• Itch.io is taken down due to an automated takedown request
• The cause is Funko Pop’s AI-powered BrandShield
• The indie gaming site is restored after nearly a day

On Monday, December 9, 2024, both the official X (formerly Twitter) and Bluesky social media accounts for popular PC indie gaming site Itch.io posted that the entire domain had been disabled. The cause? An automated AI ‘brand protection’ service.

According to Itch.io creator Leafo (and reported by Kitguru), Funko Pop’s BrandShield service flagged a Funko Pop fan page as “fraud and phishing” and automatically filed takedown requests with Itch.io’s hosting provider and domain registrar.

Despite Leafo having already complied with the takedown request, the domain registrar’s automated system responded by deactivating the Itch.io domain without any human input, which resulted in the entire site being taken offline.

As of this writing, Itch.io is back online, to the relief of gamers and especially indie developers reliant on it. However, this is clearly a case of how the use of AI-powered services and systems without human input or intervention can be disastrous.

Why AI cannot go unsupervised

As widely used and applicable AI is, there are drawbacks and negatives to its exclusive use. Like any tool, it can be a great aid for many — being a spell and grammar checker, applied to accessibility features, used for live language translations, automating repetitive and laborious work, and plenty more.

But the point of AI assistance is just that, assistance. It’s meant as a tool to make large-scale tasks easier but not to replace humans themselves. And stories like these are exactly why.

AI triggered a response that it was programed to do but without any situational context as to what happened, whether there was a need to flagged those reports as such, and whether the fan page warranted a flagging to begin with. Then another AI program, one also operating with no input or context, responded automatically and took the most drastic action it was programmed to do.

The only way to correct these errors was through human intervention (which took nearly a full day), and if humans had been involved in the process from the start this whole situation wouldn’t have escalated this far.

Especially since the AI response for the domain takedown in the first place was from BrandShield which, according to its website, is an AI-powered service that protects from phishing attempts and fraudulent websites as well as offers “brand protection.” While this seems like a useful and even vital service for high profile businesses with valuable IPs, the results unmonitored by a human can be disastrous.

I want to hope that Funko Pop and even the domain registrar, iwantmyname, have learned an important lesson in why humans must be integral to any process involving AI-powered tools. But, knowing how often these situations occur, most likely not.

• I’ve been using Google Search for 25 years and AI overview is the one thing that could ruin it for me
• Popular Python AI library hacked to deliver malware
• Goodbye, unreliable weather forecasts? Google DeepMind’s AI model sets new benchmark for 15-day predictions