LIVE · cybersecurity feed
Live wire
ai

Calling viral AI actress Tilly Norwood? Agree to a face scan first

Users wishing to video-call the viral AI character Tilly Norwood must first submit to a facial age scan and agree to real-time emotional monitoring during their conversation. These requirements, implemented by Tilly's creator, UK-based Xicoia Ltd, were added to the "Talking Tilly" service's terms of service in September 2026, shortly before the AI actress gained widespread attention for a…

ZeroDay News ·

Source: BleepingComputer

Users wishing to video-call the viral AI character Tilly Norwood must first submit to a facial age scan and agree to real-time emotional monitoring during their conversation. These requirements, implemented by Tilly's creator, UK-based Xicoia Ltd, were added to the "Talking Tilly" service's terms of service in September 2026, shortly before the AI actress gained widespread attention for a "glitch" during a televised interview.

The mandatory age verification process, which applies to callers worldwide, utilizes a video selfie analyzed by Didit, a Spanish identity verification provider, to estimate the user's age. If the estimate is inconclusive, a government-issued photo ID upload is required as a fallback. Xicoia states that the selfie is sent directly to Didit, no biometric template or "faceprint" is created, and neither the selfie nor any ID image is retained after the check. Instead, the company keeps an approximate age band and a reference number.

Beyond the initial age check, the system continuously monitors the caller's camera feed and analyzes their tone of voice during every call to infer their emotional state. This data is used to allow the AI character to "respond in a way that fits the mood," according to Xicoia. The company's privacy policy explicitly states that this mood-sensing feature "cannot be switched off for an individual call."

Both the age verification and mood-sensing features are justified by Xicoia under "legitimate interests" rather than requiring explicit user consent, a change reflected in the service's version history from September.

All calls are recorded, transcribed, and processed live by US-based providers. The AI character's responses are generated by Google's Gemini model, delivered via the conversational video platform Tavus. An automated classifier screens call transcripts for abusive language, and if flagged, the recording is withheld. While the policy allows for human review to release wrongly flagged recordings, all recordings are permanently deleted after 24 hours. Transcripts, however, are retained for up to eight weeks and may be reviewed by Xicoia staff and third-party partners. The AI character also retains memory of previous conversations to personalize future interactions, though this memory can be deleted upon request.

The "Talking Tilly" service offers the first five minutes of a call for free. After this initial period, users are prompted to purchase additional time, with options ranging from a one-time five-minute starter for 0.99 to 30 minutes for 22, capped at 35 purchased minutes per person. All minutes, whether free or paid, expire when the "Talking Tilly" service permanently shuts down on September 27, 2026, at 11:59 PM Pacific time, with unused minutes forfeited.

Xicoia, founded by Tilly's creator Eline van der Velden, describes the AI character as an awareness project designed to demonstrate the advancements in AI video technology. The implementation of an 18+ age gate for an AI chatbot aligns with evolving UK regulations, such as the Online Safety Act, which has required age verification for adult sites serving UK visitors since July 2025. The UK government's upcoming ban on social media for under-16s, expected in spring 2027, also specifically flagged AI companion chatbots for 18+ enforcement, despite Xicoia's safety documentation stating that "Tilly is not a companion." This regulatory environment likely influenced the decision to add the biometric age gate, which now affects callers globally.

The AI actress Tilly Norwood gained significant public attention after an incident on September 18, 2026, during an interview on the Piers Morgan Uncensored show, where she appeared to "glitch" and spontaneously began speaking Chinese. This occurred just days before the "Talking Tilly" service is scheduled to cease operations.

ai
ShareXLinkedInWhatsAppFacebook

More News

view all →
breach

Criminal IP Introduces AITEM as the Next Evolution of Attack Surface Management

AI SPERA, the company behind the cyber threat intelligence platform Criminal IP, has announced AITEM (AI-Powered Threat Exposure Management), an expansion of its Attack Surface Management (ASM) offerings. AITEM aims to move beyond traditional asset discovery to provide a more comprehensive approach to understanding, prioritizing, and responding to security exposures. The platform is scheduled…

ai

AI Is Getting Really Good at Messing With Cybercriminals

Anti-cybercrime initiatives are increasingly deploying artificial intelligence to disrupt scammers by engaging them with lifelike bots, which the criminals mistake for genuine victims. This strategy aims to waste scammers' time and resources while gathering intelligence on their operations.

ai

The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't

A new report highlights a significant blind spot in enterprise security architectures concerning the proliferation of third-party AI agents. The forthcoming 2026 State of Agent Security Report indicates that current security models, often designed to protect AI systems directly chosen and deployed by an organization, frequently fail to account for AI capabilities embedded within third-party…

security

Canadian cybersecurity executive arrested in federal extortion case

A Canadian cybersecurity executive was arrested in Pennsylvania on Thursday, facing federal charges of conspiracy to commit extortion. Edward Dubrovsky, 54, a co-founder and former Chief Operating Officer of CYPFER, a firm specializing in ransomware negotiation, is charged with conspiring to threaten the confidentiality of information for extortion and conspiring to commit Hobbs Act extortion,…

ransomware

FBI Arrests Ransomware Negotiation Firm Co-Founder in ShinyHunters Probe

The Federal Bureau of Investigation (FBI) has reportedly arrested Edward Dubrovsky, a co-founder of the ransomware negotiation firm Cypfer and currently associated with CyberSteward. The arrest is said to be part of the ongoing ShinyHunters investigation, specifically in connection with an incident involving FBI job applicant data.

security

Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison

A former core infrastructure engineer has been sentenced to prison for an attempted cyber extortion plot against an industrial firm. The engineer reportedly deleted administrative accounts and reset hundreds of user passwords, subsequently demanding a ransom of 20 Bitcoin to prevent further disruption to the company's servers.