# Hitting a NERVE with attacks on AI-powered brain-computer interfaces *2026-09-11 — note* Human brain interfaces are advancing at a startling pace; Ray Kurzweil has just joined a startup that dispenses with skull surgery in favour of you [snorting charged nanoparticles](https://www.ibtimes.com.au/ray-kurzweil-joins-subsense-brain-computer-interfaces-1875104) that are then driven by magnetic coils in a cap. This all sounds very scifi, but the [software stack on these BCI](https://anil.recoil.org/papers/2022-enhancing-brain-security) devices have an enormous and unguarded attack surface. [Zahra Tarkhani](https://zatkh.github.io/) has just uploaded a preprnt [NERVE Attacks: Breaking AI-Powered Brain-Computer Interfaces](https://anil.recoil.org/papers/2026-nerve-attacks) that we worked on with two brilliant interns who visited last summer, [Georgios Akkogiounoglou](https://github.com/sdi1400258) (KTH) and [Isabel Tscherniak](https://www.linkedin.com/in/isabel-tscherniak) (TUM), and [Lorena Qendro](https://lorenaqendro.github.io) at Nokia Bell Labs. Back in 2022, our [first pass at this](https://anil.recoil.org/ideas/brain-interface-security) found over [300 vulnerabilities](https://anil.recoil.org/papers/2022-enhancing-brain-security) across the stacks of commodity BCI headsets. The new paper categorises this surface into what we dub the **NERVE attacks**, which between them cover the entire Brain-Computer stack from the radio interface to the underlying trained model: - **N**euro-mimetic Forgery synthesises a physiologically plausible brain signal that the classifier accepts without any data from the user. - **E**vasion via Desynchronization nudges the timing of the signal by a fraction of a second so discriminative features fall outside the model's receptive window. - **R**eplay-based Hijacking records a real epoch and replays it over the wireless link to reissue commands without the user knowing. - **V**ein Tapping the unencrypted radio links, finding missing authentication, exporting world-readable model files, and (of course) memory-unsafe SDKs that expose everything else to the sort of [buffer overflow](https://anil.recoil.org) I was chasing over twenty years ago. - **E**mbedded Backdoors via trojaned models that behave normally until they see a trigger disguised as an eye blink, a muscle twitch or even mains interference.

In order to help find these vulnerability points, we built 'EEGle' (no relation to my [Energy and Environment Group](https://anil.recoil.org/notes/eeg-interns-2025)!). EEGle's an extensible framework for BCI security analysis that exposed 17 novel neuro-specific attacks. And like [other areas recently](https://anil.recoil.org/notes/rumour-is-the-exploit) LLMs remove the need for any expertise in neuroscience and make it super easy to supply the physiological parameters for a forged motor-imagery signal. The same models are just as happy [scanning for the flaws](https://anil.recoil.org/notes/scrutineer-local-llm) as finding ways through them. The end-to-end demonstration in the paper against the [CYBATHLON 2024](https://cybathlon.com/en/event/disciplines/bci) BCI game is pretty cool. This game has three tasks: cursor control, wheelchair navigation, and operating an ice machine with a robotic arm. All three were hijacked via raw replay, synthesised epochs and augmented replay in about 8 seconds. The defences aren't in good shape unfortunately. There's no (published) protection against some of these such as the evasion/desynchronisation signal attacks, and the [information flow control](https://anil.recoil.org/projects/difc-tee) approach we proposed back in 2022 only covers the systems half of the problem. The reason it's all so worrying is that [chained attacks](https://anil.recoil.org/notes/internet-immune-system) are really easy to execute these days, several of which are shown in the paper and often take \<10ms. In the ice machine task, a misclassification tips the robotic arm over, showing the physical stakes involved given the same mechanisms are intended to be used for [wheelchairs](https://upnride.com/) and [prosthetics](https://uk.hypershell.tech). So there's certainly some brainy work to be done here! The [preprint is on arXiv](https://arxiv.org/abs/2609.08971) and comments are very welcome. Synopsis: New preprint defining attack dimensions for Brain Computer Interfaces and an analysis framework called EEGle. Words: 514 ## Related - [NERVE Attacks: Breaking AI-Powered Brain-Computer Interfaces](https://anil.recoil.org/papers/2026-nerve-attacks) (paper, 2026-09-01) - [Security scanning my own code with Scrutineer and local coding models](https://anil.recoil.org/notes/scrutineer-local-llm) (note, 2026-08-31) - [Just a rumour of a bug is enough to find a security exploit these days](https://anil.recoil.org/notes/rumour-is-the-exploit) (note, 2026-08-22) - [The Internet needs an antibotty immune system, stat](https://anil.recoil.org/notes/internet-immune-system) (note, 2026-04-08) - [EEG internships for the summer of 2025](https://anil.recoil.org/notes/eeg-interns-2025) (note, 2025-06-28) - [Enhancing the Security & Privacy of Wearable Brain-Computer Interfaces](https://anil.recoil.org/papers/2022-enhancing-brain-security) (paper, 2022-01-01) - [Security analysis of brain-computing interfaces](https://anil.recoil.org/ideas/brain-interface-security) (idea, 2021-01-01) - [Information Flow for Trusted Execution](https://anil.recoil.org/projects/difc-tee) (project, 2020-01-01) --- Canonical: https://anil.recoil.org/notes/nerve-attacks Type: note License: CC BY 4.0 Tags: security, ai, brain, systems