The headline said an AI passed the video Turing test. I went looking for the test. It wasn't there.
Tavus reported that Griffin climbed from 1 of 41 participants (2.4%) to 26 of 54 (48%). A 45-point jump in a single revision. But by the company's own description, those participants "expected to be talking to another person." Nobody asked them to decide whether the face on screen was human. The classical Turing test forces the judge into a verdict. Tavus deleted the verdict. A detection test that never requests a detection cannot pass, and it cannot fail. It simply isn't a detection test. And 48% sits under a coin flip. Force the participants into a two-choice frame and the deception rate likely collapses toward random. That number is the most consequential figure in the entire release, and it is the one nobody quoted.
Tavus builds AI video. The current product is a digital-human API: generate a presenter, ship a clip, done. Griffin is the pivot—a full-duplex multimodal system that listens, speaks, and reads the video feed inside the same loop. Backchanneling. Interruption recovery. A ten-second voice clone that captures a specific identity.
The architecture is real. The marketing is a separate object. Separate them.
One external anchor exists. NVIDIA's VideoFDB benchmark: Griffin scored 3.83 against a human reference of 3.92. Second place—Gemini 2.5 paired with Anam—scored 2.80. A 1.03-point cliff on a five-point scale. A single benchmark. A single vendor's press kit. The second-place entry is itself a combination, which tells you the current industry path is "foundation model plus a video shell," and Tavus is the vertically integrated version of that same stack.
For crypto this matters more than it matters for video editing. This industry runs on remote verification. Exchange onboarding is a video selfie plus a liveness check. OTC desks confirm large transfers over a call. DAO multisig signers vouch for one another across time zones and legal jurisdictions. Every one of those flows leans on a single primitive: a live video of a known face is a credential. Griffin attacks that primitive at its root.
Crypto is in a bull market, and bull markets corrode diligence. Capital arrives faster than judgment. A project raises on a narrative, ships a demo, and the market prices the demo as production. That is the environment where a benchmark like 3.83 gets quoted as fact before anyone asks for error bars. The downside here is not a bad trade. It is a compromised identity layer the whole industry quietly leans on.
And the company has frozen the product. Access is limited to "a small number of trusted testers." A disclosure feature is "in development." That is the entire public state of the system.
Start with the benchmark, because it is the only number with a third-party smell on it. 3.83 versus 3.92 is a 0.09 gap. No sample size. No confidence interval. No rater list. No published definition of the scored dimensions. I have run enough stress tests to know what a 0.09 gap means when the variance is hidden: it means nothing yet. It may be significant, or it may sit inside one standard deviation of noise. The burden sits with whoever publishes the number, and they published it without the error bars. A score without a confidence interval is a rumor with a decimal point.
Then widen the frame. Second place at 2.80 is a bolted-together stack, and when your nearest competitor is a bolted-together stack, you are not ahead of the field. You are the field, momentarily assembled better. Tavus's edge is latency and integration, not a capability nobody else can reach.
Then there is the trajectory itself. 1 of 41 to 26 of 54 is not a smooth improvement curve. A jump from 2.4% to 48% in a single revision implies that something discontinuous changed—the test conditions, the participant pool, or the system architecture. The company does not say which. When I see a step function like that, I do not assume a breakthrough. I assume the methodology moved. Test design is the most common hidden variable in any benchmark, and a vendor that controls both the system and the test controls the result. This is why third-party replication is not a nicety. It is the only thing that turns a claim into a fact.
Now the infrastructure reality, which the release never touches. A ten-second voice clone is not frontier work. VALL-E and XTTS solved zero-shot cloning a while ago. The expensive part—the part that decides whether a product ships—is running voice cloning, text-to-speech, video synthesis, and a dialogue model at conversational latency, simultaneously, without a seam. That is an infrastructure problem, and infrastructure problems surface the instant you leave the demo booth.
Which raises the question the release never answers: cost per session and concurrency ceiling. Full-duplex real-time inference cannot be batched. A live conversation holds a GPU hostage for its entire duration. Batch video generation saturates a card; a live session runs it at a fraction of utilization for minutes on end. The unit economics of the two products live in different universes. "We withheld it for safety" and "we cannot serve it profitably at scale" produce identical press releases. From the outside I cannot separate them. Neither can you. Code does not lie, but incentives do.
One more tell sits in the naming. Tavus calls Griffin a "Human Interaction Model," or HIM—a category it invented. Inventing a category is a defensive move. It shifts the comparison away from foundation models, where Tavus loses on resources, toward a niche it gets to define. Category definition is a marketing act, not a technical one. When a company names its own arena, check who else showed up. Nobody has.
Here is where crypto readers should stop skimming. Video KYC and liveness detection rest on assumptions that have been quietly true for a decade. A person moves naturally. A person answers a challenge in real time. A person's audio and video stay in sync. Griffin attacks all three at once: real-time response, audiovisual consistency, and a cloned voice that seals the final gap. The twenty-second window Tavus reports—where doubters raised suspicion within the first twenty seconds and the rest never doubted at all—is not a curiosity. It is a specification for fraud. A social engineer needs to hold the frame past the suspicion window, and then the target's guard drops. Twenty seconds is trivially cheap to buy.
I have traced enough on-chain flow to recognize how this gets weaponized. The pattern is already visible in the data Tavus cites: TRM Labs reports AI adoption in criminal activity up 40% year over year, fraud as the primary driver. That figure describes text and voice today. Griffin-class tooling upgrades the payload from a voice-only scam to a full-sensory one. Success rate per attempt and average ticket size both move in the wrong direction.
The attack surfaces are not exotic. Remote notarization. Telehealth intake. Online job interviews. The "call your family member to confirm the transfer" step that custodial services still use for high-value withdrawals. Each of those flows outsources its security to the assumption that a live face is a person. I learned this the hard way in 2017, tracing the liquidity-pool logic of the 0x protocol by hand and finding an integer overflow that let an attacker drain a pool with almost no capital. The bug was never in the pool. It was in the assumption that the exchange function could not be pushed outside its intended range. Remove the assumption and the whole structure leans.
For exchanges, this is not a future problem wearing a future's clothes. It is a present one. A video-KYC flow that accepts a live call as proof of personhood is now a flow with a documented bypass—documented by the vendor that built it. I have watched this movie before. In 2021 I audited the Compound governance module and showed how a coordinated actor could manipulate proposal timing to slip past community scrutiny. The flaw was not in the vote. It was in the assumption that timing was neutral. The exploit was in the trust, not the contract. Here the contract is the social contract of "video means person," and it has no patch.
There is a second-order cost the release never mentions: trust inflation. Once people know a live video can be synthetic, their confidence in every live video drops—including the real ones. Remote collaboration, cross-border business, the ordinary act of verifying a counterparty's face all get more expensive to trust. That cost lands whether or not any specific fraud occurs.
There is a paradox in the disclosure feature that nobody at Tavus can engineer away. Make the disclosure loud enough to stop fraud and you destroy the fidelity that is the product's entire value. Make it subtle enough to preserve the product and it cannot stop fraud. You cannot ship a watermark that is simultaneously invisible to the victim and unmissable to them. This is not a roadmap item. It is a contradiction, and the company is currently marketing the contradiction as responsibility.
And the accountability question sharpens into something this industry already fought over. When a tool can be repurposed for fraud, who carries the liability—the model, the platform, or the user? I watched that argument resolve around Tornado Cash. The conclusion regulators reached was that writing code can be a crime. If that precedent holds, a system purpose-built to be indistinguishable from a human carries a liability that no disclosure toggle can wash out. The developer who ships a perfect liar inherits the lies.
Crypto already owns most of the primitives for a fix, and it deploys almost none of them where it matters. Signed attestations let an issuer vouch for a verified human. Zero-knowledge proofs of personhood let that human prove uniqueness without exposing identity. Content provenance standards like C2PA let a capture device sign its output at the sensor. Stack them and you get a verification path that does not depend on the honesty of a video stream. The catch is integration: the onboarding layer is where the money and the laziness both live.
The bulls are not wrong about everything, and I will give them their due. The most common pushback I field is that deepfakes have existed for years and video KYC still works. Fair. The difference is latency. Pre-rendered deepfakes fail live challenges—they cannot respond, cannot blink on cue, cannot recover from an interruption. A static deepfake is a photograph that moves. Griffin is the first credible attempt at a deepfake that can hold a conversation. That is a genuine threshold, and pretending otherwise is the complacency that gets protocols drained.
The second bull argument is that detection will simply catch up. Historically, detection has lagged generation, not led it. Every generation wave has been met by detectors trailing it by quarters, sometimes years. Betting on detection to arrive on schedule is betting against the historical record. The defensive industries will grow—liveness, provenance, content credentials, on-chain attestation—but they will grow in response to damage, not in anticipation of it. The crypto-native answer already exists in fragments. None of it is deployed at the layer where onboarding actually happens.
The 48% is not a pass. It is a coin flip wearing a press release. The real signals are the 0.09 gap and the twenty-second window, and both point the same direction: the credential crypto has leaned on for a decade—a live face on a live call—is now a liability with a known exploit and a published trigger window. Entropy always wins if you stop watching. The teams that re-audit their identity flows this quarter will be fine. The ones that trust the demo will fund the next case study.
