Scientists Mapped a Fly’s Nervous System. The Internet Made It Play Doom

The fly connectome became a gaming meme. Its most revealing experiments ask a harder question: what does the biological wiring actually contribute?

José Palanco José Palanco
Last Updated:
7 min read
Share
Scientists Mapped a Fly’s Nervous System. The Internet Made It Play Doom

Beyond ASPM

Proof-Driven AppSec for teams building with AI

Plexicus uses AI Swarm Pentest to explore authorized application paths, validate what is exploitable, and give teams evidence they can use to prioritize remediation.

Explore AI Swarm Pentest

Scientists Mapped a Fly’s Nervous System. The Internet Made It Play Doom

An extraordinary neuroscience dataset became a playable internet meme. Developers connected simulated fruit-fly neural activity to Doom, Minecraft, and other virtual worlds. The videos are striking. They also invite a question that matters far beyond neuroscience: what, exactly, did the biological system cause?

In 2026, researchers published a detailed map of an adult male fruit fly’s central nervous system, including its brain, optic lobes, and ventral nerve cord. The MaleCNS project made its v1.0 data available in June; the accompanying Cell paper appeared on September 3. The map contains approximately 166,700 neurons, 11,710 neuron types, and 125 million synaptic contacts (Cambridge repository; Google Research).

That is a genuine scientific achievement. It is a structural map of biological connections, however, rather than a recording of a living fly’s thoughts or a complete specification for running one. The games combine measured wiring with mathematical approximations and developer-made input and output interfaces. Those additions determine much of what viewers see.

The hero image is a Plexicus editorial illustration of the online experiments, not a scientific image or a screenshot of a validated fly playing those games.

Colorful rendering of the male fruit fly central nervous system, with representative neurons from its annotated cell types

MaleCNS visualization showing one representative cell from each annotated neuron type. Credit: FlyEM Project Team/HHMI Janelia, Cambridge Connectomics Group, and Google Research. Original gallery and context.

What the map contains—and what it does not

A connectome records which neurons connect through synapses. Building this one required electron microscopy, computational reconstruction, and human verification over years. The inclusion of the ventral nerve cord makes it possible to follow pathways from sensory regions toward motor circuits. It does not cover every peripheral nerve, muscle, or physiological process in the animal (Google Research).

The male map extends an established line of work. In 2024, the FlyWire consortium published a female fruit-fly brain connectome with 139,255 neurons and about 54.5 million synapses. The 2026 male map is a complete male central nervous system reconstruction; it should not be described as the first full adult fly CNS map of any kind. A female brain and ventral nerve cord map had also been released.

Structural connectivity alone does not tell a simulator the exact membrane voltage of each neuron, every synapse’s functional strength, the animal’s neuromodulatory state, or how its body responds. To make the map run, developers assign neural dynamics and decide how external events stimulate it. Shiu and colleagues’ 2024 Nature model showed why this can be valuable: a relatively simple connectome-based model made useful predictions about feeding and grooming circuits. That result supports studying computation in the wiring. It does not establish a faithful reconstruction of an individual fly’s experience.

How a connectome enters a game

The basic pattern is a closed loop:

Game state → engineered sensory encoding → simulated neurons on measured wiring → selected neural readout → engineered game controls.

The biological network sits in the middle. The bridges on both sides must be designed. A virtual world does not naturally stimulate fly photoreceptors, and a game engine does not naturally interpret a descending neuron’s firing as “turn left” or “shoot.”

A Minecraft fruit-fly mod maps game stimuli to sensory populations, runs a MaleCNS-derived neural graph with simplified dynamics, then decodes activity into movement. Its documentation describes thresholds and a hand-built body layer. That makes it an inventive simulation experiment, not a fly independently understanding Minecraft.

Fly64 applies the idea to Super Mario 64. It gives the simulated network a virtual visual perspective, reads activity from chosen neural groups, and converts that activity into Mario’s movement and jumps. Its creator explicitly presents the project as educational and unvalidated. The technical notes say that measured wiring does not establish recovered physiology, behavior, experience, or consciousness.

The clearest example of both the promise and the limits is Doom. DOOMFLY connects MaleCNS activity to a live Doom-engine arena. Game frames stimulate modeled visual neurons; selected neural outputs become movement and firing commands. Its neuroscience review describes a real closed-loop connectome simulation. The same documentation states that its sensory mapping, neuron dynamics, and motor decoder are approximations, not validated fly vision or natural action selection. Its experimental training notes report failed validation gates; learned survival has not been demonstrated.

The phrase “a fly plays Doom” works as a memorable headline. A more precise description is that a game is coupled to a simulated network built on fly connectivity through human-designed interfaces. The developers’ published negative results make that description more useful, not less.

The same wave produced a widely shared Beat Saber clip. It helped turn the fly into an internet character, but a short video does not disclose the neural model, control mapping, or validation needed to assess a biological claim. The Beat Saber tile in our hero illustration represents that meme, not an independently verified result.

The “brain upload” claim came from a different experiment

The viral upload story is easy to confuse with the later MaleCNS game projects. In March 2026, Eon Systems described an embodied virtual fruit fly built from the earlier female FlyWire brain map, simplified neural dynamics, and a physics-simulated body. It was not an upload of the male fly whose CNS paper appeared in September.

Eon’s technical explanation details important limits: only a subset of sensory inputs and behaviors is modeled, much biological physiology is simplified, and lower-level body controllers translate selected neural signals into movement. A simulated fly showing grooming or foraging-like behavior is interesting. Whether those behaviors arise from a sufficiently faithful recreation of the original animal is a different claim.

The Carboncopies Foundation’s response argues that “upload” overstates the evidence. The disagreement does not require dismissing Eon’s engineering. It requires distinguishing an embodied, connectome-informed model from a demonstrated transfer of an individual animal’s mind. Neither Eon’s demonstration nor the game integrations establish preserved memory, subjective experience, or consciousness.

A security experiment supplied a better control

The most revealing twist came from security operations. Intezer reported an experiment that encoded 12,716 of its own security alerts as neural stimuli and trained a linear readout on resulting activity. According to the company’s write-up, the real fly connectome reached 0.887 ROC-AUC in five-fold cross-validation. It clearly carried usable information.

Then Intezer tested whether the fly’s particular biological wiring was responsible. A scrambled network scored 0.910; a random reservoir scored 0.918; a conventional logistic regression on the alert features scored 0.922. These are Intezer’s reported results for its own data and setup, not an independently replicated or peer-reviewed benchmark. They do, however, show why a functioning demo is insufficient evidence of a unique biological advantage in this task.

The appropriate conclusion is narrow. A connectome-based reservoir can produce signals that a classifier uses. In this alert experiment, simpler or scrambled alternatives performed better. It does not follow that connectomes have no useful computations; it follows that the comparison is essential.

Another security project, CVE-FLY, explores whether neural activity can steer a fuzzer’s exploration versus exploitation policy. It uses a female-brain model, not MaleCNS. The repository reports reaching a deliberately planted heap overflow in a toy C program after 3,458 executions. Python still mutates the bytes, and the repository does not establish that this approach beats established fuzzers or an appropriate random baseline. This is a research prompt, not evidence that a fly “hacked” a real target.

What these demos prove

The scientific milestone is access to detailed, reusable biological connectivity. Developers can now download a large nervous-system graph, assign dynamics, inject stimuli, inspect activity, and connect outputs to software. That opens genuine research possibilities. It also makes visually persuasive demonstrations unusually cheap to misunderstand.

For every claim, ask what was measured and what was supplied by engineering:

  • Anatomy: Is the graph from an actual reconstruction? Was it filtered or cropped?
  • Dynamics: Which neural equations and weights were assumed rather than measured?
  • Interfaces: Who chose the sensory mapping and output decoder? Does game state bypass the advertised sensory path?
  • Controls: Does real wiring outperform scrambled wiring, a random network, and a simple baseline?
  • Validation: Does a behavior survive held-out tests, ablation, and reproduction by others?

These questions also apply to AI security products. A video of an autonomous agent finding a vulnerability is a demonstration. A defensible result identifies the target and scope, establishes reachability and impact, compares against simpler alternatives, records the agent’s actual actions, and retests the proposed fix. Proof matters most when the demo is spectacular.

The fly did not demonstrate that it learned Doom, and no experiment here establishes a mind upload. The achievement is already remarkable: a nervous system’s measured wiring became a public computational resource. The next step is to learn which outcomes come from that wiring—and which come from the software built around it.

Written by
José Palanco
José Palanco
José Ramón Palanco is the CEO/CTO of Plexicus, a pioneering company in ASPM (Application Security Posture Management) launched in 2024, offering AI-powered remediation capabilities. Previously, he founded Dinoflux in 2014, a Threat Intelligence startup that was acquired by Telefonica, and has been working with 11paths since 2018. His experience includes roles at Ericsson`s R&D department and Optenet (Allot). He holds a Telecommunications Engineering degree from the University of Alcala de Henares and a Master`s in IT Governance from the University of Deusto. As a recognized cybersecurity expert, he has been a speaker at various prestigious conferences including OWASP, ROOTEDCON, ROOTCON, MALCON, and FAQin. His contributions to the cybersecurity field include multiple CVE publications and the development of various open source tools such as nmap-scada, ProtocolDetector, escan, pma, EKanalyzer, SCADA IDS, and more.
Read More from José
More to read

Related posts

Ready to validate what matters?

Ready to validate what matters?

Plexicus is Proof-Driven AppSec: validated findings, contextual understanding, and reviewed remediation — anchored in evidence, scoped with you.

Qualification

Check whether AI Swarm Pentest fits your environment.

Share the minimum context. We will review the scope and tell you the next commercial step.

Before submitting — verify you fit

0 / 280

No commitment. If you don't fit, we'll tell you.

SAMPLE HANDOVER · ILLUSTRATIVE

Sample evidence handover

A trimmed view of what your team receives at the end of an AI Swarm Pentest engagement. Real engagements include full technical evidence, executive narrative, and a remediation plan.

VALIDATED FINDING Evidence attached

Server-Side Request Forgery in webhooks/receiver

demo-project/sample-app · src/webhooks/receiver.py:42

SeverityHigh CVSS 3.18.6 Priority79 Confirmedvia replay

Untrusted caller-supplied URLs reach an internal egress without an allowlist. Replayed in a sandbox against a fresh authorized target — the same control was validated to fail twice.

REVIEWER-READY REMEDIATION Merge-ready PR

Validate the target URL against an allowlist of permitted hostnames. Reject private/internal IP ranges. Enforce HTTPS only.

plexicus/remediation/webhooks-ssrf 3 changed · 0 new files
42resp = requests.get(target_url)
42+if not is_allowed_host(target_url):
43+  raise WebhookRejected(target_url)
44+resp = requests.get(target_url, timeout=5)
Every engagement hands over:
  • Executive briefing
  • Validated findings list
  • Merge-ready PRs
  • Compliance mapping (NIS2 · DORA · CRA)