February 24, 2026
Selfie today, watchlist tomorrow
OpenAI, the US government and Persona built an identity surveillance machine
Users say their selfies got “watchlisted” — panic, memes, and one-word replies
TLDR: A report says public files suggest Persona and OpenAI used identity checks tied to “watchlists,” sparking panic, jokes, and a split between surveillance fears and “it’s just compliance.” Persona’s blog response argues it was a non-production test setup. People are worried their selfies might mean more than a login.
Internet sleuths dropped a bomb: a report claims OpenAI, the U.S. government, and identity-check firm Persona are tied up in a selfie-powered watchlist machine, complete with code names like “SelfieSuspiciousEntityDetection.” The smoking gun? Two spooky hostnames — “openai-watchlistdb” — found via Shodan (a tool that lists exposed servers), plus publicly served source files on a government endpoint. Cue the comment chaos. One user begged, “What can those do from a separate country,” while another answered with the bleakest shrug: “No.” Meanwhile, someone asked, “Why the myspace music?” turning paranoia into punchline.<br><br>But there’s pushback. A level-headed commenter pointed to Persona’s official post-incident review, saying it was a non-production test domain with exposed source maps, not a live spy rig, and flagged a Twitter back-and-forth from Persona’s CEO Rick. The thread split fast: Team “We’re being re-screened like suspects” vs Team “This is just KYC (know-your-customer) and compliance like banks do.” The fed-friendly acronym soup (FedRAMP = government cloud rules, SAR = suspicious activity report) only fueled the mood. And yes, “SelfieSuspiciousEntityDetection” instantly became a meme — “say cheese to the Feds” — as users wrestled with the uneasy idea that chatting with AI might start with handing over your face.
Key Points
- •The authors claim passive reconnaissance found Google Cloud infrastructure exposing hostnames suggesting an OpenAI-linked watchlist database within Persona’s domain.
- •They report discovering 53 MB of unprotected source maps on a FedRAMP government endpoint, indicating source code structure exposure.
- •The article describes identity verification workflows employing facial recognition, similarity scoring, watchlist screening (including PEP checks), and periodic re-screening.
- •A source code identifier, “SelfieSuspiciousEntityDetection,” is cited as evidence of selfie-based entity detection functionality.
- •The publication emphasizes that no system access or modifications occurred and frames the work under legal protections for journalism and security research.