Researchers at King Abdullah University of Science and Technology (KAUST) have identified a potential privacy risk in commercial virtual reality (VR) headsets, showing that built-in motion sensors may capture subtle physiological signals linked to users’ visual responses.
The study found that artificial intelligence can analyze motion sensor data to reconstruct brain-related information associated with visual perception. Because these sensors are commonly accessible to applications running on VR devices, malicious software could potentially collect the data and infer sensitive information without users’ awareness.
The researchers developed a system called BRAVESPY and tested it on several commercially available VR headsets. Their findings expand existing concerns about VR privacy, as previous research has shown that sensor data can reveal activities such as typing, speech patterns and application use.
The team stressed that the research aims to identify security weaknesses and support stronger privacy protections. Suggested safeguards include tighter permission controls, better management of sensor access and technical measures to reduce the amount of information applications can extract.
Presented at the IEEE Symposium on Security and Privacy, the study also highlights opportunities for using existing VR hardware in low-cost brain-computer interfaces for healthcare, education and human-computer interaction.
As immersive technologies become more widespread, the findings underline the need for privacy and security standards to keep pace with technological development.
