strate whether cer­tain state­ments were true or false un­der the new as­sump­tions.

The course, which he has been teach­ing for years, is not an easy one: it typ­i­cally at­tracts few stu­dents, but very good ones. He has never had more than 30 stu­dents en­rolled at a time, and on some oc­ca­sions he had only eight. This se­mes­ter, prob­a­bly be­cause of the new eval­u­a­tion sys­tem, 86 stu­dents signed up for the class. The re­sults of the midterm exam, which was ad­min­is­tered on March 5, were ex­tra­or­di­nary, with an av­er­age score of 96 out of 100. Forty stu­dents scored a per­fect 100. The peo­ple who cor­rected the ex­ams warned him about sev­eral ir­reg­u­lar­i­ties. “Some an­swers con­tained un­usual pas­sages that co­in­cided with re­sults ob­tained af­ter run­ning the ques­tions through ChatGPT,” he says.

Serrano did not void the midterm exam, but warned stu­dents that the fi­nal one, which counted for 50% of the fi­nal grade, would be held in-per­son. He also said that if the grade dis­tri­b­u­tion was not sim­i­lar to the midterm, only the fi­nal exam would be taken into ac­count. The av­er­age score dropped to 48 out of 100. Of the 89 stu­dents who did the midterm exam, only 59 showed up for the fi­nal one. And of the 27 who did not show up, 22 had scored a per­fect 100 in the midterm exam.

“The em­pir­i­cal ev­i­dence of fraud is over­whelm­ing,” says the pro­fes­sor, who has de­cided to make changes for the com­ing aca­d­e­mic year. First, the weekly ex­er­cises will not count to­wards the fi­nal grade, as these could be done with AI. Second, no more take-home ex­ams, no mat­ter how ap­pro­pri­ate they would be.

The shoot­ing that changed every­thing

Brown University made head­lines on December 13 of last year for rea­sons that were not strictly aca­d­e­mic. Neves Valentes, a 48-year-old for­mer PhD stu­dent, showed up on cam­pus with a gun in his hand and started fir­ing. Two peo­ple died and nine more sus­tained in­juries, in some cases se­ri­ous ones. “We were liv­ing in an apart­ment in down­town Providence, and that Saturday we started to see a lot of po­lice cars and am­bu­lances headed for the uni­ver­sity,” he re­calls. His phone soon started get­ting mes­sages. The shoot­ing took place in­side a class­room where a re­view ses­sion was un­der­way for Introduction to Economics, led by one of his col­leagues, Rachel Friedberg. These are ses­sions held to an­swer any ques­tions that might arise ahead of the fi­nal ex­ams. Two of the nine in­jured stu­dents were en­rolled in Serrano’s class. They fought for their lives for weeks, and hap­pily both sur­vived.

Two days later, on the 15th, when the names of the de­ceased were re­leased, he found out that one of the two fa­tal­i­ties was Ella Cook. The young woman had been to Serrano’s of­fice that very same week to in­tro­duce her­self. She had told him she was go­ing to en­roll in his Intermediate Microeconomics class that se­mes­ter, and asked if he could be her ca­reer ad­vi­sor for her joint con­cen­tra­tion in eco­nom­ics and math­e­mat­ics. “We chat­ted for quite a while. She was full of pro­jects, ideas and hope. She was very in­ter­ested in her stud­ies. When I found out, I could­n’t be­lieve it. I’ve been liv­ing in the U.S. for a long time, and I still can­not un­der­stand how this coun­try still up­holds the right to bear arms. There are cases like this one all the time, but you carry on with your life be­cause they don’t af­fect you per­son­ally. Until one does. And it hurts, it hurts a great deal.”

Serrano was af­fected. “I was in a re­ally bad place men­tally for a while. After what hap­pened, it oc­curred to me that that se­mes­ter, which was be­gin­ning a month and a bit af­ter the shoot­ing, ex­ams could be take-home in or­der to make life a lit­tle eas­ier for stu­dents. Many of them still feel anx­i­ety when they are on cam­pus be­cause of what hap­pened in December.”

But now Serrano wor­ries about the fact that some of his stu­dents de­cided to cheat. And that the uni­ver­sity would side with them, in part be­cause it gets gen­er­ous do­na­tions from very wealthy fam­i­lies whose chil­dren of­ten study there. “This means that the kids al­ways get the ben­e­fit of the doubt; I’ve seen it on other oc­ca­sions,” he notes. But it also hurts him that the one time in 34 years that he de­cided to of­fer a take-home exam, for highly jus­ti­fied rea­sons, the re­sponse was wide-scale fraud.

The temp­ta­tion of AI

Artificial in­tel­li­gence is al­ter­ing cen­tury-old tra­di­tions at America’s most elite uni­ver­si­ties. Princeton, for in­stance, has de­cided to end a prac­tice that had been up­held for 133 years: from now on, pro­fes­sors will proc­tor in-per­son ex­ams. This had­n’t been the case since 1893, when an Honor Code went into ef­fect by which all stu­dents pledged not to cheat: the teacher would hand over the exam, leave the room, and walk back in to pick up the tests at the end. If any­body cheated, it would be up to other stu­dents to re­port it.

But “A.I. has made de­cep­tion eas­ier and more re­mu­ner­a­tive than ever be­fore,” wrote the U.S. jour­nal­ist Theo Baker in a re­cent ar­ti­cle in The New York Times. “I don’t know a sin­gle per­son who has­n’t used A.I. to get through some as­sign­ment in col­lege.” The 22-year-old writer has just grad­u­ated from Stanford, where he started classes two months be­fore the first ver­sion of ChatGPT was re­leased. In his four years as a stu­dent, he has wit­nessed how his fel­low stu­dents have been un­able to re­sist the temp­ta­tion.

Serrano agrees that AI makes stu­dents have more in­cen­tives to cheat. That is why, he says, these cases can­not be swept un­der the rug. On the con­trary, they should serve to open up an in-depth de­bate. “If we no longer de­fend truth and de­cency and hon­esty, then what kind of cred­i­bil­ity are we go­ing to have as aca­d­e­mics?”

Sign up for our weekly newslet­ter to get more English-language news cov­er­age from EL PAÍS USA Edition

Warning

li­bre­pods.org is not an of­fi­cial web­site of the LibrePods pro­ject. It in­ac­cu­rately claims to be the of­fi­cial web­site of the pro­ject by claim­ing copy­rights and us­ing the LibrePods logo in the footer. And at the same time, they say that the pro­ject is not af­fil­i­ated with the LibrePods pro­ject or its de­vel­op­ers.

Please re­port any other such web­sites to me@kav­ish.xyz

What is LibrePods?

LibrePods al­lows you to use AirPods fea­tures that are ex­clu­sive to Apple de­vices. It im­ple­ments the pro­pri­etary pro­to­col used to ex­change data be­tween AirPods and Apple de­vices, en­abling fea­tures like chang­ing noise con­trol modes, fast ear de­tec­tion, ac­cu­rate bat­tery sta­tus, head ges­tures, con­ver­sa­tional aware­ness, and more on non-Ap­ple plat­forms.

Feature avail­abil­ity

Press speed

Press and Hold du­ra­tion

Noise Cancellation with sin­gle AirPod

Volume con­trol on swipe

Volume swipe speed

Press and Hold to cy­cle be­tween lis­ten­ing modes/​in­voke dig­i­tal as­sis­tant (invoking dig­i­tal as­sis­tant needs a re­cent firmware)

Configure call con­trols

Personalized vol­ume

Loud Sound Reduction (needs VendorID spoof­ing)

Microphone side

Pause me­dia when falling asleep (needs a re­cent firmware)

Enable Off lis­ten­ing mode to switch to Off

Find My

The fol­low­ing fea­tures re­lated to Find My are planned, but re­quire fur­ther RE and might need root on Android:

Add your AirPods to the Find My net­work

Play sound through charg­ing case to find it

Notify when leav­ing be­hind

Toggle case charg­ing sounds

Spatial Audio

The app does not cur­rently pro­vide head track­ing in­for­ma­tion to Android for the OS to per­form HRTF. This has not been ex­plored com­pletely, and it might need root.

Spatializing stereo sound is be­yond this pro­jec­t’s scope and will never be avail­able. Many OEMs have an im­ple­men­ta­tion of their own for this.

Heart Rate Monitoring (AirPods Pro 3 and later)

This is be­ing worked upon, check the #⁠reverse-engineering chan­nel on the LibrePods Discord server for more in­for­ma­tion. If it is ever im­ple­mented, it will most likely need root on Android.

High qual­ity two-way au­dio

On iOS/​iPa­dOS, you can con­tinue us­ing A2DP while AirPods send the au­dio stream from its mi­cro­phone over AACP.

Since this needs deeper in­te­gra­tion with au­dio on Android, it will most likely need root.

Installation

Android

Linux

VendorID Spoofing

Turns out, if you change the VendorID in DID Profile to that of Apple, you get ac­cess to sev­eral spe­cial fea­tures!

You can do this on Linux by edit­ing the DeviceID in /etc/bluetooth/main.conf. Add this line to the con­fig file DeviceID = blue­tooth:004C:0000:0000. For an­droid you can en­able the act as Apple de­vice set­ting in the ap­p’s set­tings (shown only when Xposed is avail­able and LibrePods mod­ule is en­abled).

Multi-device Connectivity

Upto two de­vices can be si­mul­ta­ne­ously con­nected to AirPods, for au­dio and con­trol both. Seamless con­nec­tion switch­ing. The same no­ti­fi­ca­tion shows up on Apple de­vice when Android takes over the AirPods as if it were an Apple de­vice (“Move to iPhone”). Android also shows a popup when the other de­vice takes over.

Accessibility Settings and Hearing Aid

Accessibility set­tings like cus­tomiz­ing trans­parency mode (amplification, bal­ance, tone, con­ver­sa­tion boost, and am­bi­ent noise re­duc­tion), and loud sound re­duc­tion can be con­fig­ured.

All hear­ing aid cus­tomiza­tions can be done from Android (linux soon), in­clud­ing set­ting the au­dio­gram re­sult. The app does­n’t pro­vide a way to take a hear­ing test be­cause it re­quires much more pre­ci­sion. It is much bet­ter to use an al­ready avail­able au­dio­gram re­sult.

Protocol and Reverse Engineering

Please re­fer to the Wireshark dis­sec­tor plu­gin by Nojus (@pabloaul) for more in­for­ma­tion on the pro­to­cols used: pabloaul/​ap­ple-wire­shark

The dis­sec­tor had not been used in LibrePods for most of the im­ple­men­ta­tion; I had re­verse en­gi­neered the pro­to­col my­self be­fore this dis­sec­tor was made. But many (future) fea­tures in­clud­ing two-way high qual­ity au­dio and spa­tial au­dio would not have been pos­si­ble with­out their RE ef­forts!

Use of AI

Android app

These parts of the app were com­pletely AI-generated:

Head Gestures - all of it, in­clud­ing logic and the UI

The off­set setup with r2+the xposed mod­ule (both ver­sions)

Troubleshooter and LogCollector

Rest every­thing- the back­ground ser­vice, the Bluetooth man­ager classes (AACP and ATT), the en­tire UI, even the small­est com­po­nents were writ­ten man­u­ally.

Some parts of the UI com­po­nents were bor­rowed from Kyant0′s demo app, which is li­censed un­der Apache License 2.0.

Linux (rewrite)

The aacp.rs and the att.rs files were trans­lated from Kotlin to Rust with AI. Some parts of the me­di­a_­con­troller.rs file, mainly the pulse in­te­gra­tion, was also AI-generated.

Supporters

A huge thank you to every­one sup­port­ing the pro­ject!

Special Thanks

@tyalie for mak­ing the first doc­u­men­ta­tion on the pro­to­col! (tyalie/AAP-Protocol-Definition)

@rithvikvibhu and folks over at la­grange­point for help­ing with the hear­ing aid fea­ture (gist)

@devnoname120 for help­ing with the first root patch

@timgromeyer for mak­ing the first ver­sion of the linux app

@hackclub for host­ing High Seas and Low Skies!

Of course, every­one who has con­tributed to the pro­ject in any way, in­clud­ing by test­ing, shar­ing feed­back, or just show­ing in­ter­est!

Alternates for other plat­forms:

CAPod - A com­pan­ion app for AirPods on Android. (play store | source code). Use this if you’re us­ing Android ver­sion 16 QPR3 or be­low and are not rooted.

MagicPods for Steam Deck (website)

MagicPods - if you’re look­ing for “LibrePods for Windows” (ms store in­staller | web­site)

Star History

License

LibrePods - AirPods lib­er­ated from Apple’s ecosys­tem Copyright (C) 2025 LibrePods con­trib­u­tors

This pro­gram is free soft­ware: you can re­dis­trib­ute it and/​or mod­ify it un­der the terms of the GNU General Public License as pub­lished by the Free Software Foundation, ei­ther ver­sion 3 of the License, or any later ver­sion.

This pro­gram is dis­trib­uted in the hope that it will be use­ful, but WITHOUT ANY WARRANTY; with­out even the im­plied war­ranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more de­tails.

You should have re­ceived a copy of the GNU General Public License along with this pro­gram. If not, see https://​www.gnu.org/​li­censes/.

Trademark Notice

The GPL does not grant any rights to use the LibrePods name, logo, or brand­ing. The LibrePods name and logo may not be used for soft­ware, web­sites, do­mains, prod­ucts, ser­vices, or other pro­jects in a man­ner that sug­gests af­fil­i­a­tion with, en­dorse­ment by, or as­so­ci­a­tion with the of­fi­cial LibrePods pro­ject with­out prior per­mis­sion.

If you see any mis­use of the LibrePods name or logo, please re­port it to me@kav­ish.xyz.

The SF Pro font used in the Android app is the prop­erty of Apple Inc.. This will be re­moved in fu­ture ver­sions of the app and re­placed with an open al­ter­na­tive soon.

AirPods, AirPods Pro, AirPods Max, and the AirPods logo are trade­marks of Apple Inc. The LibrePods pro­ject is not af­fil­i­ated with or en­dorsed by Apple Inc. in any way.

By

Paula Wethington

Web Producer

Paula Wethington is a dig­i­tal pro­ducer at CBS Detroit. She pre­vi­ously held dig­i­tal con­tent roles at NEWSnet, Gannett/USA Today net­work and The Monroe News in Michigan. She is a grad­u­ate of the University of South Carolina.

Read Full Bio

June 24, 2026 / 2:03 PM EDT / CBS Detroit

Add CBS News on Google

A bill is pend­ing in the Michigan Legislature that would set rules on when and for what rea­son an em­ployer could con­tact an em­ployee out­side of a nor­mal work sched­ule.

Senate Bill 948, which was in­tro­duced by Sen. Erika Geiss, D-Taylor, has been re­ferred to the Labor Committee. The bill is also known as the Workplace Employee Boundaries Act.

“In an in­creas­ingly ‘always-on, al­ways avail­able’ econ­omy, we must take ac­tion to pro­tect work­ers and cre­ate stronger bound­aries,” Geiss said when in­tro­duc­ing the bill. “Too many work­ers are ex­pected to be con­stantly avail­able, an­swer­ing emails, mes­sages, and calls long af­ter their work­day ends. That pres­sure erodes well-be­ing, un­der­mines fam­ily life, and dis­pro­por­tion­ately im­pacts work­ing par­ents and care­givers. It is a mat­ter of fair­ness, dig­nity, and ba­sic re­spect.”

A bill analy­sis dated June 18 ex­plains that an em­ployee could be com­pen­sated in their con­tract for on-call avail­abil­ity. Another op­tion is that the em­ployee could set hours of avail­abil­ity, dur­ing which they would be able to ac­cess and re­spond to work-re­lated mat­ters.

Messages re­gard­ing a state or fed­eral emer­gency that af­fected busi­ness op­er­a­tions also would be al­lowed.

But in gen­eral, should this bill be­come law in Michigan, an em­ployer could not re­quire an em­ployee to ac­cess or re­spond to work-re­lated mat­ters out­side of their as­signed hours. This in­cludes emails, text mes­sages or so­cial me­dia mes­sages re­gard­ing em­ploy­ment du­ties or sched­ul­ing fu­ture work shifts, the bill analy­sis ex­plains.

Violations could be re­ported to the state’s Department of Labor and Economic Opportunity, with fines to the com­pany and/​or over­time pay to the em­ployee among the pos­si­ble re­sults.

The po­ten­tial costs, ac­cord­ing to the bill analy­sis, in­clude the ad­min­is­tra­tive work re­quired by the Department of Labor and Economic Opportunity to cre­ate train­ing ma­te­ri­als and process any com­plaints that may be filed.

In:

Employment

Michigan

Historic and cur­rent mem­ory and stor­age prices, col­lected in the spirit of John C. McCallum’s clas­sic mem­ory-price dataset — in­ter­ac­tive, with the raw data down­load­able. Hover for de­tails, click the leg­end to tog­gle se­ries, drag or use the slider to zoom, and use the cam­era icon to ex­port an im­age.

Price per gi­ga­byte over time

Historical low­est $/GB on a log scale — one line per mem­ory type: DRAM, NAND flash, and HBM.

DRAM price by gen­er­a­tion

The DRAM line above, bro­ken out by gen­er­a­tion across the full his­tory — Pre-DDR (SDRAM/core), DDR, DDR2, DDR3, DDR4, DDR5. (Generation is in­ferred from prod­uct de­scrip­tions, so older points are ap­prox­i­mate.)

Accelerator cost break­down

Modeled es­ti­mates from Epoch AI: quar­terly ac­cel­er­a­tor cost across the four largest AI-accelerator de­sign­ers — Nvidia, AMD, Google (TPU) and Amazon (Trainium) — stacked by com­po­nent (HBM, logic die, pack­ag­ing/​CoWoS, aux­il­iary), a pro­duc­tion-vol­ume-weighted av­er­age.

HBM price by gen­er­a­tion

By HBM gen­er­a­tion (HBM2e → HBM3 → HBM3e → HBM4). HBM is sold only to ac­cel­er­a­tor mak­ers on con­fi­den­tial con­tracts — there is no pub­lic spot mar­ket — so these are sparse in­dus­try-an­a­lyst es­ti­mates (TrendForce / SemiAnalysis), not trans­ac­tion prices. HBM4 is pro­jected (launches Q3 2026). $/TBps is cost per unit of mem­ory band­width (stack price ÷ per-stack band­width).

Sources and method

Caveats

$/GB is the cheap­est re­tail price in nom­i­nal USD — not con­tract, av­er­age, or in­fla­tion-ad­justed, and re­tail lags con­tract pric­ing.

The cheap­est list­ing of­ten tracks an end-of-life gen­er­a­tion be­ing cleared out, not the lead­ing edge — the per-gen­er­a­tion chart shows this.

These are cheap­est listed prices over time (via Keepa), not con­firmed sales. For the SSD data, ob­vi­ous post­ing er­rors are re­moved — any month a drive is listed more than 60% be­low its own typ­i­cal price (e.g. a $130 SSD shown at $4) is dropped.

The DRAM line splices two sources at mid-2024 (McCallum → Keepa); a small step there is ex­pected, since Amazon’s cheap­est clear­ance can sit be­low McCallum’s rep­re­sen­ta­tive low.

HBM fig­ures are mod­eled es­ti­mates (cost share and spend), not mea­sured prices.

Updates

DRAM and NAND $/GB re­fresh monthly from Keepa; HBM up­dates quar­terly (Epoch AI). The McCallum back­bone and HBM es­ti­mates are fixed. The down­load­able CSV lists every point with its source.

About

Compiled and main­tained by David Shim, Stanford DAM pro­ject. Questions or cor­rec­tions: hsshim@stan­ford.edu.

00:00