A universal brain decoder and Neuralink’s 50,000-hour foundation model point the same way: neural privacy is turning from a property of your data into a property of everyone’s model.
The control nobody wrote down
Every security architecture has controls nobody designed. They exist by accident: a system too slow to abuse at scale, a dataset too awkward to be worth stealing, a process that needed a human in the room. Attackers love these, because the day the accident gets fixed, the control disappears and nobody notices it was ever there.
Neural privacy has had one of these for as long as brain decoding has existed. It is called calibration. Two stories from the last week suggest it is about to be engineered away.
Forty hours down to one
On 1 October, MIT Technology Review reported on work from Michal Irani’s group at the Weizmann Institute of Science: an AI system that reconstructs the image a person is looking at from an fMRI scan, keeping structure and position close to the original, and that can also run the other way, predicting brain activity from an image [1]. The team trained on publicly available data from eight people who had each viewed around 9,000 images in a high-resolution scanner, then used an encoder to generate predicted brain responses so the decoder could keep learning from images nobody had actually seen in a scanner. Irani says around 70 percent of the training data came from images never paired with a scan [1].
The part that matters to me is not the pictures. It is the calibration number. Earlier tools typically needed about 40 hours of fMRI data on a new person before they could predict what that person was seeing. Irani’s “universal brain encoder” works on a new person with about one hour, because by combining data across studies it learned brain regions that seem to share function across individuals [1]. UC Santa Barbara neuroscientist Tommy Sprague put the old barrier in dollars: nobody can afford 40 hours of imaging per subject at $600 to $1,000 an hour [1].
A day later, Neuralink published a technical update describing a foundation model pretrained on more than 50,000 hours of neural activity streamed by its clinical trial participants [2]. The company says some decoders built on it kept working for weeks instead of days, and for some participants calibration fell from about ten minutes a day to ten minutes a week [2]. It claimed a cursor-control record of 11.32 bits per second and said that beats most able-bodied people, a comparison nobody has independently verified, and the work has not been peer reviewed [2]. Neuralink also said it is looking at pooling neural data across participants and at one-shot or zero-shot calibration, and floated an “API for the motor cortex” [2].
Different modalities, different organizations, different goals. Same direction of travel. Less of you is needed, because more of everyone else has already been learned.
Calibration was a consent mechanism
Think about what a 40-hour calibration did in security terms. It worked like an authentication factor. To decode a specific person’s brain you needed that person’s sustained, active cooperation: lying still in a scanner, looking at what you told them to look at, for days. Sprague makes the point himself when he says that ten years ago he would have laughed at the idea of reading someone’s thoughts against their will, because getting a willing person to engage is hard enough [1].
That cooperation requirement did quiet work. It meant the only brains anyone could read were brains whose owners had agreed, at length, to be read. No legislature wrote that rule. Economics and physics did.
Foundation models go straight at that factor. They do not need much of you, because the expensive part, learning how brains map to images or to movement, has already been paid for by other people. For patients this is a real gift. A paralyzed user who has to recalibrate every morning carries a burden, and cutting that to once a week matters [2]. A locked-in person who could communicate after an hour of setup instead of weeks would be better off [1]. I am not arguing against any of that. I am arguing that we should notice what got removed along the way. In access-control terms, the field is moving from per-person enrollment toward something closer to a shared master profile, where most of the work of recognizing you was done before you ever showed up.
The law was written for a world of unique brains
Here is where it gets uncomfortable for regulators. Colorado’s 2024 neural data law opens with legislative findings, and one of them reads: “Every human brain is unique, meaning that neural data is specific to the individual from whom it was collected” [3]. The same findings say the collection of neural data “always involves involuntary disclosure of information,” and that users are unlikely to understand how far their data can be decoded, “currently or in the future” [3].
The second finding has aged well. The first is the one foundation models are eroding. Brains are unique, but decoders are increasingly trained on what brains share. That is exactly how one hour replaces forty.
Now look at how the protections are built. California’s amendment to its consumer privacy law, signed months after Colorado’s, classifies neural data as sensitive personal information and defines it as information “generated by measuring the activity of a consumer’s central or peripheral nervous system,” giving that consumer rights to request, delete and restrict its sharing [4]. Colorado’s definition likewise attaches to the measurement of “an individual’s” nervous system [3]. Both frameworks protect a record, tied to a person, and hand that person rights over it.
A pretrained decoder is not that record. It is what gets learned from many records and then pointed at somebody else. If I delete my scans after the model is trained, the capability they helped build stays exactly where it is. And the stranger it is later calibrated against, in an hour, never agreed to anything that happened in the training set. Consent is individual. The risk has gone collective.
Where the reassuring case is right, and where it stops
Let me give the reassuring case its due, because it is not wrong. Irani’s system runs on fMRI, a room-sized magnet you cannot aim at someone in a coffee shop [1]. Neuralink’s model is trained on intracortical signals from people with surgically implanted devices who enrolled in a trial [2]. Neither is a covert surveillance tool today, and Irani says she is not worried about misuse for now [1].
The people who study this for a living are already looking past fMRI, though. Marcello Ienca at the Technical University of Munich calls a move to EEG a “game changer,” because once an EEG device has been calibrated to a user it could be relatively easy for companies to extract additional information from that person’s brain, potentially without consent [1]. Sprague thinks Irani’s approach would probably work quite well at predicting images a person is imagining rather than viewing [1]. Irani’s own roadmap runs to video, audio, imagined content and dreams [1].
And the consumer market is not waiting. A Davis Wright Tremaine analysis from May notes that devices reading brain and muscle signals are now shipping to consumers at commercial scale, that the federal MIND Act has not advanced, and that a 2024 Neurorights Foundation survey found 29 of 30 consumer neurotechnology companies appeared to allow access to users’ neural data with no meaningful limitations [5]. Put a universal decoder on top of that market and the calibration wall is not just lower. It becomes optional.
Treat the decoder like a credential
From where I sit, the fix is not to stop the science. It is to move the control to where the capability now lives.
In security we learned long ago that a credential is not just a secret. It is a capability: whoever holds it can do whatever it unlocks. A trained neural decoder is the same kind of object. Given a small amount of a new person’s signal, it unlocks information about that person’s mind. So govern it the way we govern any powerful credential. Know who holds each model. Bind it to a declared purpose, so a decoder trained to move a cursor for a paralyzed patient cannot quietly become a decoder for preference, attention or emotion. Log every new person it gets calibrated against. And give the people whose signals built it a say in how it is used, not just a delete button for the raw files.
The DWT authors raise a fiduciary framing, the idea that neurotechnology companies should owe users duties of loyalty and care regardless of what the terms of service say, and they note that critics consider such duties unworkable against obligations to shareholders [5]. I do not need to settle that fight to make a narrower point. Whatever framework wins has to attach to models, not only to records, or it will be guarding the part of the system that matters least.
What we are becoming
We like to talk about human augmentation as hardware: implants, prosthetics, interfaces. The quieter change is that our minds are becoming legible in aggregate. Every volunteer who lies in a scanner or streams motor cortex activity makes the next person cheaper to read. That is a new kind of shared exposure, and nothing in our privacy vocabulary describes it well yet.
Calibration used to be the wall. It was never a good wall, because nobody built it on purpose. Now that it is coming down, we get to decide what replaces it. If we decide nothing, the answer will be decided for us by whoever holds the biggest model.
About the Author
Len Noe is a Solutions Architect at BeyondTrust, Transhuman, Podcaster, International Cyber Security Speaker, Author, Technical Evangelist, and Biohacker with 11 implanted microchips. A former blackhat and ex-1% motorcycle club member with more than 30 years in technology, he has presented in over 70 countries and is featured in the documentary I Am Machine, which premiered at DEF CON 2025.
References
- Jessica Hamzelou. “An AI ‘mind-reading’ tool can reconstruct what you’re looking at from a brain scan.” MIT Technology Review, 1 October 2026. technologyreview.com
- Neetika Walter. “Neuralink trains on 50,000 hours of brain data, hits 11.32-bit/s cursor record.” Interesting Engineering, 2 October 2026. interestingengineering.com
- Colorado General Assembly. House Bill 24-1058, “Concerning protecting the privacy of individuals’ biological data, and, in connection therewith, protecting the privacy of neural data and expanding the scope of the ‘Colorado Privacy Act’ accordingly” (enrolled act), 2024. Copy hosted by Davis Wright Tremaine: dwt.com
- Perla Khattar. “Neural Data and Consumer Privacy: California’s New Frontier in Data Protection and Neurorights.” Tech Policy Press, 19 November 2024. techpolicy.press
- Wendy Kearns, Elyse Sparks, Nancy Libin and Jeremy Ben Merkelson. “All the World’s Neural Data, No Common Rule.” Davis Wright Tremaine LLP, Privacy & Security Law Blog, 28 May 2026. dwt.com