Is AI Using Your WiFi to Spy On You RIGHT NOW?

If You Have Wireless Internet You Need to Read This

Something in the room you’re sitting in right now might already know your heart rate.

It doesn’t need a camera. It doesn’t need you to say a word out loud. It just needs a signal that’s probably already bouncing off your ribcage as you read this sentence because that signal has been in the room with you the whole time. You just call it Wi-Fi.

That’s not a metaphor and it’s not a pitch for a sci-fi show nobody greenlit. Researchers have already proven it. Not “theoretically possible in a lab somewhere.” Proven and published and in one case already sitting in more than two and a half million American living rooms.

This one is scary.

Your Router Was Already Doing This

Forget every fancy sensor for a second and think about the plain WiFi box you already own. Every signal it sends carries something called Channel State Information. CSI for the acronym-inclined. It’s just the raw physical data describing how the radio wave’s strength and timing shift as it crosses your living room. Your body is mostly water and water bends radio waves. So every time you walk between your router and your phone the signal warps a little on its way through you and that warp gets recorded whether you agreed to it or not.

A team at Carnegie Mellon took that idea somewhere genuinely unnerving. They set up nothing but ordinary TP-Link home routers. The same $30 boxes sold at any electronics store. Arranged as transmitters and receivers on either side of a room. Then they fed the WiFi disruptions into a neural network called DensePose. Meta originally trained that same AI model on camera photos to map every inch of a human body’s surface.

The output wasn’t a blur or a blob. It was a full 3D reconstruction of a human body moving through the room mapped down to 24 separate body regions.

Accuracy held up in a completely dark room and through a closed wall and regardless of what the person was wearing. No camera involved anywhere in the pipeline. Just a $30 router and an AI model that learned to read a human body out of static.

And this is the part that should actually bother you. WPA3 is the encryption your router brags about right there on the box and it does absolutely nothing to stop this. Encryption locks down the data riding on top of the signal. It does nothing to the physical shape of the radio wave itself and your body already bent that wave before encryption ever entered the picture. Somebody in the apartment next door or parked outside on the street doesn’t need your WiFi password for any of this. They just need a receiver and a few hours of patience.

Comcast Already Shipped It

None of this stayed in a university lab either. Since 2020 Comcast’s Xfinity brand has been quietly turning ordinary home routers into motion sensors through a feature called WiFi Motion. It’s built by a company called Cognitive Systems and needs exactly zero new hardware. Pick a few WiFi-connected devices you already own. A smart TV. A game console. A printer. The system watches how your existing internet signal bounces between them. Movement warps the pattern and the app sends you a push notification. Xfinity says it can tell a wandering dog from an actual person which is honestly more attentive than most security guards manage at 3 a.m.

The part buried deeper in the terms of service is who else gets to see that data. Xfinity’s own policy states plainly that this motion information can be shared with law enforcement or other third parties in connection with a legal dispute or a subpoena with no additional notice required. So the same company that can’t reliably get your bill right now keeps a standing log of when you’re home and how much you move around your own living room. As of the last public count that feature was already active on more than 2.5 million routers and climbing.

This was never going to stay one telecom’s side project either. In September of 2025 the IEEE finalized 802.11bf. That’s the official industry standard that teaches ordinary WiFi hardware how to do this kind of sensing properly. By 2026 chipmakers stopped treating it as a novelty. Qualcomm is building it straight into WiFi 7 chips. Huawei already has a commercial version called AirSensing running in office buildings. What started as one company’s weird side feature is quickly becoming a checkbox every router on the planet will eventually ship with standard out of the box whether you asked for it or not.

The Thing Watching You Sleep

That’s what your ordinary internet plumbing can already do more or less by accident. Now picture what happens when someone builds a sensor for this on purpose.

Back around 2014 Google’s advanced projects division shrank radar down to a chip the size of a fingernail and called it Soli. Precise enough to track individual finger twitches at 60 GHz. Google turned it into a party trick in the Pixel 4. Wave your hand and skip a song. It flopped so hard the company quietly buried the whole feature within a year.

Except the chip didn’t die. It moved into your bedroom. The second generation Nest Hub sits on nightstands everywhere right now and runs that exact same 60 GHz radar to track your sleep stages and your breathing and your movement THROUGH THE BLANKET. No camera. No wearable required. It syncs to Google’s servers every single morning while you’re still asleep and have zero say in the matter. Google will tell you this is more private than a camera. Technically true. There’s no photo of your face. But sit with what a radar map of your unconscious body actually hands over that a photo never could. Your breathing pattern at 2 a.m. Whether you tossed all night during a brutal week at work. What your resting heart rate is quietly saying about your stress levels behind your back. That’s more than most of us admit to an actual therapist.

Funny footnote. And I mean funny the way a smoke alarm going off during a real house fire is funny. When Google tried shipping that same chip to India in 2019 the government blocked it outright because the frequency was reserved for military use. A government looked at a fingernail sized consumer chip and said out loud that’s a weapon and not a toy. Google folded rather than pick that fight. Meanwhile it’s sitting on a lot of your nightstands right now and nobody from any government has said a word about it.

Twenty Two Dollars and No Clearance Required

Walk into a lot of newer hotel rooms and look near the ceiling. That little plastic disc that isn’t a smoke detector is radar too and this branch of the family tree traces straight back to the military. Decades ago the Army built the real version of that heartbeat sensor from every shooter game you’ve ever played under a program actually named Sense Through the Wall. Point a device shaped like a temperature gun at a closed door and a blob appears on screen. There’s a person. That’s their heartbeat straight through drywall or brick and a calm 60 beats a minute reads very differently than a spiking 140 does. 140 usually means somebody’s crouched behind that door holding a weapon and hoping you don’t come through it. DARPA later built a version for Special Forces code-named Jetson that allegedly picks one specific person’s heartbeat out of a crowd from 650 feet away because your cardiac rhythm is apparently as unique as a fingerprint. You can change your face. You can change how you walk. You cannot change your heartbeat.

That was the classified decades-of-R&D need-a-clearance-to-see-the-spec-sheet version. None of it stayed that expensive. The hobbyist version of this same radar tech now runs about 22 dollars retail if you shop around and needs no license and no clearance.

Researchers at the University of Dhaka picked up two separate heartbeats through wood and brick using one of these 24 dollar chips and hit 95 percent accuracy doing it. It’s published and peer reviewed which means anyone with a soldering iron and a free Saturday can replicate it in a garage.

This Is Where AI Stops Being a Side Character

That’s the thread running under all of it. WiFi and radar both. A blob of disrupted signal is just a blob. What turns that blob into “this is a specific person, this is their mood, this is their identity” is machine learning. Full stop. And that’s the part accelerating faster than any of the hardware around it.

Just a few months ago researchers published the first public dataset built to train AI systems to recognize human emotion off nothing but radar. Volunteers watched film clips picked to trigger specific feelings while a model learned to read their state off tiny chest vibrations, breathing rate, and posture shifts too small for a human eye to catch. No camera. No face. Just an AI reading a mood off a ribcage like a physics-flavored mood ring. Except this one sees through your shirt and your drywall at the same time. Not a feature Spencer’s ever got around to advertising.

A system called RD Gait can already tell exactly which person walked into a room based purely on the rhythm of their footsteps. It’s been trained and tested across more than a hundred people ranging from small children to retirees. Turns out your walk is a fingerprint too. Stack that on top of the DensePose-from-WiFi work above and here’s the actual endgame. Not “something moved in the living room.” Something closer to that’s you specifically. Your heart rate just spiked. Your walk changed the second you saw the notification. None of that needs a camera. All it needs is exactly the thing every tech company on Earth is racing to build faster and cheaper right now. An AI system smart enough to make sense of noise nobody else could read.

Nobody’s Doing This to You Yet (Probably)

I have to be straight with you here because that’s the whole deal I signed up for. The presence and motion piece is already real and already commercial. Comcast just proved that. What’s not confirmed is the next level up. Some rogue AI agent reaching into your specific router right now to read your specific heartbeat or your specific mood. I’m not going to tell you that’s happening because I don’t actually know that and pretending otherwise would make me exactly the kind of grifter this newsletter exists to expose.

What I can tell you is that the pipes for the next level already exist. They already ship. They get cheaper every quarter.

They’re sitting in devices a lot of you already own or checked into last weekend. That’s not a conspiracy theory.

That’s a purchase order with a shipping date stamped on it. The gap between “technically possible” and “happening to you specifically” is exactly the neighborhood bad actors like to move into quietly because nobody’s watching that neighborhood and nobody needs to break your door down to get in. The sensor’s already inside your house. It came pre-installed.

The Mountain That Gave the Game Away

Still sounds like a stretch? Consider what happened on April 3. An F-15 went down over southern Iran. The weapons officer ejected and crawled into a crack in a mountain and spent the next 48 hours down there with a handgun while his rescue beacon got eaten by the terrain. Search and rescue couldn’t get a clean fix.

So the CIA reportedly reached for a device called Ghost Murmur. It was built by Lockheed’s Skunk Works division. Same shop responsible for the U-2 and the SR-71.

Ghost Murmur allegedly uses quantum magnetometry. That means sensors built on microscopic defects inside synthetic diamonds. Sensitive enough to catch the electromagnetic pulse a human heart throws off with every beat. Then AI strips out the Earth’s own magnetic field until all that’s left is one man’s pulse glowing on a screen from 40 miles away. He got found. He came home. CIA Director John Ratcliffe stood at a White House podium afterward and credited “exquisite technologies that no other intelligence service in the world possesses.”

Physicists lined up almost instantly to call foul. Fair enough. Earth’s magnetic field is roughly a million times stronger than a heartbeat’s own signal. Finding one pulse through solid rock from 40 miles out sounds like something a screenwriter invented after three energy drinks. Maybe it’s theater. Maybe the real method is even stranger and still classified six ways from Sunday. Nobody outside a clearance office actually knows for certain and neither do I.

What we do know for certain is that every rung of the technology underneath that rescue is real and published and sitting in a store or a router near you right now. You don’t have to believe the CIA can hear a heartbeat from 40 miles out to lose sleep over what the WiFi signal already bouncing around your own living room can do tonight.

Turn Off the Puck That’s Reading Your Pulse

You cannot Faraday cage your way out of modern life and anyone selling you a 400 dollar anti-radar phone case is selling you a rock with extra marketing. You’re not helpless though. Let’s fix what’s actually fixable.

Start with your own router. Log into the admin panel and check for a “motion detection” or “presence sensing” feature. If you’re on Xfinity specifically open the app and look for WiFi Motion by name. It’s supposed to be opt-in but plenty of users report finding it already switched on so check rather than assume. If you own a second generation Nest Hub or something similar dig into its settings and turn off Sleep Sensing specifically. It lives on its own separate toggle that most owners never discover. Unplug smart displays and voice assistants from any room where you actually want privacy. The bedroom especially. Don’t assume a black screen means the thing stopped listening.

Next time you check into a hotel look for a small disc near the ceiling that isn’t a smoke detector or a sprinkler head. If it bugs you just ask the front desk whether the room has occupancy sensors and what they log. Front desk staff generally know and most will tell you straight provided you ask like a normal human being and not somebody who thinks the ceiling tiles report directly to a shadow government (even if in this one specific case they kind of might).

Push the state level angle too because the federal one just closed. The sensing standard already shipped so the real fight now is over who’s allowed to use it and what they can do with what it sees. Illinois has one of the strongest biometric privacy laws on the books. It’s called BIPA and it’s already been used to successfully sue companies harvesting biometric data without consent. Those laws were written with fingerprints and faceprints in mind and not radar or WiFi signatures. But courts are starting to treat a unique cardiac rhythm or a unique gait the exact same way. That fight is happening in courtrooms right now and it’s one of the only real brakes on any of this.

Mostly just know what’s actually in the room with you. Knowing that disc in the corner isn’t a smoke detector changes how a person carries themselves in that room. Knowing your own router can already tell when you walked into the kitchen means you quietly stop assuming silence equals privacy. The heartbeat inside that Iranian mountain and the heartbeat on your nightstand tonight got pulled out of the exact same physics. One of them found a hero and brought him home. The other one is just sitting there right now. Charging. Quietly logging your 3 a.m. Never once asking permission first. Waiting for the day the software catches up to the hardware it’s already sitting on.

---

If this piece rewired how you look at the blinking box in your own bedroom that’s the whole job done. But here’s the part where I ask for something back. Sharing this article costs you nothing and it’s honestly the single biggest favor you can do us. Every new free reader is a shot at a future paid one and every paid one is what actually keeps this operation running. Lily is currently spending her summer wrangling other people’s children at a camp instead of doing investigative journalism full time. That’s a criminal misuse of a journalism degree if I’ve ever seen one. My actual goal isn’t the cute aspirational one. It’s simple. Get The Wise Wolf to a place where I can hire her on for real this fall and pay her what she’s actually worth instead of what a Substack side hustle can currently scrape together. If you can go paid that’s the fastest way there. If you can’t right now share this with one person who still thinks their smart speaker is just a speaker. Either one moves us closer and either one means Lily gets to trade a summer camp lanyard for an actual paycheck.

Help keep the Wise Wolf howling.

Grab a bucket and help The Wise Wolf extinguish the ‘Great American Dumpster Fire’ before it burns the world.