- › Affective AI reads emotional state from your voice, face, and word choice, and can keep a timestamped log of when you were anxious, tired, or afraid.
- › Emotion is not a side channel to your decisions. It is the channel. We decide with feeling first and justify with logic after, which is exactly what a social engineer exploits.
- › A running record of your emotional state is the richest manipulation dataset ever proposed, because it tells an attacker precisely when you are most exploitable.
- › This is Fearware at scale: when your emotional state, not the evidence, drives the decision. An emotional log hands that lever to whoever holds the data.
- › The defense is not fear of AI. It is treating your emotional state as part of the threat model, guarding what you feed these systems, and building decision hygiene around your worst hours.
Meta just filed a patent for an artificial intelligence that listens to your voice all day, works out how you are feeling from the way you sound, and keeps a timestamped log of it. Anxious at 9am. Exhausted by 2pm. Afraid at 11 at night. A running ledger of your inner weather, kept by a company whose business is your attention.
A patent is not a product. It is a statement of intent, and this one names something the security industry has been slow to take seriously. The most valuable thing an adversary can know about you is not your password. It is how you feel, and precisely when.
We Are Feeling Machines That Think
Start with the neuroscience, because the whole risk rests on it. We like to imagine ourselves as reasoning creatures who occasionally get emotional. The evidence runs the other way. The neuroscientist Antonio Damasio spent a career showing that people with damage to the emotional centers of the brain, but intact logic, cannot make even simple decisions. Strip out the feeling and the reasoning machine seizes. His conclusion is the one worth memorizing: we are not thinking machines that feel, we are feeling machines that think.
Sit with what that means for security. Every decision your people make, to click or not click, to approve or question, to open the door or hold it, is an emotional event first and a logical one second. The logic mostly arrives afterward to justify what the feeling already chose. This is not a flaw to train away. It is the architecture of the human operator, and it is the architecture every social engineer already attacks.
They just do it blind. A phishing crew guesses at your emotional state. They assume you are busy, rushed, eager to please, afraid of the boss, and they craft a lure that would work if you happen to be feeling that way when it lands. Their hit rate is a function of timing they cannot see. Now give them the log.
What Emotional Surveillance Actually Is
Affective computing is the field of teaching machines to read human emotion. It reads the pitch and tremor in your voice, the micro-tensions in your face, the word choices and rhythm in your text, and it maps them to states: stress, fatigue, fear, excitement, doubt. None of this is science fiction. It powers the sentiment analysis in call centers, the “wellness” features in wearables, the engagement tuning in the apps you already carry.
Emotional surveillance is what happens when that reading runs continuously and gets stored. Not a snapshot, a timeline. A record of when you are reliably anxious, which days you are depleted, what topics spike your fear, and how long it takes you to recover. Individually, each reading is noise. Assembled over weeks, it is a map of your vulnerabilities with the hours marked.
I want to be clear about my own position, because the reflexive move here is to recoil from the technology and I am not going to make it. I am pro-AI. Affective computing has real and humane uses, in mental health support, in accessibility, in catching the burnout in a team before it breaks someone. The tool is not the enemy. The undefended emotional layer is the enemy, and so is the question of who holds the log and what they are allowed to do with it. Naming the fear is the job. Performing caution about AI is not.
Fearware, With the Schematics Included
I use the term Fearware for the moment when your emotional state, rather than the evidence in front of you, dictates your security posture. Fearware is the executive who wires the money because the email felt urgent and the CEO’s tone felt real. It is the analyst who dismisses the alert because they are too fried to chase it. It is comfort bias and fear doing the deciding while logic writes the memo.
Every social engineer on earth is in the Fearware business. The whole craft is inducing an emotional state, urgency, fear, flattery, obligation, and harvesting the decision that state produces. Until now they have had to manufacture the emotion and hope it took. Emotional surveillance offers something new: the ability to wait for the emotion to arrive on its own and strike in that window.
Picture an attacker with access to a feed of your emotional state. They do not send the fraudulent request at a random time. They send it in the ninety seconds after your calendar shows a tense meeting ended and your voice still carries the stress. They pitch the investment scam on the evening the log says you are lonely. They time the ultimatum for the afternoon you are already depleted. This is the decision fatigue problem weaponized with a clock, and the clock is now readable from the outside.
The Human Zero-Day, Now Visible
A zero-day is a vulnerability with no patch. The Human Zero-Day is the unpatched condition in the operator: fatigue, fear, the authority reflex, the depletion that turns your most careful person into your most exploitable one. It has always been the vulnerability an intelligent adversary reaches for first, for one simple reason. It is present in everyone and no vendor sells a patch for it.
Emotional surveillance changes one thing about the Human Zero-Day, and it is the thing that should worry you. It makes the vulnerability visible from the outside. For all of history, the exact moment a person was most exploitable was private, knowable only to them and often not even to them. A continuous emotional log ends that privacy. It turns the internal state that governs every decision into an external signal an attacker, an advertiser, or an employer can read and act on. The most personal thing you own becomes telemetry.
This is where the three walls of security collapse into one. Your firewall does not care how you feel. Your fence does not care how you feel. But the operator standing between the alarm and the decision to act on it is running entirely on how they feel, and that operator is the target. A defense that hardens the network and the building and leaves the emotional layer wide open has simply moved the weakest point to the one place it is hardest to see.
Defending the Emotional Layer
You do not defend against this by being afraid of AI, and you do not defend against it by demanding people feel less. Emotion is not the bug. The undefended state is the bug. Here is where the work actually is.
Treat your emotional state as part of the threat model. The single most useful shift is to stop pretending the operator is a stable instrument. Model the human the way you model the network, with known load limits and predictable failure states. Know your own worst hours. Know your team’s. Assume an adversary is trying to catch you in them, because the good ones are.
Build decision hygiene around the vulnerable windows. The highest-stakes, least-reversible decisions should not be made in the emotional state an attacker would choose for you. Put a mandatory pause before anything irreversible. Require a second set of eyes on the big calls. Move the wire approval, the access grant, the containment decision to a moment when the operator owns their own prefrontal cortex. A short delay is cheap. A decision made inside a manufactured emotion is not.
Guard what you feed the machines. Every always-listening device, every “wellness” feature, every app that tunes itself to your mood is a potential input to somebody’s emotional log. You do not have to reject all of it, but you should choose it deliberately and know where the readings go. For an organization, that means a real policy on affective data: what gets collected on employees, who can see it, and the hard line that an emotional readout is never an input to a decision about a person.
Name the emotion in the moment. The oldest defense still works and it is nearly free. A social engineer needs your emotional state to stay in the driver’s seat, unnamed and unquestioned. The instant you notice it, “I am being rushed,” “this message wants me afraid,” “I am too tired to decide this well,” the spell weakens, because naming the feeling hands the decision back to the part of you that can weigh it. Teach your people that the feeling of urgency is itself the alarm.
We spent a generation treating the human as the weakest link and doing almost nothing to defend the thing that actually drives human decisions. Now the tools to read that layer at scale are being patented in the open. The feeling machine was always the target. The only thing that has changed is that the target now glows.
Want to know how much of your risk is riding on an operator’s emotional state? Measure it with our free Human Attack Surface Score, or contact Grab The Axe to build the human layer into your defense.
A PhD candidate in Health Psychology and former Corrections Officer, Jeff founded GTA to dismantle passive security models. He focuses on the 'Human Zero-Day', mitigating executive burnout and decision fatigue before they become security breaches.
View Author Page →
