A security paper maps five ways to attack an EEG headset

Five researchers, among them Anil Madhavapeddy of the University of Cambridge, posted a preprint to arXiv on 8 September 2026 setting out a taxonomy of attacks against brain-computer interfaces. They name the class NERVE, after its five dimensions: neuro-mimetic forgery, evasion via desynchronization, replay-based hijacking, vein tapping, and embedded backdoors.

The argument is that a BCI’s attack surface is not an ordinary device’s attack surface, because the signal being carried is neural and the thing on the far end may be physical. The stated stakes are cognitive autonomy, mental privacy and physical safety — neural data exfiltrated, or a BCI-tethered device driven by someone other than the person wearing it.

To test the taxonomy the authors built EEGle, an evaluation framework they are releasing, and report 17 attack instances specific to neural systems rather than inherited from general computer security. They describe a stealth-versus-effectiveness spectrum particular to BCI backdoors, and note that generative models lower the expertise an attacker needs.

This is a preprint: it has not been peer reviewed and names no venue. The evaluation is on EEG systems worn on the head, not on implanted ones — the attacks are demonstrated against the consumer end of the stack, which is also the end with the fewest medical-device obligations attached to it.