No. 12AI Gadgets

Trust nothing, agree a safe word

In Terminator 2, John Connor stops at a phone box to warn his foster parents. His foster mother answers, warm and worried, and asks him to come home. The Terminator takes the phone, does John’s voice, and asks whether Wolfie is all right, because he can hear him barking. The voice on the other end says Wolfie is fine. The dog’s name is Max, and the thing answering is the T-1000, which has killed John’s foster mother and taken her shape. He hangs up and tells John his foster parents are dead. John had already felt it, and said so: She’s never this nice. The scene is from 1991 and it holds the whole of what I want to say: a voice is not a person, and the only test that works is a fact the real one would never get wrong. A film about killer machines turns out to be the clearest advice on staying safe from one that I’ve seen, and it did it in a phone box.

In the last piece I argued that nearly everyone will soon have a personal AI connected to everything they own, and that the better the assistant, the worse the breach. I said that deserved its own piece. This is it, and I want to start with the good half, because the good half is the reason we’re going to connect everything anyway.

The same data, read twice

My watch knows when I’m asleep, how my heart behaves while I am, and whether I’ve moved in the last hour. If I fell down the stairs and didn’t get up, it would ring for help. With Apple’s version switched on, a hard fall followed by about a minute without moving gets a call to the emergency services, and a message to your emergency contact saying where you are. It also checks your pulse from time to time for a rhythm that looks like atrial fibrillation, and tells you if it keeps finding one. For a parent who lives alone, this is the best thing a gadget has done in my lifetime. Not the step count. The fall nobody would have heard.

Now hand the same stream to the wrong reader. When you leave the house and when you come back. Which nights you sleep badly. The route you walk, the people you message most, and the way you talk to each of them, because the assistant that answers your email has read all of it. None of that is a new kind of data. It is the same data, read by someone who wants something from you instead of someone who wants you safe.

Fig. 1 · The same data, read twice

The watch that rings for help and the profile that tells a thief the house is empty are the same stream.

This is not a thought experiment. The Change Healthcare breach of February 2024 exposed the health and insurance records of 192.7 million people, a figure its parent, UnitedHealth Group, confirmed as final eighteen months later. That was a claims processor, holding what it needed to pay bills. A personal AI holds everything, and holds it in one place.

What can be cloned now

Three things used to prove you were you: your voice, your face, and the way you write. All three are now copyable, at a cost that rounds to nothing.

Voice. In 2023 McAfee’s researchers tried the free voice-cloning tools anyone can find, and reported that three seconds of audio was enough to make a clone, and that 70 per cent of the 7,000 people they surveyed across seven countries weren’t confident they could tell one from the real thing. It is a security company’s own research, so hold it loosely; the three seconds is the figure everyone has repeated since. Three seconds is a voicemail greeting. It’s the clip of you singing happy birthday that somebody else posted.

Face. In early 2024 a finance worker at the engineering firm Arup joined a video call with the company’s chief financial officer and several colleagues, and was told to make fifteen transfers totalling HK$200 million, about 25 million US dollars. Everyone else on the call was a deepfake, built from video and audio that was already public. The worker had suspected the first email was phishing. Then they saw the faces.

Writing. This is the one the last piece adds. A personal AI that has read every message you’ve sent can write like you, to the people you write to, about the things you’d write about, with the private detail that makes it land. The attacker doesn’t need to guess how you’d phrase it. The model already knows. I can’t show you a case yet; assistants with this much access are months old, not years. But the other two clones went from research to free download in about two years, and this one needs no new model at all, only a login.

Fig. 2 · What it takes to copy you

Voice, face and writing are all copyable now. A phrase that was never typed is not, until you have to use it.

What none of them can copy is a sentence that has only ever existed out loud, between people who agreed it. There is nothing to scrape, until the day you have to use it, and I’ll come to that. The trick is older than the technology it defeats.

Agree a safe word

The FBI put it in a public service announcement in December 2024, one line among the tips: Create a secret word or phrase with your family to verify their identity. Starling Bank had said the same three months earlier, in a campaign run in support of the UK government’s Stop! Think Fraud drive, and added the rule that matters most: never share it digitally.

Starling’s survey, run for the bank among 3,010 adults, is worth sitting with. 28 per cent thought they had been targeted by a voice-cloning scam in the past year. 46 per cent did not know the scam existed. And 8 per cent said they would send the money even if the call seemed strange. The gap between those numbers is where this piece is aimed.

Here is how to do it so it works, because a safe word done badly is worse than none, since it makes you feel checked when you weren’t.

Hang up, ring back. First, before any of the rest. On the number you already have, not one the caller gives you. That has been the FTC’s advice since 2023, and it’s still the simplest check there is. The phrase is for when you can’t, or when the call back sounds right too.
A phrase, not a word. A single word can be guessed, or fished for in conversation; a short sentence can’t. And nothing anyone could look up: not the dog’s name, not the street you grew up on, not the team. The dog’s name only caught the T-1000 because it had never heard it.
Said, never typed. Agree it in a room. Not in the family group chat, not in a note on your phone, not in an email to remind your mum. The point is that it lives in heads and nowhere a breached assistant could read. If it has ever been typed, it’s spent. So is the day you have to say it down a phone line, because anyone listening has it now: agree a new one next time you’re in the same room. Treat it like a password, because that’s what it is.
Ask, don’t tell. The person who wants the money proves who they are; the person being asked for it never says the phrase, and never gives it to a caller who asks. The Identity Theft Resource Center has watched this go wrong. Its chief executive, Eva Velasquez, told CBS News: We have had a couple incidents where the victim will say the safe word first instead of letting the other person say it. The Terminator’s version was a trap: it offered a wrong name and waited to see if the impostor agreed. That works too, with no phrase agreed at all, so long as what you offer is false. What you never do is say the real one and wait for a yes.
Expect the dodge. Velasquez’s example is the fake grandchild who is in jail, distraught, and can’t remember the password. The dodge is the answer. Anyone who really knows it can say it, however upset they are.

Fig. 3 · The Wolfie test

You ask for the phrase and they give it. If they dodge, hang up and ring the number you already have.

Trust nothing

Trust nothing sounds bleak, and I don’t mean it that way. I’m not giving up the watch, or the assistant, or the house that turns the lamp on when the sun doesn’t. The last piece argued we’ll all take that trade, and I’ve taken it. What I mean is narrower. Inside the connected life, nothing that arrives through a screen or a speaker is proof of who sent it any more. The voice isn’t. The face isn’t. The message that sounds exactly like your daughter isn’t. So you need one secret the machines haven’t got, and the cheapest one ever made is a few words agreed in a kitchen.

It takes five minutes. Do it at the next family dinner, out loud, with the phones face down. Teach the rule along with the phrase: you ask, they answer. Then never type it, including to me. Mine isn’t in this article, and that’s the whole idea.