# Hitting a NERVE with attacks on AI-powered brain-computer interfaces

> Source: <https://anil.recoil.org/notes/nerve-attacks>
> Published: 2026-09-11 00:00:00+00:00

Human brain interfaces are advancing at a startling pace; Ray Kurzweil has just
joined a startup that dispenses with skull surgery
in favour of you [snorting charged nanoparticles](https://www.ibtimes.com.au/ray-kurzweil-joins-subsense-brain-computer-interfaces-1875104) that are then driven by
magnetic coils in a cap.

This all sounds very scifi, but the [software stack on these BCI](https://anil.recoil.org/papers/2022-enhancing-brain-security) devices
have an enormous and unguarded attack surface. [Zahra Tarkhani](https://zatkh.github.io/) has just uploaded a preprnt [NERVE Attacks: Breaking AI-Powered Brain-Computer Interfaces](https://anil.recoil.org/papers/2026-nerve-attacks) that we worked on with
two brilliant interns who visited last summer, [Georgios Akkogiounoglou](https://github.com/sdi1400258) (KTH) and [Isabel Tscherniak](https://www.linkedin.com/in/isabel-tscherniak) (TUM),
and [Lorena Qendro](https://lorenaqendro.github.io) at Nokia Bell Labs.

Back in 2022, our [first pass at this](https://anil.recoil.org/ideas/brain-interface-security) found over
[300 vulnerabilities](https://anil.recoil.org/papers/2022-enhancing-brain-security) across the stacks of commodity BCI headsets.
The new paper categorises this surface into what we dub the **NERVE attacks**, which
between them cover the entire Brain-Computer stack from the radio interface to the underlying trained model:

In order to help find these vulnerability points, we built 'EEGle' (no relation to my [Energy and Environment Group](https://anil.recoil.org/notes/eeg-interns-2025)!). EEGle's an extensible framework for BCI security analysis that exposed 17 novel neuro-specific attacks.
And like [other areas recently](https://anil.recoil.org/notes/rumour-is-the-exploit) LLMs remove the need for any expertise in neuroscience and
make it super easy to supply the physiological parameters for a forged motor-imagery signal.
The same models are just as happy [scanning for the flaws](https://anil.recoil.org/notes/scrutineer-local-llm) as finding ways through them.

The end-to-end demonstration in the paper against the [CYBATHLON 2024](https://cybathlon.com/en/event/disciplines/bci) BCI game
is pretty cool. This game has three tasks: cursor control, wheelchair navigation, and operating an ice machine with a robotic arm.
All three were hijacked via raw replay, synthesised epochs and augmented replay in about 8 seconds.

The defences aren't in good shape unfortunately. There's no (published) protection against some of these such as the evasion/desynchronisation signal attacks,
and the [information flow control](https://anil.recoil.org/projects/difc-tee) approach we proposed back in 2022 only covers the systems half of the problem.
The reason it's all so worrying is that [chained attacks](https://anil.recoil.org/notes/internet-immune-system) are really
easy to execute these days, several of which are shown in the paper and often take <10ms.
In the ice machine task, a misclassification tips the robotic arm over, showing the physical stakes involved given
the same mechanisms are intended to be used for [wheelchairs](https://upnride.com/) and [prosthetics](https://uk.hypershell.tech).

So there's certainly some brainy work to be done here! The [preprint is on arXiv](https://arxiv.org/abs/2609.08971) and comments are very welcome.