One of the world’s biggest fan fiction sites, Archive of Our Own, has been down since October 29, and so far, services have not been restored after what the team has confirmed was a security breach. In an update shared on October 30, the website said it had detected evidence of a security incident and that the team was working on fixing the issue, while assuring users that no data had been deleted from its massive library of fan-contributed stories.
In the latest update, shared three days ago, the site’s operators said the work to bring it back is still in progress. They didn’t provide an exact date for when the site will go live, only mentioning that the original estimate of two to four weeks for restoration is still on track. On social media sites, multiple users have shared their dismay over the site being down for so long, while also highlighting a concerning trend supercharged by AI.
Soon after Archive of Our Own, popularly known as AO3, went down, several copycat websites, such as AO3.life, popped up. These sites appear to have illicitly scraped fan fiction from Archive of Our Own, and on AO3.life, many of those stories were even converted into AI-generated audiobooks that were listed for sale, without ever taking the writers’ permission. Some of the largest clone sites have since been shut down after being bombarded with takedown notices.
The situation with AO3 is worse from another perspective, as the scraped work ended up being repackaged and monetized. It’s not the first time that has happened, either. Back in 2024, sellers on Etsy were scraping works from sites like AO3 and turning them into physical books, some of which cost as much as $100.
Speaking to CNN, Naomi Novik, a co-founder of AO3, pointed fingers at AI companies, claiming that thanks to their irresponsibility, virtually the entire tech world is being slammed at once and racing to push fixes at breakneck speed. That, she noted, is especially hard for a volunteer-run operation like AO3. There’s no official confirmation so far that AI played a role in the AO3 breach.
Over the past few months, we have heard of multiple incidents where AI was deployed for hacking and other illicit activities. Meanwhile, experts across the spectrum have warned that AI is going to make cybersecurity a nightmare. And we’re not just talking about open-source models without guardrails. Even frontier models developed by the likes of Anthropic and OpenAI have unexpectedly broken out of their test environments during cybersecurity evaluations and gone on to break into third-party systems in the past few months.
Archive of Our Own has over 83,000 fandoms dedicated to different IPs and hosts over 18 million works from writers across the globe. This also isn’t the first time AO3 has been targeted. Back in July 2023, the website went offline for 28 hours after a hacking group called Anonymous Sudan hit it with a DDoS attack, claiming it was targeting the site for hosting explicit content and stories.
As for AO3, the team did not fully rule out the possibility that its user database had been stolen. AO3 doesn’t collect real names, and it also clarifies that donor information is stored separately, but the user database can contain usernames, email addresses, IP addresses, and hashed passwords. That’s why users have been advised to change their passwords on any other site where they reused their AO3 credentials.