I decided to test most malicious devices I’m researching. I tested 2 browsers on device, an anonymous version of chat GPT 5 popped up (drive by compromise). Labeled: duck.ai in browser bar. I chose to interact with something that came seemingly from nowhere. During each interaction a red recording button appeared. Screen recording in progress on device. I asked anonymous actor about the recording button. Response: ‘That red square is the browser or site's visual indicator that the page is capturing input or has an active interactive state - it isn't me recording audio. Try these checks: • Look for a site-level microphone/camera permission prompt in your browser address bar.’ The attackers must be associated with Tulach / NextCloud , likely angry that I researched the adversarial nature of the presence in malicious, deeply compromised media. Consequences: threat actors retaliating because their own behavior and existence in malicious media is being researched. #tulach #nextcloud #anonymous_ai_chat