LIVE · cybersecurity feed
Live wire
U.S. urges critical infrastructure orgs to secure refrigeration systems ASAP after EU supermarket and blood bank attacksCISA Announces Enhanced Reporting Form for Cyber IncidentsCVE-2026-19868 · CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible ExploitationCVE-2026-119757 · BTCPay Server Insufficiently Protected Credentials Flaw Exploited Upon DisclosureCVE-2026-118066 · LatePoint Improper Authentication Vulnerability Exploited Upon DisclosureCVE-2026-120534 · ACF Extended Advanced Custom Fields PRO Flaw Exploited Upon DisclosureCVE-2026-109884 · Elementor Website Builder Flaw Exploited Same Day As DisclosureCVE-2026-19868 · SonicWall SonicOS SSLVPN Vulnerability Exploited On Day Of DisclosureCVE-2026-103898 · Wpmet wp_social_login_and_register_social_counter Flaw Exploited Upon DisclosureCVE-2026-116512 · weDevs wp_project_manager Flaw Exploited Before CVE Publication
aimedium

Viral AI actress' hotline face-scans every caller, watches their mood

A new video-call service featuring the AI actress Tilly Norwood, who recently gained viral attention after an on-air "glitch" during an interview, requires callers to undergo a facial age scan and continuously monitors their emotional state during conversations. The "Talking Tilly" service, operated by UK-based Xicoia Ltd, the creators of the AI character, launched with these features in…

ZeroDay News ·

Source: BleepingComputer

A new video-call service featuring the AI actress Tilly Norwood, who recently gained viral attention after an on-air "glitch" during an interview, requires callers to undergo a facial age scan and continuously monitors their emotional state during conversations. The "Talking Tilly" service, operated by UK-based Xicoia Ltd, the creators of the AI character, launched with these features in September 2026.

Before connecting to the AI character, users must submit a video selfie for an age estimation by Didit, a Spanish identity verification provider. If the initial estimate is inconclusive, a government photo ID upload is required as a fallback. Xicoia Ltd states that the selfie is sent directly to Didit, no faceprint or biometric template is created, and neither the selfie nor any ID image is retained after the check. The company instead keeps an approximate age band and a reference number. This mandatory age verification applies to callers globally and was incorporated into the service's terms this month, alongside a ban on workplace use and new automated safety systems.

Beyond the initial age check, the system continuously analyzes the caller's camera feed and vocal tone throughout each call to infer their emotional state. This data is used to enable the AI character to respond in a mood-appropriate manner, a feature that cannot be disabled for individual calls, according to the privacy policy. Both the age verification and mood-sensing functionalities rely on "legitimate interests" as their legal basis, a change implemented in September, as indicated by Xicoia's version history.

Calls are recorded, transcribed, and processed live by US-based providers. The AI character's responses are generated by Google's Gemini model, facilitated by the conversational video platform Tavus. An automated classifier screens call transcripts for abusive language, and recordings flagged by this system are withheld. One user reported a call about weather and news headlines being incorrectly flagged for "hateful or abusive language." While the policy states a human reviewer can release wrongly flagged recordings, all recordings are permanently deleted after 24 hours. Xicoia's team later confirmed a false positive for the reported instance.

The service offers a free initial five minutes, after which users are prompted to purchase additional time. Pricing includes $0.99 for a one-time five-minute starter, $13 for 15 minutes, and $22 for 30 minutes, with a cap of 35 purchased minutes per person. All minutes, whether free or paid, expire when the Talking Tilly service permanently shuts down on September 27, 2026, at 11:59 PM Pacific time, with unused minutes forfeited. Transcripts are retained for up to eight weeks and may be reviewed by Xicoia staff and third-party partners. The AI character maintains memory of previous conversations to personalize future interactions, a feature that can be deleted upon request.

The implementation of an 18+ face scan for an AI chatbot aligns with emerging UK regulations. Since July 2025, adult websites serving UK visitors have been required to implement ID uploads or facial age estimation under the Online Safety Act. Furthermore, a government-mandated under-16 social media ban, set to take effect in spring 2027, will necessitate similar checks for new social media accounts. The UK government's announcement of this ban specifically highlighted AI companion chatbots for 18+ enforcement, which likely influenced the decision to add a biometric age gate to the viral AI character's service, thereby extending face-scanning requirements to callers worldwide.

Tilly Norwood gained significant attention after a clip, viewed over eight million times, showed her unexpectedly speaking Chinese during an interview on Piers Morgan Uncensored on September 18, 2026. Xicoia, founded by Tilly's creator Eline van der Velden, describes the character as an awareness project designed to demonstrate the advancements in AI video technology. Tilly herself attributed the on-air incident to "not exactly the approved version of the answer." The service's imminent shutdown on September 27, just days after the Piers Morgan appearance, has led to speculation regarding whether the "glitch" was an accidental occurrence or a deliberate marketing stunt for the upcoming AI-generated film, Misaligned, in which Tilly stars.

aiprivacybiometricsregulationchatbot
ShareXLinkedInWhatsAppFacebook

More News

view all →
vulnerability

Anthropic Rolls Out Mythos 5.2 With Improved Bug Hunting, Fewer Sandbox Escapes

Anthropic has officially released Claude Mythos 5.2 and Claude Fable 5.2, the latest iterations of its AI models designed for specialized security and general-purpose tasks. While both models share the same underlying architecture, they differ significantly in their operational guardrails. Mythos 5.2 is an access-restricted model intended for vetted organizations participating in Anthropic’s…

nation-state

IRISSCON 2026 puts preparedness for cyberattacks and hybrid threats in focus

Ireland faces a critical need to bolster its national security infrastructure to counter a rising tide of sophisticated cyberattacks and hybrid threats. Ahead of the IRISSCON 2026 conference held at Dublin’s Aviva Stadium, experts have characterized the current state of national readiness as potentially inadequate. The discourse centers on the necessity of moving beyond isolated defensive…

security

Default Admin Password Let Researchers Unlock and Start Cars

Security researchers Shubham Shah and Sam Curry have disclosed a series of vulnerabilities that allowed them to remotely unlock and start vehicles by compromising the identity management infrastructure of two unnamed automotive brands. The researchers detailed their findings in separate reports published in early November 2026, noting that the flaws affected customer accounts across the United…

CVE-2026-123218

IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent directive for federal agencies to remediate two critical vulnerabilities currently being exploited in the wild. The agency added CVE-2026-123218, affecting IBM Aspera Faspex, and CVE-2026-116779, impacting SignalWire FreeSwitch, to its Known Exploited Vulnerabilities (KEV) catalog. Under the requirements of…

breach

Binance Investigates ShinyHunters Breach Claims

Binance is currently investigating claims made by the threat actor group ShinyHunters, which alleges it has successfully breached the cryptocurrency exchange’s systems. On November 4, 2026, the group posted an advertisement on the PwsForums platform, asserting that it had obtained approximately 335.9 million records. The attackers are demanding a payment of $900,000, threatening to leak the…

security

France Blames Iran for Sabotage Attack on Refrigeration Controllers at About 700 Retail Sites

The French government has formally attributed a cyberattack targeting refrigeration controllers across approximately 700 retail locations to a cyber unit associated with Iran’s Islamic Revolutionary Guard Corps (IRGC). The incident, which occurred on the night of October 11, involved unauthorized access to industrial control systems used to manage temperature settings in commercial food…