Sora asks for your face first

Breaking news over lunch: Sora 2 is out ▸ 18:27. Sam Altman appears cleaning a camera lens, he tells Julia, incredulous-slash-maybe, that the clip looks generated, and then they rewind and the first line confirms it: “todo lo que usted está a punto de ver y escuchar fue hecho con Sora” ▸ 19:10. His review is one sentence: “está un nivel que ya me asusta” ▸ 19:19.

What makes it a teardown is that he immediately writes the exploit. Not movies, the family chat: a deepfake of himself saying “me secuestraron, págueme 100 millones de pesos”, posted to the family group, “y ellos lo creen” ▸ 20:04. This is not hypothetical modeling; the same chat confirmed lab-grown eggs two days ago with less evidence. The threat model writes itself from observed data.

tu cara es la licencia; la del otro requiere firma →

Then the design insight, surfaced by a complaint in Vibe Coders Anónimos: Cristian, the Platzi cofounder who runs the group, asks why Sora demanded so many biometrics at signup ▸ 20:47, and the answer reframes the annoyance as the safety mechanism: photo and ID bind the tool to your face and personal brand, and using anyone else’s face requires their permission through the same system ▸ 21:05. Identity verification isn’t friction around the product; for a deepfake engine, it is the product’s license scheme, the thing that in theory stops a Maduro-está-muerto clip at the registration desk ▸ 21:33. His verdict keeps both halves, “en teoría está bueno”, with Julia’s “tengo miedo” cutting through it ▸ 21:28, because the scheme’s whole weight rests on enforcement nobody has seen yet…