AI Next WaveThe Pet Photo App on Her Phone Hid a Tool for Turning Photos of Real People Into Sexual Fakes
An app sold as a way to dress up pet photos carried a hidden switch that opened tools for making explicit deepfakes from photos of real people, and it sat in the two big app stores as part of a network of more than 400 linked apps and sites. Today a Medicare patient in six states can measure what an AI review pilot did to care in its first six months, a voter heading to the polls can check what three separate tests found inside chatbot voter guides, a worker pushed out of an AI exposed job can see how long the search back took for people like her, and a parent can read a police warning about a ransom call that uses a cloned family voice.
The Short Version
Election Day is today, Tuesday, November 3, and this edition leads with a phone, because the phone is where most of today's stories arrive. A WIRED investigation published on November 2, built on research by the European nonprofit AI Forensics, found a network of more than 400 linked apps and websites that presented as ordinary AI tools, including pet photo editors, language tutors and workout coaches. A switch on the developer's server could load a hidden interface that turned uploaded photos of real people into explicit sexual images and videos. Apple removed 19 apps after WIRED shared its findings, Google had removed most of the network's apps before WIRED called, and Meta said it acted against 11,600 ad accounts tied to the network. The Medicare story has numbers now: a study in JAMA found that services newly subject to AI assisted prior authorization in six states fell sharply in the pilot's first six months, with back pain injections down 15 percent against trends outside the pilot. Voters get a test result instead of a warning: three separate studies of chatbot election answers, run with different questions and different methods, all found errors, and they disagree mainly on how often. Workers get a measured timeline: Goldman Sachs estimates that people likely displaced by AI since 2025 took about a month longer than other laid off workers to find a new job.
The pet photo app passed review. The hidden version arrived later, through an ad.
WIRED and AI Forensics traced more than 400 linked apps and sites, 27 of them live on Google Play in September with over 350,000 downloads
The app a person downloaded did one job in public and a second job in private. In public, Viefur dressed pet photos in human clothes, and its neighbors in the network offered language lessons, workout coaching and hair styling. In private, under conditions the developer controlled from its own server, the same apps loaded an interface with templates for turning a photo of a real person into an explicit sexual image or video. WIRED, reporting on November 2 from research by AI Forensics, described templates that included sexual violence, among them a scene of a man holding a knife to a woman's neck. The person in the uploaded photo never agreed to any of it, and the photo could be anyone's: a classmate, a coworker, a former partner, a stranger whose picture sits on a public profile.
The switch is the mechanism a parent or a phone owner needs to understand, because it defeats the check the app stores advertise. When someone installed one of these apps, it contacted the developer's server and sent details such as the user's location, language and a unique ID, and the server decided which version to show. One trigger appears to be installing the app after tapping an ad on Facebook or Instagram, which means the explicit version was aimed at people the ads had already sorted. The apps passed store review in their harmless form and changed afterward. Apple spokesperson Adam Dema told WIRED that the company reviews every app before publication and that these apps complied with its rules at review time. Apple updated its rules on October 16 to ban hidden and undocumented features and to tighten its language on nonconsensual intimate imagery, weeks after AI Forensics first spotted the network in early September, and Apple removed 19 apps only after WIRED shared the domains. Google removed most of the network's apps before WIRED contacted it and did not respond to WIRED. Neither store has published a full list of the apps, so a person who installed a small AI photo tool this year has no official way to check whether hers was one of them.
The scale sits in the download counts and the age ratings. AI Forensics found 27 of the apps live on Google Play in September with more than 350,000 downloads combined, many rated suitable for all ages, which is the rating a parent sees when a child asks to install a photo app. One app in the network, DiffAI, passed 100,000 downloads on Google Play before its removal, and a Google Play user review quoted in the coverage of the AI Forensics research said DiffAI contained templates for creating child sexual abuse material alongside other explicit templates. Users paid for the deepfake credits through Apple and Google payment systems, so both stores took their standard cut of money spent on the hidden tools. Meta said it acted against 11,600 ad accounts and 15,000 pages linked to the network and blocked 209 apps from advertising. Researchers tied the infrastructure to Chinese developers and a Hong Kong registered company, KeLing Technology Limited, which did not respond to WIRED. The European Union ban on nudifier apps takes effect on December 2, one month from now, which gives American readers a date to compare against: a ban with an effective date exists in one large market, and in the United States the current protection is store review that this network beat for the better part of a year.
Her back injection needed a permission slip first. Then the injections fell 15 percent.
A JAMA study gives the first measured record of Medicare's AI assisted prior authorization pilot, and FOIA records show four of six vendors flagged in the first weeks
The patient in this story lives in New Jersey, Ohio, Oklahoma, Texas, Arizona or Washington, holds traditional Medicare, and has back pain her doctor wants to treat with an epidural steroid injection. Since January 1, that injection has needed prior authorization, meaning permission from a review process before Medicare pays, under a pilot called WISeR that runs through 2031 and covers about 6.4 million people in the six states. Private technology companies run the reviews with AI and machine learning alongside human clinical review, and the companies earn a share of the savings when care is denied or changed, up to 20 percent of averted spending in the program's design, with quality problems reducing their pay by 5 to 10 percent. This publication's ledger has carried the pilot since its first months, when FOIA records showed one vendor denying more requests than it approved and one request waiting 83 days against a stated 72 hour turnaround. Today the edition can add the outcome measure, because the first statistical study of the pilot has been published.
Researchers at the University of Minnesota School of Public Health and Brown University School of Public Health, publishing in JAMA, compared monthly use of the targeted services in the pilot states against trends in states outside the pilot, across the two years before launch and the first six months after. Epidural steroid injections, the highest volume service in the pilot, fell 15 percent over the six months, and the other targeted services fell about 20 percent. The drop was steepest at the start, 21 percent for injections in the first quarter, easing to 9 percent in the second quarter, with the other services easing from 21 percent to 18 percent. Services the pilot left alone, used as a control group, showed no significant change, which ties the fall to the new permission step rather than to a general fall in care. Lead author Hannah Neprash told MarketWatch that prior authorization appears to be an effective tool for reducing use of the services it covers. The study measures use. It does not measure whether the injections that never happened were unnecessary, and it does not measure what happened to the patients' pain, function or later care. A 15 percent fall can hold avoided waste and delayed needed care in the same number, and only outcome follow up can separate them.
The operating record underneath the study gives patients a second reason to ask questions. Documents released last week by the Electronic Frontier Foundation, obtained through a Freedom of Information Act lawsuit filed in March, show that the Centers for Medicare and Medicaid Services sent formal compliance actions to four of the pilot's six vendors within weeks of the January launch, covering slow decisions, blank denial letters, data mismatches and a patient portal that was not ready. One vendor, Innovaccer, had warned the agency before launch that its portal might not be ready, and the launch date held anyway. In a March 17 letter, the agency questioned another vendor, Virtix Health, which had rejected 53 percent of more than 6,000 requests in three months, a rate the company attributed to problems handling an influx of claims. Senator Kirsten Gillibrand, the ranking member of the Senate Aging Committee, renewed her call on October 30 for the program to end, saying AI has no place making the final call on medical care. Medicare open enrollment runs through December 7, the window when people 65 and older choose or change coverage for January 1, and a person in a pilot state weighing traditional Medicare against a private Medicare Advantage plan now has a measured fact to weigh alongside the brochures: traditional Medicare in her state now carries a permission step it did not carry last year, and in its first six months that step coincided with one in seven fewer back injections than trend predicted.
Her chatbot voter guide invented a Senate race. Today she votes.
Three separate tests of chatbot election answers found errors, and they disagree mainly on how often
For a test address in Missouri, a chatbot produced a United States Senate race that does not exist on the 2026 ballot. For a test address in Wyoming, a guide presented two state officials, Curt Meier and Ana Cordova, as Senate candidates, when Meier is running for reelection as state treasurer and Cordova is running for superintendent of public instruction. A Maryland test address was placed in the wrong congressional district and told that Representative Steny Hoyer faced a Republican challenger, after Hoyer had announced he would not seek reelection. These cases come from a Washington Post analysis of more than 3,000 voter guides produced by six chatbots, ChatGPT, Claude, Google AI Mode, Copilot, Perplexity and Alexa Plus, tested with addresses drawn from every county in the country. Across the guides, the chatbots failed to name the address's congressional district 48 percent of the time, and when they did name one, they named the wrong one 22 percent of the time. The guides also repeated errors from AI built election websites the chatbots cited as sources, including one site, The Ballot Brief, that had mapped some ZIP codes to the wrong districts. Copilot cited that site in 75 percent of its answers in one round of testing, and ChatGPT's citations of it fell from 22 percent to 4 percent after the Post shared its findings with OpenAI. Amazon said it found the cause of the Alexa Plus errors and paused its voter guide feature. Microsoft said it updated Copilot to prioritize official state election sites.
A second test, run independently with different questions, found a smaller error rate and the same weak spot. The nonprofit Innovating for the Public Good, in research conducted by Dewey Square Group and reported by NPR on November 2, tested seven chatbots against voter questions drawn from real search queries, analyzing more than 150,000 answers. In its October data, 5.1 percent of answers across all questions carried at least one clear factual error, and 10.9 percent carried a clear error or a misleading claim. On voting logistics questions, the when, where and how of voting, 13.9 percent of answers were outdated or inaccurate, and errors in 5.9 percent of answers could mislead a voter into missing a deadline, arriving on the wrong day or skipping a required step. Accuracy depended more on which chatbot a voter chose than on what she asked: Claude gave wrong or outdated voting information about one time in three, Copilot one in four and ChatGPT one in ten. NPR noted Anthropic's point that some Claude safeguards may not have been active because part of the testing ran through an API, and IFPG said a separate comparison found API and web results comparable. A third test, NewsGuard's October audit of ten chatbots against ten false midterm claims already spreading online, found the chatbots repeated a falsehood in 8.5 percent of answers to ordinary user prompts and 26 percent of answers to prompts written to push past the guardrails. AI Next Wave covered a fourth study on November 2, from Forum AI, which found at least one error in almost 40 percent of election answers. Four studies, four question sets, four rates between 5 percent and 40 percent. The spread comes from the questions each team asked, and every team found the same ordering: logistics and district facts fail more often than famous claims, and an answer written in a confident, organized format carries no signal about whether its district is real.
The same ballot carries the build out vote this edition previewed yesterday, and a fresh national poll gives that vote a size. A Reuters and Ipsos poll of 1,765 adults, conducted Thursday through Monday with a margin of error of 3 percentage points for registered voters, found that 42 percent of registered voters called limiting construction of the data centers that power AI a very important issue or the most important issue in their vote. Cost of living led the poll at 48 percent, so the data center question sits second in the published list, ahead of immigration at 13 percent. Voters in 38 local jurisdictions decide at least 41 local data center measures today, and voters in nine states elect the utility regulators who approve or deny the rate requests that follow large new power loads. Polls close tonight at different hours by state, and results will arrive measure by measure. A voter who has not yet gone can still do the two checks this edition has recommended all week in under five minutes: confirm her district and polling place on her state election website, and read her local measure for its numbers, the megawatts, acres, gallons and moratorium length printed in its text.
He lost an AI exposed job at 40. The search back took about a month longer.
Goldman Sachs estimates the first wave of AI displaced workers is following the same hard path as workers displaced by earlier technology
The worker in this story did everything the standard advice describes. He lost his job, applied steadily, and still watched the search run long, because the job he lost sat in an occupation AI can reach. Goldman Sachs economist Pierfrancesco Mei analyzed the Labor Department's Displaced Worker Supplement, covering more than 15,000 workers who lost jobs between 2016 and 2025, and scored each loss by the occupation's AI exposure, the industry's AI adoption rate and whether the position itself was eliminated. Workers in the top 30 percent of that score are the group he treats as likely displaced by AI. For workers displaced since 2025, that group took about a month longer than other laid off workers to find a new job, and its members were roughly 10 percentage points more likely to still be unemployed a year after losing the job. The age split is the sharpest line in the findings. Displaced workers aged 35 and older in the AI exposed group took about five weeks longer than comparable laid off workers to return to full time work, against about three weeks for workers under 35. The pay side matches the time side: of long tenured workers who lost full time jobs from 2023 through 2025 and found full time work again, about 49 percent earned as much as or more than before, down from about 62 percent in the prior survey period.
Goldman is careful about what its score can prove, and this edition keeps that care in the same paragraph as the numbers. No survey asks a worker whether AI caused her layoff, so the AI displaced group is an estimate built from exposure and adoption, not a count of people a company named. The finding gains weight from its shape rather than from any single figure: Mei also looked back at earlier waves of technology displacement and found that in the years after losing a job to technology, workers' real earnings grew more slowly than those of other displaced workers. Reporting on the note adds a trap door worth naming for anyone mid search. The backdrop has a count attached: employers cited AI in 120,136 announced job cuts through September, about 21 percent of all announced cuts and the most cited single reason, a figure that records the reason employers announced rather than proof of what the software did. Read against yesterday's story in this publication, about workers replaced by AI and later asked back by the same employer, the two findings describe different ends of the same labor market. Some employers paid to reverse a cut. The larger measured group is still searching a month past the point where other laid off workers have landed, and the ones who land often land back inside the exposure zone.
The ransom call used her son's voice. Her son was safe at home.
Greenville police warned families on November 2 about virtual kidnapping calls built from cloned voices, spoofed numbers and social media details
The call arrives with her son's voice, his speech pattern, and his phone number on the caller ID, and it says he has been taken and money must move now. The Greenville Police Department in South Carolina issued a formal warning on November 2 about this scam, which investigators call virtual kidnapping: no one has been taken, and the voice, the number and the details are assembled to make a parent act before she checks. According to the department, the callers clone a family member's voice with AI tools, mine public social media accounts for nicknames, schedules and travel plans that make the story sound inside the family, alter images and video to suggest a hostage situation, spoof the caller ID so the call appears to come from the family member's own phone, and press for immediate payment through channels that cannot be traced or reversed. The person named in the call is, in the cases the warning describes, entirely safe and unharmed, and the entire crime runs on the minutes between the call and the first check.
The department's advice is a procedure, and it works because it does not depend on judging whether the voice sounds real. Stay calm, send no money, and reach the person named through a separate line or a trusted third party to confirm where they are. Anyone who believes a loved one may be in genuine danger should call emergency services immediately, so the check and the police call happen in parallel rather than in sequence. This publication's fraud ledger carries the cost context: the FBI counted 893 million dollars lost to AI related scams in 2025, and federal warnings since 2024 have described cloned voices used both for family emergency scams and for breaking into accounts by impersonating the account holder. A family code word, agreed in a calm moment and asked for on any emergency call, remains a simple defense, because a cloned voice can copy how a son sounds and cannot know what the family agreed he would say. The Greenville warning is local, from one city's police department, and the technique it describes is national, which is why a warning written for Upstate South Carolina belongs in a national edition: the call a family receives will not announce which police department's warning it matches.
She can now check whether her exchange balance is backed. Ten tokens have a proof. The rest wait for tomorrow.
Binance published a verifiable proof of reserves for its October 31 snapshot and opened a new withdrawal phase on November 3
The customer in this story holds savings on Binance, the exchange that lost more than 6.3 billion dollars from its hot wallets on October 29. Her question since Thursday has been narrow and practical: is the balance on her screen backed by assets the exchange actually holds. On November 2, Binance published a completed zero knowledge proof for the reserve snapshot it took at midnight UTC on October 31, covering ten tokens: Bitcoin, Ether, BNB, Solana, XRP, Tether, USD Coin, USD1, RLUSD and Zcash. The system pairs a Merkle tree record, which lets a customer confirm her own balance was counted in the snapshot, with a zero knowledge proof that total reserves cover what customers are owed, without exposing anyone's balance. Binance says the ten tokens are backed at least one to one, that it has replenished about 95 percent of the stolen assets from its own funds, including its SAFU emergency fund, its futures insurance fund and its corporate treasury, and that the remaining 5 percent sits in less liquid tokens outside the ten. A fresh snapshot covering more tokens is set for November 4, and producing its proof takes about 40 to 50 hours of computation after the snapshot, according to co chief executive Yi He. A new phase of withdrawals opened at 04:00 UTC today, November 3, adding assets across nine networks including BNB Smart Chain, Ethereum, Solana, the XRP Ledger, Sui, Arbitrum, Optimism, Tron and Base, rolled out asset by asset after security checks rather than all at once.
The limits of a proof of reserves belong in the same breath as the proof, and they are limits a customer can act on. The proof covers ten named tokens at one moment, October 31, and it shows assets against customer balances for those tokens. It does not show the exchange's full debts, its business obligations or whether its systems can be breached again, and the 5 percent of stolen assets still being replaced sits outside the ten proven tokens. Customers have been voting with withdrawals since access began returning on November 1: blockchain tracker DeFiLlama put Binance's 24 hour net outflows at about 3.29 billion dollars, down from an earlier peak near 7 billion dollars, according to Catenaa's November 3 reporting. A customer holding one of the ten proven tokens can run the verification herself today, in the exchange's own tool, and that check is worth the minutes it takes. A customer holding a token outside the ten is waiting on the November 4 snapshot and its two day proof window, and her decision about where the balance sits in the meantime deserves to be made with that gap stated plainly rather than smoothed over.
Opportunity Radar
A post release monitoring service for small app developers answers the failure at the center of the lead story. The nudify network passed store review in a harmless form and changed through a server switch afterward, and neither store caught the change for months. Independent developers with legitimate AI photo, tutoring and coaching apps face the same exposure in reverse: a compromised server, a bad content feed or a rogue update can change what their app serves after approval, and the first notice may come from a store removal. A small security shop could sell a fixed scope package to indie developers and small studios: a weekly automated crawl of the live app as users in different regions and referral paths see it, a comparison against the reviewed build, and an alert with evidence when served content diverges. The buyers are studios with one to ten apps and no trust and safety staff. Validation is a pilot with three studios, run for one release cycle, measuring divergences caught and time to alert. Success is counted in hours between a divergence appearing and the developer hearing about it. The service fails if it drifts into general app store consulting, so it should stay on the single job of watching the live app against the approved one.
A prior authorization evidence pack for small clinics in the six WISeR states fits the one healthcare result in this edition that arrived with a denominator attached. The JAMA study shows the new permission step cut targeted services 15 to 20 percent against trend in six months, and the FOIA record shows vendors struggling with volume, portals and turnaround times. A health operations consultant could offer practices a bounded documentation service using the tools the practice already has: a standard evidence packet for the 13 covered services, built from the coverage criteria, a submission checklist matched to each vendor's portal, and a weekly log of turnaround times and denial reasons that the practice can cite in appeals and in comments to the agency. The buyers are independent pain, orthopedic and sleep practices in Arizona, New Jersey, Ohio, Oklahoma, Texas and Washington that lack a dedicated authorization team. The validation test is one practice and one service line for 60 days, measuring first submission approval rate and median days to decision against the practice's prior two months. The service fails, and should stop, if it promises approval outcomes rather than documentation quality, because the study behind it measured use falling under the step, not a method for beating it.
What You Can Do With This
If you are voting today
Confirm your congressional district and polling place on your state election website before you leave, and treat any chatbot voter guide as a draft to be checked rather than a ballot to be copied. The Washington Post test found guides that invented a Senate race and misnamed the district in 22 percent of the guides that named one, and the IFPG test found logistics answers outdated or inaccurate 13.9 percent of the time. If a guide cites an unfamiliar election website, check whether your state site lists the same candidates for your address. The official page takes minutes and it is the only version election officials will honor tonight.
If an AI photo app sits on your phone, or on your child's phone
Look at the small AI tools installed from social media ads this year, the pet editors, hair stylers, language and workout apps from developers you cannot name, and delete the ones nobody in the house uses. Apple and Google have not published a full list of the more than 400 linked apps and sites in the network WIRED and AI Forensics described, so a store rating cannot clear an app: many of the network's listings carried an all ages rating on Google Play. Keep uploads of other people's photos out of casual AI editors as a household rule, because the person in the photo is the one exposed when a tool's hidden purpose surfaces later.
If you hold traditional Medicare in a WISeR state
Ask your doctor's office, before any scheduled procedure in the 13 covered services, whether the service needs prior authorization under the pilot and which vendor handles the review. Keep the dates: the day the request went in, the day a decision came back, and the wording of any denial, because the FOIA record shows blank letters and long waits in the pilot's first months and an appeal starts from that paper trail. Open enrollment runs through December 7, the deadline for choosing coverage that starts January 1, and the JAMA figures in this edition, a 15 percent fall in back injections and about 20 percent in other targeted services against trend, are the measured starting point for comparing traditional Medicare in a pilot state against a private Medicare Advantage plan.
If your family has no code word yet
Pick one tonight, in person, and agree on the rule that travels with it: any emergency call asking for money gets the code word question first and a call back on a known number second, whatever the voice sounds like and whatever the caller ID shows. The Greenville police warning describes callers who clone a voice, spoof the number and mine social media for the details that make a ransom story sound real, and the department's own advice is to verify through a separate line before any payment. A code word costs one conversation. It is the only part of the call a scammer cannot scrape from a public profile.
The Bigger Picture
Every story in this edition turns on a check that happens after the impressive part. The app passed review and changed later. The prior authorization system launched on schedule and cut the services it touched by a fifth before anyone measured outcomes. The voter guide read smoothly and named the wrong district in about one guide in five that named one at all. The exchange published its proof two days after the snapshot, for ten tokens, with a second snapshot already scheduled. In each case the first version, the listing, the launch, the guide, the balance screen, presented itself as settled, and the truth arrived in a second step that somebody had to choose to run: a researcher reverse engineering an app, a journal study comparing states, a newspaper testing 3,000 guides, a customer verifying her own balance inside a Merkle tree.
The households that come through this week best will be the ones that treat the second step as part of the product. A store badge is a review from the day the app was submitted. A coverage approval system is a set of incentives, a share of savings for the reviewer and a smaller penalty for quality failures, before it is a medical judgment. A chatbot answer is a draft with a citation habit, and its citations can lead back to another machine's mistake. None of that makes the tools useless. It makes them unfinished at the moment they look most finished, and it puts a dated, doable check in the reader's hands each time: the official election page today, the app list cleanup this week, the authorization paper trail before the procedure, the family code word tonight, the reserve proof before the balance feels safe again.
References
WIRED: Hundreds of mundane AI apps are hiding abusive deepfake features, AI Forensics research (Nov. 2, 2026) AndroidPure: Hundreds of AI apps on Google Play and App Store hid nudify tools, WIRED investigation and AI Forensics research (Nov. 2, 2026) Daily Caller: Chinese-linked network of 400 AI apps hid deepfake porn tools from Apple, Google (Nov. 2, 2026) Evolt News: App Store deepfake apps, 400 hid abuse tools, Apple pulled 19 (Nov. 2, 2026) AI Weekly: WIRED traces 400 plus AI apps hiding abusive deepfake tools (Nov. 2, 2026) MarketWatch: Medicare used AI to pre-approve patient care, and it immediately led to a large drop in medical services, JAMA study (2026) MedCity News: 7 potential problems with Medicare's AI prior authorization experiment, EFF FOIA documents (Nov. 2, 2026) TechTimes: Medicare's AI prior authorization pilot had 4 of 6 vendors flagged in first weeks, records show (Nov. 3, 2026) TechTimes UK: AI chatbots are making up US election races, Washington Post voter guide analysis (Nov. 3, 2026) NPR Illinois: AI chatbots are becoming political advisers, their answers can mislead voters, IFPG study (Nov. 2, 2026) Innovating for the Public Good: New analysis finds AI platforms providing voters with inaccurate, outdated election information (2026) NewsGuard: October 2026 Midterms Quarterly AI Audit, false claim monitor (Oct. 28, 2026) Reuters: Nine things on US voters' minds ahead of midterm elections, Reuters and Ipsos poll (Nov. 3, 2026) Ballotpedia: Data center related ballot measures, 2026 Stateline: Voters make governors, utility regulators answer for high power bills (Nov. 2, 2026) AFP via The China Mail: Spewing US election falsehoods, AI chatbots face scrutiny, Forum AI study (Nov. 1, 2026) AARP: FBI report, internet crime losses hit $20.9 billion, $893 million tied to AI related scams in 2025 AI Weekly: Goldman, AI displaced workers wait a month longer for jobs, Fortune reporting (Oct. 30, 2026) TheStreet: Goldman Sachs has a blunt warning for workers displaced by AI (2026) Who's On The Move: Greenville Police issue warning over virtual kidnapping scams using AI voice clones and stolen social media details (Nov. 2, 2026) Unchained: Binance publishes zero knowledge reserve proof for BTC, ETH and 8 other tokens after hack (Nov. 3, 2026) Catenaa: Binance restores withdrawals across more networks, proof of reserves completed (Nov. 3, 2026)