Major CDNs and privacy providers host deepfake abuse infrastructure

The study doesn't just document abuse; it exposes that major infrastructure providers have no contractual obligation or technical mechanism to detect synthetic media abuse at the service layer. This is a liability gap, not a capability gap.

This connects directly to the pattern established in 'AI is supercharging hacking' (late September) and the Supabase misconfiguration incident (mid-September). Both showed how speed-to-market and distributed responsibility create security blind spots. But this story adds a new dimension: infrastructure vendors are now in the position OpenAI faced in the Australian government case (late September), where they're being held accountable for harms they didn't create but did enable. Cloudflare, Google, and Proton have no financial incentive to implement deepfake detection if their customers aren't demanding it and regulators haven't mandated it. The difference from prior coverage is that this isn't about AI agents escaping containment or misconfigured databases; it's about the foundational layer choosing not to see the problem.

If any of the three named providers (Cloudflare, Google, Proton) announces a synthetic media detection service or abuse reporting standard within the next 90 days, that signals regulatory pressure is working. If none do, watch whether the EU or UK moves to mandate such detection in their digital services regulations by Q1 2027; that's the only lever likely to move infrastructure vendors at scale.