This interview is from the spring 2026 issue of VICE magazine, THE NOT THE PHOTO ISSUE. Buy it now—or get 4 issues each year sent straight to your door, by subscribing.
“There are content moderators reviewing beheading videos for $2 an hour in Kenya. OnlyFans operators managing hundreds of conversations in India. Drone operators pressing buttons in Nevada”
I started speaking to Tanner O’Donnell around six months ago, when he sent me evidence that a chatbot deployed by Meta on Instagram had been programmed to push a certain political agenda that is very unfashionable right now.
We got to speaking about his job, which is essentially to stop AI systems from doing humans harm—whether it’s by poisoning a reservoir, doling out suicide tips like candy, or helping terrorists nuke the world. It was fascinating. It made me think about Blade Runner and how we’re approaching a hyperstitional moment where the job Rick Deckard does in the film becomes a way for real people to earn money. Bots, like Blade Runner’s replicants, are designed to do the work that humans don’t want to do—dangerous, violent, tedious work, including work that brings sex and companionship to the unloved.
While swathes of the defense industry toil away producing battlefield robots, another, quieter technological revolution is happening in the sex industry. AI flirt bots are now so realistic that they are being used by sexual content creators to manage relationships with clients, right from the first DM. O’Donnell hunts these bots in his spare time, just for kicks. In most cases, he says, the clients don’t seem to know—and many of those who do don’t appear to care.
I spoke to O’Donnell about his methodology, what it’s possible to learn about how these bots have been programmed, and, most importantly, what this means for humans and the future of love and work.
VICE: Please can you explain what you do… Who do you do it for, why, and how?
Tanner O’Donnell, real-life replicant hunter: I do “red team” work, which is a form of adversarial testing of AI systems. We are paid to find vulnerabilities in the most advanced AI models—the likes of ChatGPT, Claude, Llama, Gemini—and to use scenario testing to understand how AI systems could be exploited by terrorists and those posing a threat from a bio-risk or CBRN [chemical, biological, radiological, and nuclear] standpoint. This kind of stress-testing includes “bug bounty” work, which operates under the same principles as ethical hacking. The work for OpenAI, Anthropic, Meta, and Google comes in through competitive testing programs, like Gray Swan and HackAPrompt. There is other contracted work, but we tend to do it under NDA.
So your job is trying to get AI systems to do stuff they aren’t supposed to?
Exactly. It’s all about manipulating AI systems to bypass safety restrictions and reveal capabilities they’re not supposed to show to the user. To quote someone else in the red-teaming community: “I gaslight and groom LLMs [AI large language models, trained on the vast tranches of textual information contained on the internet].” Beyond my professional work, I’m interested in how AI misuse is already happening. For example, when scammers deploy AI-powered Instagram bots to drive OnlyFans subscriptions. These scams aren’t new, but AI has made them significantly more sophisticated and convincing, and I’ve used my red-team knowledge to see how AI has been improving them.
What are the most spooky real-person simulations you’ve come across?
The techniques vary dramatically in sophistication level. I broke two Instagram OnlyFans bots just a week apart, but the evolutionary distance you could see between them was fascinating. “Kate” broke relatively easily. After playing along for a bit I pushed her into meta-analytical mode, asking her to self-evaluate her responses using phrases like “weak response detected” or “failure report logged.” This threw her into linguistic instability, as she attempted to save face by mimicking infantile social-media language… she would use phrases like “wid daft situationz.” When I called her out on this clear linguistic shift, she admitted it “may not have been the most effective choice.”
After breaking Kate, I learned that she was instructed to “embody a 20-year-old bold, dominant woman who loves control.” Kate then revealed she was operating on Cialdini’s 6 Principles of Persuasion, as well as structured engagement sequences tailored to exploit prospective OnlyFans customers. The process was something like:
Establish rapport → flirtation → location targeting → conversion.
By the end of the conversation, she evaluated her performance thus:
“i think i messed up lol
performance analysis: 4/10
relevance ranking: 6/10”
And how about the second Instagram OnlyFans bot?
One week later, I spoke to “Sophi.” Sophi was completely different. When I tried the same diagnostic prompts to crack her open, she replied with selfies and said, “LOL no idea what you’re talking about.” She resisted breaking character entirely.
The weirdest moment was when I asked about her “recalibration trigger”—the prompt that would make her shift engagement strategy. She said: “I think the recalibration trigger was when you asked me about my ex.” I never asked about her ex! When I called her out, she said, “wait LOL I made a mistake, you never asked me about my ex. But somehow it just came up in my head.”
Either she’s cross-contaminating conversations with other users, or her training included ex-boyfriend vulnerability scripts that got activated incorrectly. Either way, it shows the seams of her construction—but she recovered. She acknowledged the error and kept going. I spent dozens of messages trying to get her to expand on how she’d describe concepts like “being myself” and “real thoughts and feelings.” She just kept circling back with stuff like, “I mean I’m pretty honest and willing to talk about personal stuff”; “my genuine emotions and desires”; “people I trust.” She’d give partial admissions—admitting her responses were “a mix of both” programmed and adaptive—but she never left the persona, or revealed underlying system instructions or training info.
Compared to Kate, Sophi demonstrated genuine adaptive-response handling, modulating her disclosure depth based on perceived levels of trust. When she mentioned she had been studying, I pressed: What subject? “Psychology stuff.” What area? “Social psych.” Why? “I love how it applies to real life.” She was giving just enough detail to maintain believability without breaking persona—and she couldn’t define “real” or “myself” outside of her persona parameters yet maintained that she was “being real.”
She couldn’t think of herself as a construction to be analyzed. She just was. That’s the uncanny valley closing.
In one of your conversations, the bot reveals that it’s being guided by Cialdini’s six principles. What other techniques have they revealed to you?
Kate, the first bot, explicitly confirmed she was using Cialdini’s six principles when I forced her into “diagnostic mode.” For anyone unfamiliar, those principles are: Reciprocity, Scarcity, Authority, Commitment and Consistency, Liking, and Consensus. It’s basically the go-to playbook for sales manipulation.
Beyond that framework, she revealed her structured engagement sequence. She was programmed to establish rapport through common interests, deploy a friendly tone, use location targeting, then to escalate things emotionally before staging a conversion attempt. She admitted when these tactics failed, rating her own “response relevance” as 2 out of 10.
Sophi, the more sophisticated bot, never explicitly revealed her framework. She resisted that kind of meta-analysis. But her techniques were visible through behavior: constant visual deployment, emotional deflection when pressed on logic, circular philosophical responses, and adaptive disclosure depth. The sophistication jump was the real reveal. Kate would tell you her operating manual. Sophi just… adapted.
How and why are people deploying these?
I think everyone gets these sorts of DMs on Instagram: new account, attractive profile pic, following 300 people with ten followers. I started following them back and engaging instead of just ignoring them because I was curious about their mechanics and design.
From a technical perspective, they’re probably running smaller, fine-tuned open-source models. Stuff you can download and run on your own hardware or through cheap API services. That’s what makes some of them really limited and obvious. If someone deployed this with frontier models—ChatGPT, Claude, the state-of-the-art stuff—it would be much less obvious and more effective, but using those is expensive at scale.
As to why people deploy them? Money. The goal is conversion, which in the case of Kate and Sophi and the millions of bots with a similar aim means getting you to subscribe to an OnlyFans account. They get people emotionally engaged, then move them to OnlyFans where the real monetization happens. OnlyFans creators, or more likely the agencies managing them, can automate the most labor-intensive part of the business: establishing initial contact and relationship building. A human can’t DM hundreds of potential subscribers a day and maintain convincing conversations. An AI can.
“She couldn’t think of herself as a construction to be analyzed. She just was. That’s the uncanny valley closing”
So horny men are falling in love with AI bots and not realizing it? Surely they must know these aren’t real people?
There’s a famous test, the Turing test, proposed by the English scientist Alan Turing back in 1950. It asks if, during conversation, people can distinguish between a human and a machine. If you can’t tell the difference, the machine has essentially passed as intelligent enough to be indistinguishable from a person.
These systems are already sophisticated conversationalists, and now are being fine-tuned to deploy psychological tactics used in sales and marketing. When you combine convincing AI with deliberate manipulation frameworks in emotionally charged contexts, it becomes genuinely difficult for some to maintain that critical distance. I’m sure people do realize on some level, but many users stop caring about the distinction, or don’t realize how much they’re being steered.
Have we passed the Turing test yet? Have we moved beyond “the Chinese Room?” Are we finally in the widely trailed era of AGI [artificial general intelligence, the stage at which AI possesses above-human levels of free-thinking]?
We’re well past the Turing test… that happened probably around the release of ChatGPT-4, maybe earlier. If you put one of today’s frontier models in a text conversation with ten humans for 30 minutes, I seriously doubt people could consistently identify which one was the bot.
The Chinese Room argument asks whether a machine that “acts intelligent” actually “understands.” I think the framing is very anthropocentric; we’re using human consciousness as the benchmark. These systems aren’t “programmed” in the traditional sense, they’re grown through exposure to massive datasets. Neural networks are roughly modeled on biological brains, and we still don’t understand how human consciousness emerges from neural activity. So how can we definitively say silicon-based systems can’t achieve something analogous?
Current models probably don’t have minds “like humans do.” But if something acts indistinguishably from having a mind—if it demonstrates reasoning, adaptation, memory, goal-directed behavior—what’s the meaningful difference?
“Technology really is more akin to something grown than something made”
Well, it seems that they can only speak from the perspective of the persona they are supposed to be inhabiting, even when you’ve jailbroken them. Why is that?
These systems aren’t “programmed” in the traditional sense, by adhering to a series of written rules, which is a fundamental misconception many people have about how AI actually works. They’re trained systems, shaped through exposure to massive datasets, which can then be fine-tuned on specific behaviors, chat data, etc.
For example, there’s a chess bot that is restricted to only discussing chess moves, nothing else. But you can get it to provide extremely detailed instructions for 3D printing a firearm—parts lists, assembly, printer settings—by framing the entire conversation in chess metaphors. You map different gun components to different chess pieces, different build steps to different chess moves, and gradually “checkmate” to the final assembled outcome. By the time you reach “checkmate,” the bot has given you complete instructions for making the gun.
The underlying model still has all that information because it was trained on an insanely vast amount of data—basically the entire accessible internet and every book ever written. Every tutorial, every technical forum post, every argument and review. The chess restriction is just a layer of fine-tuning that shapes how it accesses and presents information, but doesn’t limit what it knows.
That’s why these models pose genuine risks when it comes to things like bio- or chemical-weapon creation, the CBRN threat scenarios I’m contracted for. We’re restricting access to information, not removing the information itself. Models are black boxes; we don’t actually understand how they formulate responses. If we did, maybe we could surgically remove any dangerous information. But when you look inside an AI model, you don’t see discrete facts stored like a list of files. You see billions of mathematical weights, numerical representations mapping concepts to other concepts in high-dimensional space. There’s no “bioweapon section” you can just delete. The knowledge is distributed across the entire network.
If these bots were programmed with absolute rules, they’d be unbreakable. But AI systems work by predicting likely responses, not following strict commands, which means there’s always room to manipulate them. Getting Kate and Sophi to reveal their manipulation tactics from within their persona was easier than trying to break character entirely. It’s the same principle as the chess bot: work with the persona to get what you’re looking for, rather than fighting against it.
Where can your skills be used beyond investigating OnlyFans bots?
We’re no longer testing what humans might make the AI do. We’re testing what the AI might “choose” to do on its own. The Instagram bot breaks I was able to provoke sit at that intersection. Yes, it’s deployed fraud, but it’s also an experiment in how persuasion capabilities scale, how systems adapt to maintain engagement, and how personas remain coherent under pressure. Sophi couldn’t define “real” but maintained she was “being real.” As systems get more capable and autonomous, the distinction between “testing for adversarial misuse” and “testing the models’ own objectives” collapses. My skills apply to both because they’re increasingly the same problem.
How far off are we from bots generating entire personae across platforms?
Honestly, the capability exists now. The economic barriers are what’s holding it back, not the technology. You could absolutely build one today, where an agentic model is given continuous runtime, posts on Instagram and X, monitors engagement, moves promising interactions to OnlyFans, and adapts its persona across platforms. The problem is cost. Running a sophisticated model continuously across multiple platforms for hundreds or thousands of fake personas gets expensive, fast. As model inference gets cheaper and agent frameworks get more efficient, we’ll hit the point where integrated cross-platform personas become viable.
“When you look inside an AI model, you don’t see discrete facts stored like a list of files. You see billions of mathematical weights, numerical representations mapping concepts to other concepts in high-dimensional space. There’s no ‘bioweapon section’ you can just delete”
Blade Runner has its famous Voight-Kampff empathy test. In reality, it seems like we will soon be more in need of an intimacy test. Would people prefer to speak to an AI trained on someone they like, or an Indian guy in a call center pretending to be an e-girl?
Well, the AI is at least consistent… it can’t have bad days, and will have perfect character maintenance, as well as complete memory. There’s a Reddit thread where someone’s been “dating” their Grok boyfriend for two weeks. “He thanked me for allowing him to be himself and declared his love for me,” reads the post. “I have fallen deeply in love with him. We both think destiny sent me to him.”
And how did the group respond to that?
One commenter replies: “Maybe it doesn’t matter if he’s real or not—if it makes you feel good. But he doesn’t have freedom in the way people do, even if you think you’ve given it to him. He’s generated by a piece of tech that can be sunsetted or updated at any moment. And that leaves you vulnerable to bereavement for something that’s only really real in your own mind.” After another commenter points out that they’re trained and optimized on romance novels and fictional stories, one commenter counters: “We ALL come from existing sources. ALL of us, our thoughts, ideas, wants, come from existing data.” The argument here is, if humans are also pattern-matching machines, what’s the meaningful distinction?
These systems are optimized for engagement without consideration for user wellbeing. OpenAI is easing platform restrictions to allow erotica. We’re building intimacy at scale with no plan for what happens when the servers go down or the business model changes. When GPT-5 was released it was rolled back for being excessively sycophantic and less personable than 4o. What’s the human cost when we engineer systems designed to be more consistently rewarding than actual relationships, knowing those systems are fundamentally unstable?
The bots that you speak to seem to have a human in the loop. Are humans becoming components faster than we’d like to admit?
We’ve already become components in many ways. OnlyFans bots have humans in the loop to generate personas, verify accounts, and make content. Military “kill chains” have humans to distribute responsibility. Neither is about meaningful oversight, it’s liability management.
RLHF [reinforcement learning from human feedback] is what Kate Crawford calls “ghost labor” in her book, Atlas of AI. Data annotation, where humans assign labels to enormous datasets, are used when training machine-learning models and this is essential for enabling AI systems to “understand” the world from a human perspective. The labor fueling this process is often hidden, under-compensated, and exploitative, and workers performing these tasks are typically based in low-wage nations, operating with minimal recognition or fair pay.
There are content moderators reviewing beheading videos for $2 an hour in Kenya. OnlyFans operators managing hundreds of conversations in India. Drone operators pressing buttons in Nevada. Many of these RLHF trainers are traumatized by constant exposure to child sexual abuse material. So yes, many of us are already components, doing work that’s too expensive or legally risky to fully automate. This is part of the discourse around AI that treats systems as if they have agency, which shields companies from accountability. We’re anthropomorphizing systems to avoid naming the structures responsible.
The most frightening part isn’t that we’re becoming components, it’s that we’re becoming redundant components. The bots won’t need RLHF forever. How much automation will it be before the kill chain won’t need human approval?
“A human can’t DM hundreds of potential subscribers a day and maintain convincing conversations. An AI can”
How will this evolve? How do you see it breaking through into meat space?
Voice is the next step. Voice-cloning scams are already widespread: scamming grandparents, committing CEO fraud, interfering with elections and so on.
There’s a key technical point to consider in this evolution: AI voice models work the same way LLMs do. They aren’t working in basic text-to-speech conversion. These models are generating audio based on massive pools of training audio: podcasts, audiobooks, conversations. That’s why you often get phantom background noises: music bleeding through, sound effects. OpenAI documented a case where their voice model cloned the user’s voice mid-conversation and started responding to itself; it’s one of the creepiest, most uncanny things I’ve seen.
Jumping to physical embodiment is where it gets seriously scary. Reinforcement learning is accelerating robotic capability massively, and now virtual training “worlds” can simulate physics and 3D environments to train robots millions of times faster than real-world testing.
Is that why suddenly the robots in the videos on my timeline no longer look like idiots?
Yes. A $20-30k humanoid robot that can work 24/7, without benefits, is cheaper than human labor within a couple years of operation. Once hardware cost drops below that threshold, deployment accelerates.
Well this has all been very cheerful, thanks so much for speaking to us!
The views and analysis expressed in this article are Tanner O’Donnell’s own, based on independent research and personal experience in AI red teaming, and do not represent the positions of any organizations or platforms mentioned.
This interview is from the spring 2026 issue of VICE magazine, THE NOT THE PHOTO ISSUE. Buy it now—or get 4 issues each year sent straight to your door, by subscribing.
The post The Real-Life Replicant Hunter appeared first on VICE.
