Clearview's unreleased AI tool was in its login page

WIRED reported on September 10 that Clearview AI has been testing an unannounced AI tool called InquiryIQ — and that reporters found it in code Clearview's login page ships to every visitor's browser, before anyone signs in. There are two stories here. One is about surveillance. The other is about your frontend bundle, and it is the one you can do something about this afternoon.

What actually happened

InquiryIQ is an assistant that picks up where a facial recognition match ends. Per reporting summarized by Biometric Update, it browses the open web, runs image searches and secondary face searches, and assembles a "Candidate Graph" of possible employers, aliases, associates, addresses, phone numbers, social accounts, and arrest history. Its interface tells investigators that supplying age, gender, and race helps it make better decisions. One model Clearview tested for that reasoning came from xAI.

Clearview told WIRED that police have never used InquiryIQ, that it was never pitched or shipped, and that there are no plans to release the current version.

Now the part relevant to anyone shipping software. This was not a leak, a breach, or a disgruntled insider. It was JavaScript. An unreleased, politically radioactive product surfaced because its strings and routes rode along in the bundle served at the login screen — the one URL a company least wants strangers poking at, handed to every stranger who loads it.

Why your frontend bundle matters for your business

Everything your browser downloads is public. Not "public if someone is determined" — public. Minification is not obfuscation, and an unshipped feature flag named enable_pricing_v3_enterprise tells a competitor exactly what is coming. We have found live API keys, internal hostnames, admin-only route tables, and half-built acquisition features in client bundles we inherited, none of it behind a login, all of it one view-source away.

Go look at yours today. Open your production app, pull the main JS chunk, and search it for the names of things you have not announced. Search for key, secret, token, internal, admin, staging. Check whether source maps are being served in production — most teams ship them by accident and hand attackers the original, commented source.

Then fix the pattern, not the instance. Unreleased features get gated on the server, where the client never learns they exist, instead of being shipped and hidden with a CSS class. Admin routes live in a separate bundle behind an authenticated boundary. Secrets stay server-side, always, because anything in a NEXT_PUBLIC_ or VITE_ variable is a press release. Your login page is the most-loaded file you own. Treat it like the front window it is.

Sources: Biometric Update: Clearview AI prototype points to next phase of facial recognition, reporting first published by WIRED on September 10, 2026.