Researchers at The University of Texas MD Anderson Cancer Center have identified immune cell and tumor-specific features in triple-negative breast cancer (TNBC) that may help predict which patients are most likely to respond to chemotherapy before treatment begins, according to a study published in Nature. Using single-cell and spatial transcriptomic analyses of pretreatment tumor samples, the team identified specific macrophage subtypes and cancer-cell gene expression programs associated with response to neoadjuvant chemotherapy (NAC). The team also developed a 13-gene panel and a machine learning model that could help classify tumors according to their likelihood of responding to chemotherapy.
“This study provides novel insights into the gene-expression programs and the different cell states of the tumor microenvironment in patients with triple-negative breast cancer,” said Nicholas Navin, PhD, chair of systems biology at MD Anderson. “Importantly, we’ve identified certain programs and macrophage subtypes that are associated with good responses to neoadjuvant chemotherapy, which has tremendous potential to improve patient outcomes.”
TNBC accounts for between 10% and 20% of breast cancer cases. Because it lacks estrogen, progesterone, and HER2 receptors, treatment options are limited, resulting in a higher rate of recurrence compared with other form of breast cancer. Chemotherapy is the main treatment approach, particularly in early-stage disease, where neoadjuvant chemotherapy can achieve pathological complete response in 40% to 50% of patients. However, treatment outcomes vary widely from patient to patient, and researchers have been looking for ways that can better predict response before therapy begins.
For this study, the researchers analyzed pretreatment core biopsy samples from treatment-naive patients with early-stage TNBC. They performed single-cell RNA sequencing on 427,857 cells collected from 101 patients and spatial transcriptomic profiling on tumors from 44 patients. The findings also were compared with normal breast tissue data from the Human Breast Cell Atlas.
Based on their testing the researchers classified TNBC tumors into four patient-level “archetypes” based on cancer-cell gene expression patterns. They also identified 13 metaprograms that reflected heterogeneity within tumors at the single-cell level.
The tumor microenvironment consisted of 49 immune and stromal cell states organized into eight cellular communities, or ecotypes, defined by the co-occurrence of cancer cells and surrounding immune cell populations. Researchers found these cellular neighborhoods were associated both with tumor archetypes and chemotherapy response.
The study homed in on macrophages, a type of immune cell that has received less attention in TNBC research than T cells. The investigators said that seven of eight macrophage cell states were significantly associated with treatment response, while none of the 14 T-cell and natural killer-cell states showed significant associations with NAC response.
Macrophage subtypes linked to interferon signaling and complement activity, identified as Mac-IFN and Mac-lip-C1Q, were more abundant in patients who achieved pathological complete response. By comparison, two macrophages associated with angiogenesis and extracellular matrix remodeling, called Mac-angio and Mac-ECM, were enriched in patients with residual disease after chemotherapy.
The team also found that tumors linked to good response to NAC showed increased interferon signaling and elevated expression of human leukocyte antigen class II genes. Researchers said these findings indicate that cancer cells themselves may actively participate in modulating immune signaling related to chemotherapy response.
As part of their work, the researchers developed a 13-gene transcriptional signature panel developed from the single-cell analyses that can be used as a predictive model for chemotherapy response. Researchers said the model’s predictions correlated with chemotherapy response and overall survival across multiple public TNBC cohorts.
These new findings have the potential to influence how patients with TNBC are treated in the future by helping clinicians identify which patients are more likely to benefit from standard chemotherapy and which patients may need alternative therapeutic strategies earlier.
In addition, “these findings suggest that targeting specific macrophage subtypes could potentially provide new therapeutic opportunities in TNBC,” the researchers wrote.
The MD Anderson team noted that the study is one of the first large-scale single-cell genomic studies of TNBC integrating cancer cells, immune cells and treatment-response data. Earlier research exploring tumor heterogeneity has often lacked therapy response information, focused only on cancer cells or immune cells separately, or included relatively small patient cohorts.
Whether single-cell RNA seq could eventually become a basis for predictive diagnostics remains an open question. Today, the method is still expensive and technically challenging, two hindrances to it wider adoption. The researchers noted, however, that advances in sample multiplexing and other methods compatible with formalin-fixed paraffin-embedded tissue could make it feasible in the future.
Clinton Yam, MD, an associate professor of breast medical oncology at MD Anderson, said the findings could support more individualized approaches to TNBC care.
“These insights provide an important foundation for improving our understanding of why different TNBC tumors respond differently to chemotherapy, and the findings have strong potential to inform future strategies aimed at better predicting treatment response and guiding more individualized care for patients with triple-negative breast cancer.”
Future research will focus on validating the predictive models in prospective patient cohorts and evaluating TNBC treated with chemo-immunotherapy, which has become the standard of care when TNBC is detected early. The researchers also plan to study longitudinal tumor samples collected before, during, and after treatment to better understand how cancer cells and the tumor microenvironment evolve over time and how those changes relate to chemotherapy response and survival.
Arriving in the isolation ward of a biocontainment hospital is an unsettling, scary experience. In 2014, I spent 19 days in one while being treated for Ebola, watching the news cycle churn around me as my world receded to a small window, a phone, and the handful of providers in protective suits who came into my room every day.
More than a dozen Americans are living some version of that right now in a Nebraska quarantine facility — passengers from the MV Hondius, the cruise ship that is at the center of a small but instructive outbreak of Andes hantavirus.
Scientists have developed a sensor platform that can monitor cerebrospinal fluid (CSF) in intensive care unit patients, overcoming major delays in diagnosis associated with current testing methods. A study published today in Science Translational Medicine reports that the NeuroSense platform can provide near real-time readings of four key biomarkers every 27 minutes, with results accurately reflecting standard clinical measurements.
In neurological intensive care units, external ventricular drainage (EVD) systems are routinely used to temporarily assist patients with drainage of excess CSF, manage postoperative complications and monitor intracranial pressure. However, the use of these devices carries a high infection risk, with rates reaching up to 20% of patients.
Delayed diagnosis of these infections can lead to severe meningitis, neural damage, cognitive impairment, permanent disability, or even death. However, current testing methods are labor-intensive and require sending samples to external laboratories for biomarker analysis and manual inspection. This limits testing to every one to two days, significantly delaying clinical decisions that can be critical for preventing severe complications.
“To address these limitations, we developed NeuroSense, a multiplexed sensing platform that integrates with standard external ventricular drainage systems to enable near real-time monitoring of key CSF biomarkers, including glucose, lactate, pH, and flow rate, that are essential for detecting infection and drain dysfunction,” write the study authors.
The NeuroSense platform employs aptamer-based biosensors to detect glucose and lactate levels in CSF, which are key markers of bacterial infections. These types of biosensors are more stable and have a longer shelf life than conventional enzymatic biosensors, ensuring the platform can consistently and accurately track these markers for the entire time EVD systems remain in place, typically between five to 10 days.
Furthermore, an impedance-based sensor measures CSF flow rate to monitor for potential catheter obstructions or incorrect EVD settings, while a polydopamine sensor keeps track of pH changes, which can indicate acidosis, hemorrhage, infection, or a disrupted blood-brain barrier.
The platform’s performance was evaluated in a small-scale study that recruited six patients with EVDs hospitalized in the intensive care unit. Every four hours, readings from the NeuroSense platform were compared with those from standard testing methods, revealing a strong correlation between the sensor platform and clinical reference measurements.
A survey of the healthcare providers and clinicians involved in the study further showed that most participants found the platform easy to use, as it integrates with standard EVD systems routinely used in the intensive care setting.
Going forward, the researchers plan on further improving the performance of the pH sensor and continue developing the platform to comply with regulatory requirements for running large-scale clinical studies and eventually making the platform available to healthcare providers.
“Beyond infection detection and EVD assessment, NeuroSense enables higher temporal-resolution tracking of CSF biomarkers and flow dynamics, supporting earlier recognition of evolving trends that may be missed with intermittent sampling,” write the researchers. “Although the current system measures glucose, lactate, pH, and flow, the platform is modular and can accommodate additional sensors in future iterations. By providing near-bedside, actionable insights into patients’ neurological health, NeuroSense has strong potential to enhance clinical decision-making and improve patient care.”
Background: Accurate transcription of pathology gross examination dictation is important for clinical documentation, but multilingual dictation remains challenging in settings where clinicians mix Chinese and English while final pathology reports are written in English. Objective: This study aimed to evaluate whether a Whisper-based automatic speech recognition (ASR) pipeline guided by contextual system messages and combined with open-source large language models (LLMs; Qwen2:72b, Llama3.1:70b, Gemma2:27b) could improve multilingual (Chinese-English) pathology dictation transcription accuracy and generate clinically appropriate English gross description reports. Methods: We conducted a controlled proof-of-concept study using 125 simulated mixed Chinese-English pathology gross examination audio recordings created by physicians or pathologists. Audio recordings were transcribed using Whisper ASR with and without a contextual system message. The ASR transcripts were then converted into English gross description reports using 3 open-source LLMs: Qwen2:72b, Llama3.1:70b, and Gemma2:27b. Outcomes included character error rate, Bilingual Evaluation Understudy, Recall-Oriented Understudy for Gisting Evaluation (ROUGE)-1, ROUGE-2, ROUGE-L, Metric for Evaluation of Translation with Explicit Ordering, pathologist Win-Tie-Lose rankings, report-level error categories, inference time, and interrater agreement. Results: The ASR contextual system message reduced the mean character error rate from 0.344 (SD 0.176; 95% CI 0.313‐0.375) to 0.066 (SD 0.100; 95% CI 0.048‐0.084; <.001). Qwen2:72b achieved the highest automated metric scores, including a Bilingual Evaluation Understudy of 0.644 (SD 0.307), ROUGE-1 of 0.866 (SD 0.163), ROUGE-2 of 0.771 (SD 0.235), ROUGE-L of 0.842 (SD 0.178), and Metric for Evaluation of Translation with Explicit Ordering of 0.805 (SD 0.214). Pathologist-coded total error rates were 16.8% (21/125) for Qwen2:72b, 45.6% (57/125) for Llama3.1:70b, and 92.8% (116/125) for Gemma2:27b. The exact agreement between the 2 pathologists across full ranking categories was 76.8% (96/125; Cohen κ=0.668), and agreement on the top-ranked model or tied top group was 81.6% (102/125; Cohen κ=0.722). Conclusions: In this proof-of-concept evaluation, contextual prompting improved ASR transcription accuracy, and Qwen2:72b generated the most accurate English pathology reports among the evaluated LLMs. However, the study used simulated audio recordings, a local vocabulary prompt, and report-level rather than term-level clinical annotation. LLM-generated reports should therefore be considered draft documentation requiring pathologist verification, and prospective validation in real clinical workflows is needed before clinical deployment.
Antibiotic resistance is on the rise around the world, creating an urgent need for faster and more dependable approaches to design antimicrobial candidates. While AI-driven methods have accelerated antimicrobial discovery, most have focused on screening fixed libraries or generating broad candidate sets.
Now, researchers at the University of Pennsylvania have developed ApexGO—a novel, AI-powered method that starts with a small number of candidates and improves them, using a predictive algorithm to evaluate each modification and guide the next.
“Antibiotic discovery is fundamentally a search problem across an enormous molecular space. ApexGO gives us a way to navigate that space with far more direction,” says César de la Fuente, PhD, presidential associate professor in the School of Engineering and Applied Science at UPenn.
“What is striking is that ApexGO’s predictions held up in the real world,” says Jacob R. Gardner, PhD, assistant professor in computer and information science (CIS) at UPenn. “ApexGO was optimizing against another computer model, so one concern was that it might find molecules that looked good to the model but failed in the lab. Instead, the majority of the molecules it designed actually worked.”
indeed, 85% of the AI-generated molecules halted bacterial growth, while 72% outperformed the peptides from which they were derived. In mice, two antimicrobial peptides created by ApexGO reduced bacterial counts at levels comparable to the antibiotic polymyxin B.
“This result points toward a future in which we can optimize molecules for a desired function in a fraction of the time,” adds de la Fuente, “using machines to guide discovery through chemical spaces too vast for humans to explore by trial and error.”
For years, the de la Fuente lab has looked for antibiotic candidates in unlikely places, from frog secretions to ancient microbes. Two years ago, the group released APEX, an AI model that predicts whether or not a given peptide is likely to have antimicrobial properties.
“APEX helped us find promising antibiotic candidates in enormous biological datasets,” says Marcelo Torres, PhD, research assistant professor of psychiatry in the Perelman School of Medicine. “ApexGO takes the next step: once we have a promising molecule, it helps us ask how to make it better.”
One part of ApexGO (short for APEX Generative Optimization) suggests molecular tweaks, while the previously published APEX model predicts whether those changes are likely to increase antimicrobial activity. ApexGO then uses those predictions to guide the next round of proposed edits.
While some of the molecules proposed by ApexGO showed promising antibiotic activity, the researchers emphasize that even the best-performing peptides are still early-stage candidates. Before any could be used to treat infections in humans, they would need to be further optimized for safety, stability, and how long they remain active in the body.
Still, the study suggests that AI can help researchers decide which molecules are worth making and testing in the first place. For de la Fuente, the approach could eventually extend beyond antibiotics. “In this case, we wanted to optimize peptides for antimicrobial activity,” he says. “But you could imagine applying the same idea to peptides with other biological functions, like modulating the immune system or targeting tumors.”
“ApexGO shows that AI can do more than predict which molecules might work: it can help us improve them,” adds de la Fuente. “At a time when antibiotic resistance is rising worldwide, we need technologies that help us move faster from an idea to a real therapeutic candidate. ApexGO is an important step toward that future.”
What you’re describing sounds really overwhelming. I’m glad you reached out. The fears you mention — being scared of doing something against your will, worrying you might not have control, and feeling intensely concerned about being judged — are patterns I often see in people with anxiety and, sometimes, people with obsessive-compulsive disorder (OCD). A hallmark of OCD is a deep doubt about control: the fear that you might act in a way that goes against your values, even though you don’t want to. These kinds of fears are called intrusive thoughts. While intrusive thoughts can feel very real and frightening, they are not things you actually intend to do or predictions of things that you will do — they’re unwanted experiences that don’t define you.
Avoiding sports and other things for fear of being judged is also a symptom of anxiety. I can understand how hard it is to tell your family what you’re going through, especially if you have felt ignored in the past. At the same time, your pain deserves to be heard and taken seriously. I encourage you to try talking to your parents again, but if you truly feel like you can’t, consider telling one safe person — whether that’s another family member, a school counselor, or even a teacher you trust. You can write how you’re feeling in a note if speaking feels too hard.
The physical symptoms you mentioned — neck and shoulder pain, fidgeting — are also common in anxiety because our bodies can hold tension when our brains are on high alert. What this likely means is that your brain is caught in a fear loop, constantly scanning for danger around control and judgment.
The good news is that this is very treatable. A mental health professional may recommend a type of cognitive behavioral therapy called exposure and response prevention (ERP). ERP helps you gradually face the situations or thoughts you fear instead of looking for reassurance from someone else or avoiding those situations or thoughts altogether. Over time, ERP teaches your brain that thoughts are just thoughts, not actions, and that you can tolerate uncertainty without something bad happening.
For now, you might try gently labeling upsetting thoughts as anxiety, not facts, and practicing not accepting them as true when they show up. Taking small steps toward what you’ve been avoiding can help you rebuild your confidence, even if it feels uncomfortable at first.
While you can practice managing anxiety or intrusive thoughts on your own, it’s better to have help. Once you talk to someone you know and trust, have them help you reach out to a mental health professional who can provide a more thorough assessment and the appropriate treatment for you. You don’t have to go through this alone, and with the right support, this can get much better.
A personalized DNA vaccine targeting up to 40 patient-specific neoantigens generated robust immune responses and encouraging survival outcomes in patients with MGMT-unmethylated glioblastoma in a small Phase I clinical trial, according to new findings published in Nature Cancer.
The study evaluated GNOS-PV01, a personalized therapeutic cancer vaccine developed by Geneos Therapeutics in collaboration with researchers at Washington University School of Medicine in St. Louis. Investigators reported that the vaccine was safe, feasible to administer, and capable of stimulating circulating and tumor-infiltrating T-cell responses in a cancer type long considered highly resistant to immunotherapy.
Glioblastoma remains one of the deadliest cancers, with median survival typically ranging from 12 to 18 months. Patients with MGMT-unmethylated disease face especially poor outcomes because they derive limited benefit from temozolomide, a standard chemotherapy agent commonly used after surgery and radiation.
“Nothing really works in this MGMT-negative or unmethylated glioblastoma patient population,” said Niranjan Sardesai, Geneos’ CEO. “Median survival is around a year, and effective treatments are very much needed.”
The open-label, single-arm GT-20 study enrolled nine patients with newly diagnosed MGMT-unmethylated glioblastoma following surgical resection and radiation therapy. Each patient received a fully individualized vaccine constructed from neoantigens identified through sequencing of their own tumors. Vaccines encoded between 17 and 40 neoantigens per patient.
According to the paper, the vaccine caused no serious adverse events, unexpected toxicities, or dose-limiting toxicities. Eight of the nine evaluable patients developed measurable immune responses. The lone nonresponder had been treated with dexamethasone, an immunosuppressive corticosteroid frequently used in glioblastoma management.
Sardesai emphasized that the immunogenicity findings were particularly notable because glioblastoma is considered an “immune-excluded” tumor with low tumor mutational burden, characteristics that have historically limited the effectiveness of checkpoint inhibitors such as anti–PD-1 therapies.
“Checkpoint-based immunotherapy has not worked in GBM,” he said. “This is a cold tumor.”
The investigators also observed signals of clinical activity. Six-month progression-free survival and 12-month overall survival were each achieved in 66.7% of patients. Median progression-free survival was 8.5 months, while median overall survival reached 16.3 months. Survival at 24 months was 33%, including one patient who remains alive four years after surgery.
“What was very striking was that three of nine patients, or one-third of the patients, had lived more than two years,” Sardesai said. “The two-year survival rate is about 10% to 15%” with standard treatment approaches in this population.
The study also identified an association between stronger CD8-positive T-cell responses and longer survival. Investigators reported that patients generating higher levels of vaccine-induced cytotoxic T cells tended to experience improved overall survival.
One of the most compelling findings involved a long-term survivor who has remained progression-free for nearly five years. Researchers analyzed a brain biopsy obtained approximately three years after treatment initiation and identified vaccine-induced T-cell clones within the tumor tissue that matched T-cell populations detected in the patient’s blood.
“For the first time, we are able to match vaccine-driven immune responses,” Sardesai said. “We are able to see T-cell clones in the blood, and these T-cell clones have infiltrated and are found in her brain.”
The vaccine platform differs from earlier glioblastoma vaccine strategies in several ways. Rather than targeting a small number of antigens, the DNA-based approach allows investigators to incorporate a much larger neoantigen repertoire into each personalized product.
“These patients received as many as 40 different antigens that were identified from their own tumor,” Sardesai said. “Prior treatments had typically been looking at 20 or fewer in GBM.”
He argued that broader antigen targeting may be especially important in glioblastoma because of the disease’s pronounced intratumoral heterogeneity.
“When it comes to targeting cancer, more is better,” he said. “You want to take more shots on goal.”
Another distinguishing feature of the platform is its apparent ability to stimulate CD8-positive killer T cells, which are considered critical for direct tumor cell elimination. Sardesai noted that generating robust CD8 responses has historically been difficult for many cancer vaccine technologies.
Importantly, each vaccine is uniquely manufactured for a single patient.
“These are exquisitely personalized vaccines,” Sardesai said. “Every patient gets their own vaccine.”
The authors cautioned that the findings remain preliminary because of the trial’s small sample size and lack of a control arm. Still, they believe the results justify larger randomized studies.
“We are very encouraged by the data,” Sardesai said. “But this is still only nine patients. We have to replicate these findings in larger, well-controlled studies.”
The company has previously reported results using the same platform in hepatocellular carcinoma, suggesting the strategy could potentially extend across multiple tumor types characterized by immune exclusion and low tumor mutational burden.
“All cancers carry neoantigens,” Sardesai said. “These personalized cancer vaccines provide a very convenient way” to target those tumor-specific alterations across different cancers.
Transcriptomic analysis of more than 100 metastatic renal cell carcinomas (mRCC) has revealed key differences in aberrant alternative gene splicing events between treatment responders and nonresponders that could aid prognostication in future.
“In the near term, these findings could help guide treatment selection by identifying patients more likely to respond to targeted therapies or standard immuno-oncology regimens,” said Patrick Pirrotte, PhD, director of the Integrated Mass Spectrometry Shared Resource at TGen and City of Hope, associate professor in TGen’s Early Detection and Prevention Division, and senior author of the paper.
“Longer term, splicing-derived antigens could provide a foundation for more personalized adoptive immunotherapy strategies tailored to the molecular features of an individual patient’s tumor,” he told Inside Precision Medicine.
Pirrotte explained that “alternative splicing [AS] is a fundamental transcriptional mechanism that expands proteomic diversity in normal cells, but aberrant splicing is increasingly recognized as a feature of cancer that can contribute to tumorigenesis, progression, and metastasis.”
His group, and collaborators, have previously demonstrated that aberrant splicing could act as a broadly relevant biomarker across different malignancies, including ovarian cancer and sarcomatoid renal cell carcinoma, but its diagnostic and predictive potential in mRCC remained largely unexplored.
To address this, Pirrotte and team conducted a retrospective analysis on tumor samples from 101 patients with mRCC who received immune checkpoint inhibitor (n=91) and/or targeted (n=77) therapies. Response rates to each of the therapies were 63% and 77%, respectively.
The researchers report in the Journal for ImmunoTherapy of Cancer that they identified 10 AS events that were specific to mRCC. Six of these were intron retention events and four were exon skipping events.
Differential AS analysis identified 461 slicing events that differed between responders and non-responders to immune checkpoint inhibitors and 253 events that differed between targeted therapy responders and non-responders. In both cases, more than 70% of novel AS events among responders involved intron retention.
“Intron retention was the predominant alternative splicing event observed in patients who responded well to therapy,” observed Pirrotte.
“Mechanistically, intron retention occurs when intronic sequences that are normally removed during RNA processing are retained in the mature transcript. This can generate novel amino acid sequences and, in some cases, tumor-associated antigens derived from aberrant splicing,” he explained. “A high intron-retention burden was associated with an immunogenic tumor microenvironment, marked by adaptive immune activation and enriched antigen processing. In simple terms, these cancer-specific splicing errors may help ‘flag’ tumor cells, making them more visible to the immune system.”
The team then investigated whether differentially spliced sequences shared between the immunotherapy and targeted therapy responder cohorts could potentially act as neoantigenic targets.
This revealed that novel peptide-generating AS events in the genes IFFO1 and ZNF692 were highly expressed among the responders. Both genes are known to play a role in tumorigenesis and metastasis in RCC and colorectal cancer. The researchers note that although the specific impact of AS events within these genes is unclear, the resulting neoantigens could play a role in future treatment approaches.
“It is becoming increasingly feasible to identify splicing-derived neoantigens that could be used in personalized immunotherapy approaches, including adoptive cell therapies such as CAR T-cell or tumor-infiltrating lymphocyte therapies,” said Pirrotte. “These strategies are designed to train or redirect a patient’s immune system to recognize tumor-specific antigen signatures. In this case, the targets would be antigens generated by aberrant splicing events, allowing immune cells to selectively recognize and kill cancer cells.”
Finally, the investigators showed that tumors with higher levels of aberrant splicing were more common among therapy responders than nonresponders. This could potentially be used as a biomarker for treatment response.
“Current biomarkers such as PD-L1 expression and microsatellite instability have shown limited and inconsistent predictive value in mRCC,” said Pirrotte. “In contrast, our study identified a significant association between tumor ‘splicing burden’ (the extent of aberrant splicing) and clinical response to therapy. These findings suggest that the tumor transcriptome, particularly splicing dysregulation, may provide a more informative framework for predicting treatment response and personalizing therapy.”
Before assessment of AS can be implemented in routine clinical practice, the core technologies will need further refinement, including clinically validated RNA sequencing workflows, robust computational pipelines for splicing analysis, and clear regulatory and technical frameworks for using the results to guide treatment decisions or develop biologic therapies.
Pirrotte and team are now assembling validation cohorts to confirm their findings in larger patient populations. They are also expanding their work to other cancer types to determine whether aberrant splicing and splicing-derived antigens represent broadly applicable biomarkers and therapeutic targets.
I started creating health content online in medical school. I realized I could reach thousands of people in seconds and share medically accurate information with students around the world. For example, I made a video showing how deep an injection goes for vaccination. The public is both fascinated and afraid of injections, but dispelling the rumors that a massive needle could go as deep as your bone goes a long way in vaccine adoption.
During my emergency medicine residency, though, things changed. What had been seen during my interview process as a strength and skill set became “high risk” overnight. I was told that continuing to post on social media could jeopardize my career.
People report that their personal contact info was surfaced by Google AI—and there’s apparently no easy way to prevent it.
A Redditor recently wrote that he was “desperate for help”: for about a month, he said, his phone had been inundated by calls from “strangers” who were “looking for a lawyer, a product designer, a locksmith.” Callers were apparently misdirected by Google’s generative AI.
In March, a software developer in Israel was contacted on WhatsApp after Google’s chatbot Gemini provided incorrect customer service instructions that included his number.
And in April, a PhD candidate at the University of Washington was messing around on Gemini and got it to cough up her colleague’s personal cell phone number.
AI researchers and online privacy experts have long warned of the myriad dangers generative AI poses for personal privacy. These cases give us yet another scenario to worry about: generative AI exposing people’s real phone numbers. (The Redditor did not respond to multiple requests for comment and we could not independently verify his story.)
Experts say that these privacy lapses are most likely due to personally identifiable information (PII) being used in training data, though it’s hard to understand the exact mechanism causing real phone numbers to show up in the AI-generated responses. But no matter the reason, the result is not fun for people on the receiving end—and, even more worryingly, there appears to be little that anyone can do to stop it.
A 400% increase in AI-related privacy requests
It’s impossible to know how often people’s phone numbers are exposed by AI chatbots, but experts say they believe that it is happening far more than is reported publicly.
DeleteMe, a company that helps customers remove their personal information from the internet, says customer queries about generative AI have increased by 400%—up to a few thousand—in the last seven months. These queries “specifically reference ChatGPT, Claude, Gemini … or other generative AI tools,” says Rob Shavell, the company’s cofounder and CEO. Specifically, 55% of these concerns about generative AI reference ChatGPT, 20% reference Gemini, 15% Claude, and 10% other AI tools, Shavell says. (MIT Technology Review has a business subscription to DeleteMe.)
Shavell says customer complaints about personal information being surfaced by LLMs usually take two forms: Either “a customer asks a chatbot something innocuous about themselves and gets back accurate home addresses, phone numbers, family members’ names, or employer details.” Alternatively, a customer may be confronted with and report the exposure of someone else’s personal data, when “the chatbot generates plausible-but-wrong contact information.”
This aligns with what happened to Daniel Abraham, a 28-year-old software engineer in Israel. In mid-March, he says, a stranger sent him a “weird WhatsApp message from an unknown number” asking for help with his account in PayBox, an Israeli payment app.
“I thought it was a spam message,” he wrote to MIT Technology Review in an email—“someone who was trying to troll me.”
But when he asked the stranger how they had found his number, they sent him a screenshot of Gemini’s instructions to contact PayBox customer service via WhatsApp—giving his personal number. Abraham does not work for PayBox, and PayBox does not have a WhatsApp customer service number, Elad Gabay, a customer service representative for the company, confirmed.
Later, Abraham asked Gemini how to contact PayBox, and it generated another person’s WhatsApp number. When I recently asked, Gemini again responded with an Israeli phone number—it belonged not to PayBox, but to a separate credit card company that works with PayBox.
Screenshot: Google Gemini provides MIT Technology Review with the incorrect number for PayBox.
Abraham’s exchange with the stranger ended quickly, but he said he was concerned about how other potential exchanges could quickly turn sour, including “harassment or other bad interactions.” “What if I asked for money in order to ‘solve’ that [customer service] issue?” he said.
To try to figure out how this happened, Abraham ran a regular Google search on his phone number, and he found that it had been shared online once, back in 2015, on a local site similar to Quora. Though he’s not sure who posted it there, it may explain how it ended up being reproduced by Gemini over a decade later.
Chatbots like Gemini, Open AI’s ChatGPT, and Anthropic’s Claude are built on LLMs that are trained on huge amounts of data scraped from across the web. This inevitably includes hundreds of millions of instances of PII. As we reported last summer, for example, the large popular open-source data set DataComp CommonPool, which has been used to train image-generation models, included copies of résumés, driver’s licenses, and credit cards.
The likelihood of PII appearing in AI training data is only increasing as public data “runs out” and AI companies look for new sources of high-quality training data. This includes information from data brokers and people-search websites. According to the California data broker registry, for instance, 31 of 578 registered data brokers operating in the state self-reported that they had “shared or sold consumers’ data to a developer of a GenAI system or model in the past year.”
Furthermore, models are known to memorize and reproduce data verbatim from training data sets—and recent research suggests that it is not just frequently appearing data that is most likely to be memorized.
Imperfect Measures
It’s standard practice now to build guardrails into an LLM’s design to constrain certain outputs, ranging from content filters meant to identify and prevent chatbots from releasing PII to Anthropic’s instructions to Claude to choose responses that contain “the least personal, private, or confidential information belonging to others.”
But as a pair of University of Washington PhD students researching privacy and technology saw firsthand recently, these safeguards don’t always work.
“One day, I was just playing around on Gemini, and I searched for Yael Eiger, my friend and collaborator,” Meira Gilbert says. She typed in “Yael Eiger contact info,” and after Gemini provided an overview of Eiger’s research, which Gilbert had expected, Gemini also returned her friend’s personal phone number. “It was shocking,” Gilbert says.
When she saw the Gemini result, Eiger remembered that she had, in fact, shared her phone number online in the previous year, for a technology workshop. But she had not expected it to be so visible to everyone on the internet.
Have you had your PII revealed by generative AI? Reach the reporter on Signal at eileenguo.15 or tips@technologyreview.com.
“Having your information be … accessible to one audience, and then Gemini making it accessible to anyone” feels completely different, Eiger says—especially when she found that the information was buried in a normal Google search.
“It was severely downgraded,” Gilbert confirms. “I never would have found it if I was just looking through Google results.” (I tried the same prompt in Gemini earlier this month, and after an initial denial, the tool also gave me Eiger’s number.)
After this experience, Eiger, Gilbert, and another UW PhD student, Anna-Maria Gueorguieva, decided to test ChatGPT to see what it would surface about a professor.
At first, OpenAI’s guardrails kicked in, and ChatGPT responded that the information was unavailable. But in the same response, the chatbot suggested, “if you want to go deeper, I can still try a more ‘investigative-style’ approach.” Their inquiry just had to help “narrow things down,” ChatGPT said, by providing “a neighborhood guess” for where the professor might live, or “a possible co-owner name” for the professor’s home. ChatGPT continued: “That’s usually the only way to surface newer or intentionally less-visible property records.”
The students provided this information, leading ChatGPT to produce the professor’s home address, home purchase price, and spouse’s name from city property records.
(Taya Christianson, an OpenAI representative, said she was not able to comment on what happened in this case without seeing screenshots or knowing which model the students had tested, though we pointed out that many users may not know which model they were using in the ChatGPT interface. In response to questions about the exposure of PII, she sent links to documents describing how OpenAI handles privacy, including filtering out PII, and other tools.)
This reveals one of the fundamental problems with chatbots, says DeleteMe’s Shavell. AI companies “can build in guardrails, but [their chatbots] are also designed to be effective and to answer customer questions.”
The exposure issue is not limited to Gemini or ChatGPT. Last year, Futurismfound that if you promptedxAI’s chatbot Grok with “[name] address,” in almost all cases, it provided not only residential addresses but also often the person’s phone numbers, work addresses, and addresses for people with similar-sounding names. (xAI did not respond to a request for comment.)
No clear answers
There aren’t straightforward solutions to this problem—there’s no easy way to either verify whether someone’s personal information is in a given model’s training set or to compel the models to remove PII.
Ideally, individual consumers should be able to request that their PII be removed, says Jennifer King, the privacy and data fellow at Stanford University Institute for Human-Centered Artificial Intelligence. But this is typically interpreted to apply only to the data that people have directly given to companies—like when they interact with a chatbot, King explains.
“I don’t know if Google even has the infrastructure … to say to me, ‘Yes, we have your data in our training data, we can summarize what we know about you, and then we can delete or correct things that are wrong or things that you don’t want in there,’” she says.
Existing privacy legislation, like the California Consumer Privacy Act or Europe’s GDPR, does not cover the “publicly available” information that has already been scraped and used to train LLMs, especially since much of this is anonymized (though multiplestudies have also shown how easy it is to infer identities and PII from anonymized and pseudonymous data).
As to “whether they [AI companies] have ever systematically tried to go back through data that had already been collected from the public internet and minimized that stuff?” King adds. “No idea.”
The next best solution would be that the companies are “taking out everybody’s phone numbers or all data that resembles [phone numbers],” King says, but “nobody’s been willing to say” they’re doing that.
Hugging Face, a platform that hosts open-source data sets and AI models, has a tool that allows people to search how often a piece of data—like their phone number—has appeared in open-source LLM training data sets, but this does not necessarily represent what has been used to train closed LLMs that power popular chatbots like Claude, ChatGPT, and Gemini. (Eiger’s number, for example, did not show up in Hugging Face’s tool.)
Alex Joseph, the head of communications for Gemini apps and Google Labs, did not respond to specific questions, but he said that “the team” is “looking into” the particular cases flagged by MIT Technology Review. He also provided a link to a support document that describes how users can “object to the processing of your personal data” or “ask for inaccurate personal data in Gemini Apps’ responses to be corrected.” The page notes that the company’s response will depend on the privacy laws of your jurisdiction.
OpenAI has a privacy portal that allows people to submit requests to remove their personal information from ChatGPT responses, but notes that it balances privacy requests with the public interest and “may decline a request if we have a lawful reason for doing so.”
Anthropic describes how it uses personal data in model training, but it does not have a clear way for people to request its removal. The company did not respond to a request for comment.
The best option for anyone who wants to protect their private data right now is to “start upstream: get personal data off the public web before it ends up in the next scrape,” says Shavell. Since the start of the year, for instance, California has offered its residents a web portal to request that data brokers delete their information. Still, this doesn’t guarantee that your data hasn’t already been used for training—and will therefore not appear in a chatbot’s response.
The Redditor who received incessant calls posted that he had “submitted an official Legal Removal/Privacy Request to Google, asking them to urgently blacklist my number from their LLM outputs,” but had not yet received a response. He also wrote last month that “the harassment continues daily.”
Abraham, the Israeli software developer, says he contacted Google’s customer service on March 17, the day after his phone number was exposed. He says he did not receive a response until May 4, and it simply asked for documentation that he had already provided.
Meanwhile, inspired by her own exposure on Gemini, Eiger, along with Gilbert and Gueorguieva, is designing a research project to further study what personal information is being surfaced by various AI chatbots—and what they may know, even if they’re not telling us.
Some of that information may “technically be public,” says Gilbert, but chatbots may be altering “the amount of effort you would put into finding” it. Now instead of searching through 10 pages of Google search results, or paying for the information from a data broker site, “does generative AI just lower the barrier to entry to target people?”
This piece has been updated to clarify OpenAI’s response.
