Discord cuts ties with Persona after verification code found tied to US surveillance efforts

Discord cut ties with the Peter Thiel-backed verification software after researchers flagged publicly accessible files

Discord has ended its partnership with identity verification provider Persona after researchers discovered the company’s front-end code accessible online and on a US government-authorised endpoint.

Nearly 2,500 files were reportedly found on a Federal Risk and Authorisation Management Program (FedRAMP) server, including 53 megabytes of data. Researchers said the files showed Persona conducting facial recognition checks against watchlists, screening politically exposed persons and assigning risk and similarity scores. They also identified 269 distinct verification checks, including screening for “adverse media” across 14 categories such as terrorism and espionage.

“We didn’t even have to write or perform a single exploit, the entire architecture was just on the doorstep,” the researchers wrote, adding that the endpoint “tags reports with codenames from active intelligence programs.”

Discord confirmed the partnership lasted less than a month and involved a limited test group. According to the company, submitted information could be stored for up to seven days before deletion. Persona, partially funded by Peter Thiel’s Founders Fund, continues to provide age verification services for OpenAI, Lime and Roblox.

The development follows previous scrutiny over Discord’s third-party data handling. Last year, hackers accessed government IDs of more than 70,000 users via customer support vendor 5CA. Discord said at the time, “At Discord, protecting the privacy and security of our users is a top priority.”

Persona chief executive Rick Song rejected claims of a vulnerability, telling Fortune, “What was found was uncompressed files of a front end that’s already on every single person’s device.” He added: “We have no relationship whatsoever with ICE, Palantir.”