AI-powered vending machines that sell bullets could be hacked, says a cybersecurity expert

• Vending machines that dispense bullets have been rolled out in Alabama, Oklahoma, and Texas.
• The machines use facial recognition for age and ID verification.

The US has rolled out AI-powered vending machines that dispense bullets to customers aged over 21 who have valid IDs.

Various stores in Alabama, Oklahoma, and Texas have installed ammo-vending machines that use 360-degree facial recognition to check a person's age and ID.

Another machine will be installed in Colorado this week.

The vending machines, made by ammunition distribution company American Rounds, are designed to make ammo available 24/7.

The company said it aims to make the retail process "free from the constraints of store hours and long lines."

According to a promo video released earlier this year, the machines were installed in response to requests from Fresh Value stores.

"They came to us, they knew their customer base…there's a lot of hunting community in Pell City," said a representative for American Rounds.

While most of the comments under the video are celebratory, some viewers are concerned, with one commenting that this was "deeply dystopian shit."

Cybersecurity expert Andrew Whaley told Business Insider that while the technology would have had under rigorous security checks, it is not 100% hack-proof.

"The simple truth is, as retailers continue to digitize services like this and infuse them with advanced technology, they inevitably broaden the attack surface for cybercriminals, transforming each innovation into a potential vulnerability," said Whaley, who is the senior technical director at Norwegian cybersecurity firm Promon.

"An obvious concern would be that bad actors take advantage of vulnerabilities inherent in the vending machine system itself," he added.

"It's still possible that cybercriminals could exploit weaknesses in the facial recognition software to bypass security measures and purchase ammunition."

Another potential risk is the possibility of bugs, which could lead to incorrect results.

"Errors in this technology could theoretically deny legitimate transactions or, more dangerously, permit illegal ones," said Whaley.

American Rounds' CEO, Grant Magers, said the company's vending machines are the "safest, most secure method of purchasing ammo in the country."

In a statement to BI, Magers recalled witnessing open boxes of ammunition on shelves at retail locations, which he said encourages underage purchasing of ammo and a high theft rate.

"It is easy for an underaged purchaser to go online and click they are of legal age, purchase ammunition, and have it shipped to their house," added Magers.

"We never store, share, or sell the customer's personal data. We believe in responsible firearm ownership. We believe we are creating a better environment for all law-abiding gun owners," he said.

Whaley believes that there are ways to minimize the risks, recommending regular security audits and penetration testing to identify and address potential vulnerabilities in the vending machines, strict access controls, detailed access logs, and physical security measures like alarm systems and surveillance cameras.

A report published by Everytown for Gun Safety revealed that Alabama ranked fourth on a state-wise list of gun-related violence in 2024. Oklahoma was thirteenth, Colorado 19th, and Texas 26th. The company also plans to expand its presence to Louisiana, which ranked second after Mississippi.

President Joe Biden said he is committed to national gun safety and has declared it a public health crisis. His challenger, Donald Trump, has signaled that he supports the Second Amendment and has pledged to roll back gun restrictions.