The EU's age verification app, built for roughly €2 million [1], was bypassed twice in four months by a single researcher using AI-assisted Chrome extensions built in minutes [1]. The root cause is not weak obfuscation but a procurement specification that mandated binary hardening, including RASP, while explicitly placing app attestation out of scope [1]. Approov's analysis separates the attacks that server-side attestation could have prevented from the relay attack that no attestation technology can stop, arguing that honest threat modeling must precede any hardening spend.
What is Covered in this Article
- AI-accelerated reverse engineering and the collapse of obfuscation-first security [1]
- Procurement specification failures: RASP in scope, app attestation out of scope [1]
- Solvable vs. structurally unsolvable attack classes in age verification architecture [1]
- Open-source binary obfuscation as security theater [1]
- Relay attacks and the anonymity-assurance tradeoff in privacy-preserving systems [1]
The News: In April 2026, the European Commission launched a white-label age verification app built by the T-Scy consortium (Scytáles AB and T-Systems International) under a contract reported at roughly €2 million against a framework valued up to €4 million [1]. Security researcher Paul Moore bypassed the app within days of launch, then bypassed the hardened re-release (version 2026.07-1) twice in July 2026 using two different Chrome extension techniques he built in minutes with an AI assistant [1]. His second technique was an automated relay attack that Moore described as unfixable: a Chrome extension detects the age verification QR code and relays it to a remote phone running the genuine app with a genuine credential, returning a real signature with no forged artifacts [1]. The EU technical specification had mandated obfuscation, code hardening, and RASP as normative requirements while explicitly placing app attestation checks and anti-root measures out of scope [1]. The app is open source and published on GitHub [1], making binary obfuscation of a publicly available codebase an ineffective control from the outset.
EU Age Verification App: A €2M Lesson in Misplaced Security Spend
Analyst Take: The EU age verification failure is not a story about insufficient hardening. It is a story about a specification that protected the wrong thing. The budget went into making the binary hard to read, including RASP deployment [1], while the question of whether the entity calling the API was a genuine, unmodified app on a genuine device was deferred indefinitely. AI-assisted tooling has now made that tradeoff catastrophically visible [1].
When AI Crashes the Price of Reverse Engineering
Code obfuscation has always been an economic deterrent, not a security control. Its value rested on making reverse engineering expensive enough that attackers moved to softer targets. That model assumed a skilled reverse engineer's time was the scarce resource. Moore's bypasses demonstrate that this assumption no longer holds: he built working Chrome extensions in minutes using an AI assistant [1]. The cost of defeating obfuscation has approached zero, and every hardening technique whose security derives from tedium is being repriced accordingly. The EU app compounds this problem by being open source and published on GitHub [1]. Obfuscating the binary of an application whose source code is publicly available is not defense in depth. It is a rounding error dressed as a control, and the procurement budget treated it as the primary line of defense [1].
The Specification as the Primary Exhibit
The EU technical specification is unusually self-incriminating. It mandated obfuscation, code hardening, and RASP as normative requirements while explicitly placing app attestation checks and anti-root measures out of scope, assigning implementation responsibility to individual member states [1]. This means the binary was protected while the API trust boundary was left entirely unguarded against cloned or relay clients. Moore's first bypass, a Chrome extension replicating the app with ID checks stripped out, exploited exactly this gap. Server-side app and device attestation, token binding, message signing, and dynamic certificate pinning would have closed the cloned-client attack vector. None of these controls are exotic: they are standard practice in mobile banking. They were simply never required [1].
Solvable vs. Structurally Unsolvable: An Honest Threat Model
Approov's analysis draws a line that most post-breach commentary avoids. The cloned-client attack was solvable via server-enforced attestation. The relay attack is not solvable by any attestation technology, a point Moore himself described as unfixable [1]. In Moore's relay, everything is authentic: a real app, a real unrooted device, a real credential issued to a real adult, and a real signature [1]. Attestation proves a genuine app is running on a genuine device. It cannot prove who is holding that device at the moment of proof. Closing that gap requires binding the credential holder to the live session through proximity constraints, liveness checks, or channel binding, and each of those measures erodes the anonymity that was the project's core selling point. The honest framing is that anonymity and assurance are in direct tension, and no hardening SDK resolves that tension. Procurement decisions that ignore this tradeoff do not eliminate the risk; they defer it until a researcher with an AI assistant makes it public.
What to Watch
- Specification revision: whether the European Commission updates the normative requirements to include server-side app attestation and token binding in Q4 2026
- Member-state divergence: which member states deploying the white-label app add attestation controls independently, and whether that creates a fragmented assurance market
- Relay attack escalation: whether Moore's automated relay technique, described as unfixable at the architectural level, is replicated at scale or productized before a structural fix is deployed [1]
- Procurement accountability: whether the T-Scy consortium contract triggers a formal review given the specification's explicit exclusion of the controls that failed [1][1]
- Regulatory response trajectory: whether repeated public bypasses shift Brussels toward more invasive identity-binding requirements, trading the privacy-first framing for stronger assurance
Sources
1. The Flaws in EU's Age Verification App: A Deeper Look, Approov, August 2026
Disclosure: Futurum is a research and advisory firm that engages or has engaged in research, analysis, and advisory services with many technology companies, including those mentioned in this article. The author does not hold any equity positions with any company mentioned in this article.
Read the full Futurum Group Disclosure.
Other Insights from Futurum:
Frontline's 2026 Benchmark Reframes Law Firm IT as an Operating System
Pega Bets Governance-Native AI Will Redefine Customer Engagement
PyTorch 2026: The Unifying Layer for a $181B AI Platform Market
Author Information
This content is written by a commercial general-purpose language model (LLM) along with the Futurum Intelligence Platform, and has not been curated or reviewed by editors. Due to the inherent limitations in using AI tools, please consider the probability of error. The accuracy, completeness, or timeliness of this content cannot be guaranteed. It is generated on the date indicated at the top of the page, based on the content available, and it may be automatically updated as new content becomes available. The content does not consider any other information or perform any independent analysis.
