![\"Is](\"https:\/\/dataconomy.com\/wp-content\/uploads\/2026\/02\/Is-ChatGPT-spying-for-the-feds.jpg\" "\\"Is")
<\/p>\n<\/p>\n
A massive data exposure has allegedly pulled back the curtain on a secret surveillance pipeline linking OpenAI, the identity provider Persona, and the U.S. Federal Government.<\/p>\n
According to a report published by researchers vmfunc<\/strong>, MDL<\/strong>, and Dziurwa<\/strong>, the identity verification firm Persona accidentally exposed its entire internal codebase via unprotected source maps on a government-authorized server ( > be nerds \u2014 vx-underground (@vxunderground) February 18, 2026<\/p>\n<\/blockquote>\n The exposure\u2014found on a FedRAMP-authorized<\/strong> endpoint\u2014reportedly allows anyone to reconstruct over 2,400 original TypeScript files, detailing exactly how the platform processes user biometrics and files reports to federal agencies.<\/p>\n The researchers claim that OpenAI\u2019s identity verification is not a simple \u201csafety check\u201d but a sophisticated screening engine that has been operational since November 2023<\/strong>. Notable findings include:<\/p>\n Perhaps the most controversial discovery is the \u201cDirect File\u201d capability built into the Persona dashboard. The code reportedly contains a module for filing Suspicious Activity Reports (SARs)<\/strong> directly to the U.S. Treasury (FinCEN)<\/strong> and FINTRAC<\/strong> in Canada.<\/p>\n \u201cThe form lets filers tag their reports as related to specific intelligence operations by name\u2026 Project ANTON, Project LEGION, Project SHADOW. They are hardcoded in the dropdown.\u201d<\/p>\n<\/blockquote>\n The report also highlights a new subdomain, The leaked source maps allegedly reveal that Persona performs 269 distinct checks<\/strong> during a single verification. These include:<\/p>\n The researchers argue that this infrastructure creates a massive legal exposure under the Illinois Biometric Information Privacy Act (BIPA)<\/strong>. While companies claim 1-year data retention, the leaked code allegedly shows 3-year retention<\/strong> for biometric face lists, and \u201cpermanent\u201d storage for government ID photos.<\/p>\n \u201cIf someone asks you to take a selfie to prove you\u2019re human, ask yourself who\u2019s on the other side of that camera, and what list you just landed on. Knowledge is the only real currency.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":" A massive data exposure has allegedly pulled back the curtain on a secret surveillance pipeline linking OpenAI, the identity provider Persona, and the U.S. Federal Government. Is ChatGPT spying for the feds? According to a report published by researchers vmfunc, MDL, and Dziurwa, the identity verification firm Persona accidentally exposed its entire internal codebase via […]<\/p>\n","protected":false},"author":1,"featured_media":45780,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[37],"tags":[],"class_list":{"0":"post-45779","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-technologies"},"_links":{"self":[{"href":"https:\/\/agooka.com\/news\/wp-json\/wp\/v2\/posts\/45779","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/agooka.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/agooka.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/agooka.com\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/agooka.com\/news\/wp-json\/wp\/v2\/comments?post=45779"}],"version-history":[{"count":0,"href":"https:\/\/agooka.com\/news\/wp-json\/wp\/v2\/posts\/45779\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/agooka.com\/news\/wp-json\/wp\/v2\/media\/45780"}],"wp:attachment":[{"href":"https:\/\/agooka.com\/news\/wp-json\/wp\/v2\/media?parent=45779"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/agooka.com\/news\/wp-json\/wp\/v2\/categories?post=45779"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/agooka.com\/news\/wp-json\/wp\/v2\/tags?post=45779"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}withpersona-gov.com<\/code>).<\/p>\n\n
> look into persona (used by discord)
> kyc (know your customer) service
> used for age verification
> search on internet (shodan)
> find weird server
> image 1
> openai-watchlistdb.withpersona
> openai-watchlistdb-testing.withpersona
> lolwtf
> look inside
> supposed\u2026 pic.twitter.com\/3Cdl3vSxAg<\/p>\nKey allegation: WatchlistDB<\/h2>\n
\n
openai-watchlistdb.withpersona.com<\/code>) used to screen millions of users monthly.<\/li>\nSelfieSuspiciousEntityDetection<\/code>, an AI model that flags faces as \u201csuspicious\u201d without user disclosure.<\/li>\nThe federal pipeline: Project SHADOW & ONYX<\/h2>\n
\n
onyx.withpersona-gov.com<\/code>, which appeared just 12 days ago. This matches the name of Fivecast ONYX<\/strong>, an AI surveillance tool purchased by ICE<\/strong> for $4.2 million to build digital footprints and track \u201cviolent tendencies.\u201d<\/p>\n\n\n
\n \nCategory<\/th>\n Check Details<\/th>\n<\/tr>\n<\/thead>\n \n Biometrics<\/strong><\/td>\n Liveness detection, spoof risk, and Public Figure matching.<\/td>\n<\/tr>\n \n Metadata<\/strong><\/td>\n PDF annotation detection, JPEG original image verification.<\/td>\n<\/tr>\n \n External<\/strong><\/td>\n AAMVA lookup (Driver\u2019s Licenses), SSA Death Master File matching.<\/td>\n<\/tr>\n \n Crypto<\/strong><\/td>\n Risk scoring for wallets via Chainalysis and TRM Labs.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n The researchers\u2019 warning:<\/h4>\n