This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
A group of fourth-graders discovered that Hive Box's facial-recognition locker system could be bypassed using a printed photograph of an authorized user. The vulnerability was confirmed by a television host, leading the company to suspend the feature, which was still in beta testing. This incident highlights security risks associated with the implementation of 2D facial-recognition technology in public infrastructure.
Facial-recognition locks by Hive Box, an express delivery locker company in China, were easily opened by a group of fourth-graders in a science-club demo using only a printed photo of the intended recipient’s face, leaving contents vulnerable to theft.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Vulnerabilities that can be exploited in AI systems, software development toolchains, and hardware, resulting in unauthorized access, data and privacy breaches, or system manipulation causing unsafe outputs or behavior.
Also classified as
The 2D facial recognition system lacked the robustness to distinguish between a real human face and a printed photograph.
The incident involves a security vulnerability in the facial-recognition lock system that allowed unauthorized access to physical lockers using printed photos.
AI system
Due to a decision or action made by an AI system
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The security vulnerability was caused by the deployed AI facial-recognition system failing to distinguish a 2D photo from a live face, which was an unexpected outcome of its deployment.
Primary school students bypassed Hive Box's beta 2D facial recognition locker system using printed photos. While demonstrating clear consumer privacy and biometric security vulnerabilities in a major commercial network, the incident has negligible national security implications and the feature was quickly suspended.
The facial-recognition lock operates as a tool, performing a specific, deterministic verification function based on direct image inputs without maintaining an internal state or planning.
High Risk: The system uses biometric identification (facial recognition) to control access to physical lockers, which carries significant security and privacy implications.
The system's primary goal is to perform face recognition to verify the identity of users and unlock the smart lockers.
The report provides clear, consistent details about the vulnerability, its discovery by the students, replication by a TV host, and the company's subsequent suspension of the beta feature. Expert commentary explains the technical cause clearly.
None.
Technology
Vulnerable 2D Mapping
Locker locks used simple 2D mapping instead of secure 3D mapping.
Lack of Liveness Detection
The camera could not distinguish between a live human face and a flat photo.
No Infrared Illumination
Absence of infrared sensors allowed static printed images to bypass security.
Data Inputs
Static Image Input Vulnerability
The system accepted a printed photo as a valid facial data input.
Human Factors
User Trust in Beta Tech
Users trusted the locker system despite it being in an unverified beta phase.
Process and Methods
Public Beta Deployment
Deploying untested beta features directly to active public smart lockers.
Inadequate Security Testing
Failure to test basic spoofing methods like printed photos before release.
Lack of Multi-Factor Verification
System relied solely on facial recognition without secondary verification.
Management
Prioritizing Market Growth over Safety
Company focused on rapid expansion and IPO preparation over system security.
Premature Feature Release
Management approved rolling out beta facial recognition to the public.
Regulatory Environment
Weak Standards for Smart Locks
Lack of strict regulatory standards allowed weak 2D facial recognition locks.
Rapid AI Commercialization Pressure
Push for AI adoption outpaced the establishment of safety regulations.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
