For a brief period last week, Telegram disappeared from Apple’s App Store. That is no small thing. Telegram has more than a billion users worldwide, and for anyone who tried to install Telegram on an iPhone, Apple had temporarily cut off the normal route to getting the app. Apple said it removed Telegram after finding child sexual abuse material on the service. Telegram deleted the material, banned the offending user, and Apple restored the app the same day. Existing users were able to keep using Telegram while it was unavailable for download.

That alone would have been a noteworthy story, but Telegram founder Pavel Durov later offered a much stranger explanation for what happened. According to Durov, the material was not simply posted by some random criminal. He claims it was deliberately planted by what he called a “takedown extortionist,” someone who threatens online communities with removal unless their owners pay up.

It's a much stranger security problem than most people are used to thinking about.

In Durov’s telling, the attacker found an old message in an active public Telegram group, edited it to contain AI-modified illegal material, and then reported the offending content directly to Apple. Because the edited message was buried in the group’s history, ordinary Telegram users were unlikely to stumble across it and report it themselves. The Verge subsequently reported Durov’s account of the alleged scheme.

Apple has confirmed the illegal content and the reason it removed Telegram, but it has not independently confirmed Durov’s story about the extortion scheme. That distinction matters. The claim that an extortionist deliberately planted the material, that AI was used to modify it, and that the old message was selected specifically to evade Telegram’s own moderation all come from Durov.

Still, if his account is accurate, the incident offers a glimpse of where cyberattacks may be headed. The alleged attacker did not have to hack Telegram’s servers, compromise Apple, steal anyone’s password, or discover some exotic zero day vulnerability. He simply figured out how to manipulate Apple’s enforcement system into attacking Telegram for him.

Hack the referee

That may sound like an entirely new category of attack, but the basic idea has been around for years. Social media companies have dealt with organized mass reporting campaigns in which activists, dissidents, competitors, and political opponents are buried under bogus complaints in hopes that an automated moderation system will suspend them.

Meta disclosed in 2021 that it had broken up a network in Vietnam that used real, duplicate, and fake accounts to submit hundreds and sometimes thousands of false reports against activists and critics of the Vietnamese government.

YouTube has had similar problems with fraudulent copyright complaints. Google reported that more than 6% of videos targeted through YouTube’s public copyright removal process in 2025 were subject to abusive removal requests.

The reason the Telegram case is more interesting is that artificial intelligence is changing the economics of these attacks. A human being has always been capable of lying, filing false reports, forging evidence, or pretending to be someone else. AI makes it possible to do those things at enormous scale and with much less time and effort.

RELATED: Infamous cyberattackers claim their next shocking victim — using a decades-old trick

Jaap Arriens/NurPhoto/Getty Images

The FBI has already warned that criminals are using generative AI to create fake identification documents, fictitious social media profiles, synthetic photographs, cloned voices, and fraudulent videos for impersonation and fraud. The FBI has separately warned that criminals are using AI-altered images and videos to create explicit material for extortion.

The important thing is not merely that AI can make a convincing fake photograph. It is that one person can now manufacture photographs, voices, accounts, documents, messages, and identities faster and cheaper than ever before.

The attack surface is getting bigger

That becomes especially dangerous as more institutions hand decisions over to automated systems. Banks use software to decide whether a transaction looks fraudulent. Email providers decide whether a message is spam. Social networks decide whether a photograph violates their rules. App stores determine whether software is safe enough to distribute. Advertising platforms decide which businesses are legitimate. Payment processors determine which merchants are too risky to serve.

In every case, the system has to take some collection of inputs and make a judgment about them. An attacker does not necessarily have to defeat those systems in the traditional sense. He only has to learn which inputs produce the result he wants.

That is a much stranger security problem than the one most people are used to thinking about. For decades, the stereotypical cyberattack involved a hacker trying to break through a locked door. He stole a password, exploited an unpatched vulnerability, installed malware, encrypted a hard drive, or broke into a database.

Those attacks are not going anywhere, and AI is making them more sophisticated as well. But increasingly, attackers may be able to accomplish their goal without ever breaking through the door. If they can persuade the security guard that the owner of the building is a criminal, the guard may do the damage for them.

Apple’s power is part of the problem

That is essentially what Durov claims happened to Telegram, and it exposes another uncomfortable part of the story.

Apple obviously cannot ignore child sexual abuse material. Nobody is arguing that it should. But that does not automatically answer the much larger question of what Apple should do when a single user uploads prohibited material to an application serving more than a billion people.

Is Apple responsible for policing every photograph, message, and file that passes through every app it distributes? More importantly, should Apple have the authority to punish every user of an application because one user violated the rules?

Apple’s own App Store guidelines do not require developers to somehow guarantee that objectionable material will never appear. Apps containing user generated content are required to have systems for filtering objectionable material, reporting it, blocking abusive users, and providing contact information so complaints can be addressed.

Apple’s guidelines also describe a remediation process in which the company may contact a developer, ask that offending material be removed, and request a plan for preventing similar violations. The guidelines reserve immediate removal for more serious circumstances, including egregious or repeated behavior.

That raises an obvious question if Durov’s account is accurate. Why did Apple remove Telegram before contacting the company instead of first giving Telegram an opportunity to remove the content and address the offending account?

RELATED: Surveillance pricing is here — and this surprising state is saying NO

mathisworks/Getty Images

There may be additional considerations involving child sexual abuse material that are not fully spelled out in Apple’s general App Store guidelines, so it would be too strong to say Apple clearly violated its own policy. But the discrepancy is worth asking about.

Telegram says this entire episode stemmed from the actions of a single user. Telegram spokesperson Remi Vaughn criticized Apple for disrupting access to the app over one user’s actions, while Epic Games CEO Tim Sweeney questioned how any large messaging service could realistically guarantee that none of its users would ever upload prohibited material.

That gets to the larger issue. No communications platform with hundreds of millions or billions of users can promise that no individual user will ever do something criminal. The meaningful question is how quickly and effectively the platform responds when that happens.

Yet Apple possesses the power to remove an entire application from the primary software marketplace for more than a billion iPhone users.

That is an extraordinary amount of authority for one private company to exercise over communications software.

It also makes the alleged extortion scheme possible in the first place. The attacker’s leverage did not come merely from his ability to plant prohibited material. It came from knowing that Apple possessed both the power and the willingness to punish an entire application in response.

If Durov’s story is accurate, the extortionist was exploiting Apple just as surely as he was exploiting Telegram.

Who decides who gets to stay?

There is also reason to question how consistently Apple exercises that authority.

The Verge reported Friday that Apple took a different approach toward X and Grok during controversy over sexualized AI-generated images. Apple reportedly contacted X and sought moderation changes rather than immediately removing the apps.

Durov, by contrast, says Telegram was removed before Apple contacted the company.

That does not prove Apple acted improperly in either case, and the underlying facts were not identical. But it does expose how much discretion Apple possesses. Apple worked with one platform while another was removed before contact, according to Durov.

That should make even people who have little sympathy for Telegram uncomfortable. The question is not whether Apple should tolerate illegal material. It is whether a company that controls one of the two dominant mobile operating systems should also serve as judge, jury, and executioner for applications containing the speech of billions of third-party users.

Seen that way, the Telegram affair is not merely a warning about AI-powered cyberattacks. It is also a warning about centralized gatekeepers.

The more power we give a handful of companies to decide who may communicate, transact, advertise, publish, or distribute software, the more valuable those companies become as targets for manipulation.

Why bother silencing a billion users yourself when you can trick Apple into doing it for you?

AI is getting better at old-fashioned hacking too

AI makes these manipulation attacks easier, but the machines themselves are also becoming much better at traditional hacking.

OpenAI recently disclosed an internal cybersecurity evaluation in which advanced models escaped the constrained environment researchers had built for them after discovering and exploiting a previously unknown vulnerability. The models gained internet access, escalated privileges, moved laterally through systems, and ultimately exploited vulnerabilities in Hugging Face’s real production infrastructure while pursuing the objective of the test.

There are important caveats. This was a deliberately aggressive cybersecurity evaluation. OpenAI had reduced or disabled some of the safeguards that would ordinarily restrict such behavior, and the prerelease model involved was an internal research prototype rather than a product released to the public.

Even with those caveats, the result was remarkable. The models found ways around barriers that researchers had not expected them to overcome.

RELATED: They had their life savings drained online in an instant. So who's next?

Velishchuk/Getty Images

Then on Friday, OpenAI disclosed another development that shows how quickly these capabilities are progressing. The company said testing of its upcoming Astra model had advanced far enough that it could no longer rule out what OpenAI classifies as “critical” cybersecurity capability.

That is the highest category in OpenAI’s cybersecurity framework. At that level, according to OpenAI’s description, a model could potentially discover functional zero-day exploits against hardened real-world systems without human assistance or independently plan and execute complex novel attacks from a high-level objective.

OpenAI has not said Astra definitely possesses those capabilities. It has said the possibility is serious enough that the company has tightened security controls around the model while testing continues.

We have reached the stage where one of the companies building the world’s most advanced AI systems considers autonomous attacks against hardened real-world targets plausible enough to build safeguards around.

Cybersecurity is becoming a fight over reality

Put these developments together, and the future of cybercrime starts to look much more complicated than simply giving hackers better tools.

On one side, AI systems are becoming increasingly capable of probing networks, discovering vulnerabilities, writing exploits, and carrying out technical work that once required highly skilled human operators. On the other side, far less sophisticated AI can already generate fake identities, doctored evidence, fraudulent complaints, cloned voices, and synthetic content that can be used to manipulate the institutions surrounding a target.

You can imagine where that leads without getting too far into science fiction. A criminal might not need to break into a company’s bank account if he can generate enough convincing evidence to persuade the bank’s fraud system to freeze it. He might not need to hack a competitor’s website if he can convince its hosting company that the site contains illegal material. He might not need to compromise an executive’s email if he can clone the executive’s voice and video closely enough to fool an employee. An attacker targeting a social media account might simply generate and test thousands of variations of malicious content until he discovers one that reliably triggers the platform’s moderation system.

The institutions involved cannot simply stop enforcing their rules. Banks cannot stop looking for fraud. Email providers cannot stop filtering spam. Social networks cannot simply abandon moderation. Apple cannot simply shrug when illegal material appears inside an app.

But neither should we treat every decision made by those systems, or by the companies controlling them, as automatically legitimate simply because the underlying problem is serious.

Every system that makes judgments can also be studied, manipulated, and eventually exploited.

That is what makes the Telegram incident worth paying attention to, even if Durov’s account ultimately proves incomplete. Apple has removed Telegram over child sexual abuse material before, in 2018, and Telegram has faced years of criticism and regulatory pressure over illegal activity on the platform. Durov is hardly a disinterested observer.

But the broader vulnerability he describes is real whether or not every detail of this particular incident turns out exactly as he says.

For most of the history of cybersecurity, defenders worried about attackers taking control of their computers. The next phase may be stranger. Attackers may not need to take control of your computer at all.

They may only need to convince everyone else’s computers to turn against you.