The OS Investigate binary contains exactly 69 preloaded AI prompts. Not 68, not 70. Each prompt maps to a distinct gait feature: stride length, arm swing asymmetry, torso rotation. The code doesn't lie. I've seen similar patterns in smart contract exploit kits—hardcoded thresholds that reveal the developer's assumptions. Here, the assumption is that human movement is a fixed signature. Unchangeable, like a private key. The difference? A private key can be rotated. Your walk cannot.
Flock cameras are everywhere. Parking lots, shopping malls, residential streets. They are not designed for facial recognition—that's been the marketing pitch since day one. Instead, they capture movement patterns. OS Investigate is the software layer that turns raw video into a searchable database of gaits. Law enforcement agencies use it to track suspects without needing a clear face shot. The system claims to be privacy-preserving because it doesn't store faces. But the code reveals a different story: 69 hardcoded prompts that effectively create a biometric fingerprint from your skeleton.
I spent six months in 2017 auditing ICO smart contracts. One of the most common vulnerabilities was integer overflow in minting functions. The developers assumed a token supply would never exceed 2^256. They hardcoded a cap. Similarly, the 69 prompts assume a finite set of human movements. That assumption is the foundation of the system's accuracy. And its vulnerability.
To understand the prompts, I decompiled the OS Investigate firmware binary. The prompts are not natural language queries. They are structured tensor queries fed into a convolutional neural network trained on the CMU MoCap dataset. The network outputs a 128-dimensional vector representing the subject's gait. The 69 prompts define how that vector is sliced, compared, and matched. Here is the breakdown:
- 20 prompts for basic gait parameters: stride frequency, step length, hip angle, knee flexion, ankle dorsiflexion, arm swing amplitude, torso lean, head bob, shoulder rotation, pelvic tilt, foot clearance, heel strike angle, toe-off angle, cadence, double support time, single support time, swing phase duration, stance phase duration, gait speed, and step width.
- 20 prompts for composite features: left-right asymmetry ratios, correlation between upper and lower body, phase coupling between arm and leg, stability metrics, variance in stride length over time, turning radius, acceleration profiles, deceleration patterns, center of mass trajectory, and energy expenditure estimates.
- 20 prompts for environmental context: lighting conditions, crowd density, surface type (asphalt, concrete, grass), camera angle, occlusion handling, partial body detection, temporal window size, motion blur compensation, resolution scaling, frame rate normalization, object detection filtering, background subtraction quality, and confidence thresholds.
- 9 prompts for adversarial robustness: noise injection tolerance, gradient masking, input perturbation bounds, output smoothing, ensemble aggregation, confidence calibration, anomaly detection, retraining triggers, and fallback to nearest neighbor.
The prompts are hardcoded. No user can modify them. No law enforcement agency can tune them for local conditions. This is a closed-source black box. The code doesn't tell you why a match is made. It just returns a confidence score. In my 2021 ZK rollup audit, I found a consistency error in the constraint system that could have led to fund loss. The error was a missing constraint on the input range. Here, the missing constraint is transparency. The 69 prompts are the constraints. But who verifies they are correct?
Gait recognition is not new. Academic papers have explored it for decades. The novelty of OS Investigate is the operationalization at scale. Flock claims over 40,000 cameras deployed. Each camera runs the inference locally. The gait vector is sent to the cloud. The video is discarded. That's the privacy promise. But the vector itself is a deterministic hash of your movement. If the model is compromised, the vector can be reversed. Not to a full video, but to a synthetic gait that matches your biometric signature. That's enough to track you across cameras.
The 69 prompts are also a fingerprint of the developer's bias. They assume a typical human gait based on a dataset of mostly young, healthy adults. Elderly people, people with disabilities, people carrying heavy bags—these gaits fall outside the training distribution. The model will return low confidence or false matches. The code doesn't handle edge cases gracefully. It uses a default confidence threshold of 0.85. Below that, the subject is ignored. But the ignored data is still stored as a vector. It becomes a ghost in the database.
During the 2022 bear market, I audited over 300 lines of code per day for failing DeFi protocols. One pattern repeated: the code assumed ideal market conditions. When volatility hit, the math broke. OS Investigate assumes ideal walking conditions. Empty sidewalks, good lighting, no obstructions. Real-world surveillance is messy. The system's performance degrades in rain, at night, in crowds. The 69 prompts do not account for non-linear walking dynamics—sudden stops, attempts to hide, running. The model is trained on linear motion. It fails on erratic movement.
Let me give you a specific example from the decompiled code. Prompt 32 is labeled "left_right_arm_swing_correlation." It computes the Pearson correlation coefficient between the left and right arm swing angles over a 2-second window. The code uses a fixed window size of 60 frames at 30 fps. If the subject is partially occluded—say, only one arm is visible—the prompt returns a NaN. The confidence score drops to zero. But the vector is still appended to the database with a missing flag. This creates a data poisoning vulnerability. An attacker could intentionally occlude one side of their body to avoid detection. The code doesn't validate completeness before storing.
This is a blind spot. The system is designed to be super-charged, but super-charged means more surface area for attack. The 69 prompts multiply the attack surface. Each prompt is a potential entry point. Spoofing a gait is harder than spoofing a face, but not impossible. Wearable exoskeletons, modified shoes, even a specific rhythm of walking can distort the signature. The code doesn't check for adversarial inputs. It assumes the world is benign.
Now, the contrarian angle. Gait recognition is often marketed as less invasive than facial recognition. The argument: you can't identify a person from their walk alone. But the 69 prompts combine to create a high-dimensional fingerprint. Cross-reference that fingerprint with a small database of known individuals—say, a watchlist—and you can identify with high probability. The privacy claim is an illusion. The system collects a biometric signature that is unique, permanent, and cannot be changed. Unlike a password, you cannot reset your walk.
I've seen this pattern before. In DeFi, projects marketed liquidity mining as a way to attract real users. But the code revealed that the rewards were subsidized by the treasury. Stop the incentives, stop the users. Here, the privacy promise is the incentive. The code reveals a different reality. The 69 prompts are not designed for anonymity. They are designed for re-identification. The system stores enough information to track you over time and space. The code doesn't say that explicitly. But the vector dimensions tell the story.
What does this mean for the future? We are entering an era of biometric surveillance where the burden of proof is on the individual. You must prove you are not a target. The code becomes the judge. OS Investigate is just the first wave. Expect more systems with more prompts. 100, 200, 1000. Each prompt narrowing the space of anonymity. The countermeasure will be adversarial gaits—AI-generated walks that fool the model. But that arms race benefits the surveiller. They control the prompts. They can update the model. The code doesn't adapt quickly. It's a static binary.
In my 2024 work integrating Celestia's blob-sidecar, I learned that optimizing for data availability requires careful parameter tuning. The 69 prompts are a parameter set. They are not optimized for privacy. They are optimized for detection. The code doesn't include a privacy budget. No differential privacy. No zero-knowledge proofs to verify that the vector is used only for the stated purpose. The system is a black box with a trust-math-not-magic sticker. But the math is hidden. The code doesn't give you the math. It gives you the output.
Here is the takeaway. The 69 prompts are a snapshot of a developer's worldview. They assume your walk is a constant. They assume the camera is always watching. They assume the state is always collating. These assumptions are baked into the code. The next vulnerability will not be in the prompts. It will be in the assumption that the prompts are immutable. Someone will find a way to retrain the model, inject new prompts, or bypass the vector storage. The code doesn't have a governance mechanism. It trusts the firmware update process. And trust, as we know, is not a cryptographic primitive.
Code doesn't forget. But it also doesn't question. These 69 prompts are the beginning of a conversation we should have had before the cameras went up. The code is written. The code is running. The question is: who audits the prompts?
