Hitting a NERVE with attacks on AI-powered brain-computer interfaces

A preprint titled "NERVE Attacks: Breaking AI-Powered Brain-Computer Interfaces" from researchers Zahra Tarkhani, Georgios Akkogiounoglou, Isabel Tscherniak, Lorena Qendro of Nokia Bell Labs, and Anil Madhavapeddy categorizes the attack surface of AI-powered brain-computer interfaces and documents 17 novel neuro-specific attacks found using the EEGle security-analysis framework. The paper's end-to-end demonstration hijacked all three tasks of the CYBATHLON 2024 BCI game — cursor control, wheelchair navigation, and robotic-arm ice-machine operation — in about 8 seconds, with some chained attacks executing in under 10ms. The authors report no published defense against attacks such as evasion and desynchronisation signal attacks, and note their 2022 information flow control proposal covers only the systems half of the problem.

Human brain interfaces are advancing at a startling pace; Ray Kurzweil has just joined a startup that dispenses with skull surgery in favour of you snorting charged nanoparticles https://www.ibtimes.com.au/ray-kurzweil-joins-subsense-brain-computer-interfaces-1875104 that are then driven by magnetic coils in a cap. This all sounds very scifi, but the software stack on these BCI https://anil.recoil.org/papers/2022-enhancing-brain-security devices have an enormous and unguarded attack surface. Zahra Tarkhani https://zatkh.github.io/ has just uploaded a preprnt NERVE Attacks: Breaking AI-Powered Brain-Computer Interfaces https://anil.recoil.org/papers/2026-nerve-attacks that we worked on with two brilliant interns who visited last summer, Georgios Akkogiounoglou https://github.com/sdi1400258 KTH and Isabel Tscherniak https://www.linkedin.com/in/isabel-tscherniak TUM , and Lorena Qendro https://lorenaqendro.github.io at Nokia Bell Labs. Back in 2022, our first pass at this https://anil.recoil.org/ideas/brain-interface-security found over 300 vulnerabilities https://anil.recoil.org/papers/2022-enhancing-brain-security across the stacks of commodity BCI headsets. The new paper categorises this surface into what we dub the NERVE attacks , which between them cover the entire Brain-Computer stack from the radio interface to the underlying trained model: In order to help find these vulnerability points, we built 'EEGle' no relation to my Energy and Environment Group https://anil.recoil.org/notes/eeg-interns-2025 . EEGle's an extensible framework for BCI security analysis that exposed 17 novel neuro-specific attacks. And like other areas recently https://anil.recoil.org/notes/rumour-is-the-exploit LLMs remove the need for any expertise in neuroscience and make it super easy to supply the physiological parameters for a forged motor-imagery signal. The same models are just as happy scanning for the flaws https://anil.recoil.org/notes/scrutineer-local-llm as finding ways through them. The end-to-end demonstration in the paper against the CYBATHLON 2024 https://cybathlon.com/en/event/disciplines/bci BCI game is pretty cool. This game has three tasks: cursor control, wheelchair navigation, and operating an ice machine with a robotic arm. All three were hijacked via raw replay, synthesised epochs and augmented replay in about 8 seconds. The defences aren't in good shape unfortunately. There's no published protection against some of these such as the evasion/desynchronisation signal attacks, and the information flow control https://anil.recoil.org/projects/difc-tee approach we proposed back in 2022 only covers the systems half of the problem. The reason it's all so worrying is that chained attacks https://anil.recoil.org/notes/internet-immune-system are really easy to execute these days, several of which are shown in the paper and often take <10ms. In the ice machine task, a misclassification tips the robotic arm over, showing the physical stakes involved given the same mechanisms are intended to be used for wheelchairs https://upnride.com/ and prosthetics https://uk.hypershell.tech . So there's certainly some brainy work to be done here The preprint is on arXiv https://arxiv.org/abs/2609.08971 and comments are very welcome.