{"meta":{"exportedAt":"2026-10-23T08:59:28.470Z","formatVersion":2,"selection":{"q":"bc","system":"","harm":"","context":"","country":"","role":"","relation":"","evidence":"","year":"2025","response":"regulatory","severity":"","verification":"","view":"incidents","sort":"added"},"totalIncidents":2,"coverage":{"cases":2,"countries":1,"languages":1,"unknownLocation":1,"locationPending":0,"unknownLanguage":0,"unknownDate":0,"lawsuits":0,"regulatory":2,"minors":1,"coreRelations":1,"contextualRelations":1,"mixedRelations":0,"unknownRelations":0,"relationPending":0,"relationUnknown":0},"countingNote":"Distinct public cases in this selection. People counts apply within individual cases only; cross-case person overlap has not been resolved. No population incidence estimate.","affectedCountNote":"Interpret person counts with affectedCountStatus and the reported effects. Unquantified zeros are placeholders, not a measured zero.","source":"AI incidents","publisher":"NOPE","url":"https://nope.net/incidents","license":"CC BY 4.0"},"incidents":[{"id":"2025-nsw-resilient-homes-program-applicant-data-uploaded-to-chatgpt","caseFacts":{"claims":[{"id":"c1","status":"reported","evidence":[{"locator":"Some personal information provided by people during the RHP applications process was uploaded by a former temporary employee of the RA to the AI platform, ChatGPT.","relation":"supports","source_id":"s1"},{"locator":"The data shared was contained in a Microsoft Excel spreadsheet with 10 columns and more than 12,000 rows of information.","relation":"supports","source_id":"s1"},{"locator":"The upload took place between 12 and 15 March 2025.","relation":"supports","source_id":"s1"},{"locator":"This incident occurred when a former temporary employee uploaded information from a Microsoft Excel spreadsheet to an unauthorised third-party AI platform, ChatGPT.","relation":"supports","source_id":"s1"},{"locator":"Between 12 and 15 March 2025, personal information was uploaded by a former contractor of the RA to the Artificial Intelligence platform ChatGPT.","relation":"supports","source_id":"s4"},{"locator":"\"Personal information was uploaded by a former contractor of the RA to the artificial intelligence platform ChatGPT,\" an RA spokesperson said.","relation":"supports","source_id":"s2"},{"locator":"The authority said in a breach notice that the upload “was not authorised”.","relation":"supports","source_id":"s3"}],"assertion":"Between 12 and 15 March 2025 a former temporary staff member (called a former contractor in the first notice) of the NSW Reconstruction Authority uploaded a Microsoft Excel spreadsheet of Northern Rivers Resilient Homes Program information (10 columns, more than 12,000 rows) to ChatGPT; the Authority says the upload was not authorised and was not a cyber-attack.","causal_attribution":"The Authority's own notices report the upload, its dates and its unauthorised status; the ABC and iTnews relay those notices. The uploader's role is a former temporary staff member on the current page and a former contractor in the first notice and the press."},{"id":"c2","status":"reported","evidence":[{"locator":"2031 people who provided information to the RA for the RHP had some of their data uploaded to ChatGPT.","relation":"supports","source_id":"s1"},{"locator":"Name and contact details","relation":"supports","source_id":"s1"},{"locator":"Residential/mailing address","relation":"supports","source_id":"s1"},{"locator":"Date of birth","relation":"supports","source_id":"s1"},{"locator":"Sensitive personal information","relation":"supports","source_id":"s1"},{"locator":"Sensitive health information","relation":"supports","source_id":"s1"},{"locator":"Limited financial commentary, but not banking or financial details","relation":"supports","source_id":"s1"},{"locator":"no driver's licence numbers, Medicare numbers, passport numbers, or Tax File Numbers were disclosed in the breach.","relation":"supports","source_id":"s1"},{"locator":"Up to 3000 individuals may be impacted by the breach.","relation":"supports","source_id":"s4"},{"locator":"The breach shared the names and addresses of program applicants, as well as email addresses, phone numbers, and other personal and health information.","relation":"supports","source_id":"s2"}],"assertion":"The Authority says external forensic analysis confirmed that 2031 people who provided information for the program had some of their data uploaded to ChatGPT, including name and contact details, residential or mailing address, date of birth, sensitive personal and health information and limited financial commentary, and that no driver licence, Medicare, passport or Tax File Numbers were disclosed; its first notice had estimated up to 3000 people.","causal_attribution":"The Authority's statements report the count and data categories from its forensic analysis; the ABC relays the first notice's categories."},{"id":"c3","status":"reported","evidence":[{"locator":"There is no evidence that any of the uploaded data is publicly available online or has been accessed by a third party at this stage.","relation":"supports","source_id":"s1"},{"locator":"We believe the risk of misuse is low","relation":"supports","source_id":"s1"},{"locator":"There is no evidence that any information has been made public, however this cannot be ruled out","relation":"supports","source_id":"s4"}],"assertion":"The Authority says there is no evidence that the uploaded data is publicly available online or has been accessed by a third party; its first notice said this could not be ruled out, and it assesses the risk of misuse as low.","causal_attribution":"The Authority's own assessment. Whether OpenAI retained, deleted or used the uploaded data is not addressed in the inspected sources."},{"id":"c4","status":"reported","evidence":[{"locator":"we are deeply sorry for the distress it may cause for those involved in the program.","relation":"supports","source_id":"s1"},{"locator":"I feel concerned — the information with the RA was deeply personal,","relation":"supports","source_id":"s2"}],"assertion":"The Authority apologised for the distress the breach may cause, and a program participant whose flooded home was bought back told the ABC the information held by the Authority was deeply personal and that they felt concerned.","causal_attribution":"The concern is one participant's stated reaction; the ABC does not say whether this person is among the 2031. No identity misuse or other realised loss is reported."},{"id":"c5","status":"reported","evidence":[{"locator":"We are working with Social Futures to reach out to people who have been impacted and ID Support NSW, a government identity and cyber security support service, to assist anyone whose data may have been compromised.","relation":"supports","source_id":"s1"},{"locator":"The NSW Reconstruction Authority will provide compensation for any reasonable out of pocket expenses if any compromised identity documents need to be replaced.","relation":"supports","source_id":"s4"}],"assertion":"The Authority contacted affected people with ID Support NSW and Social Futures to offer support, and said it would compensate reasonable out-of-pocket expenses if compromised identity documents needed replacing.","causal_attribution":"The Authority's statements about its response."},{"id":"c6","status":"reported","evidence":[{"locator":"We are working with Cyber Security NSW to monitor the internet and dark web to see if any of this information is accessible online. The NSW Privacy Commissioner has also been notified.","relation":"supports","source_id":"s1"},{"locator":"The RA has also implemented controls to block the upload of personal information into AI tools.","relation":"supports","source_id":"s1"},{"locator":"An independent review into the data breach has now been completed, identifying several areas for improvement in RA’s governance, training and data security practices.","relation":"supports","source_id":"s1"}],"assertion":"The Authority notified the NSW Privacy Commissioner, had Cyber Security NSW monitor the internet and dark web, implemented controls to block the upload of personal information into AI tools, and completed an independent review that identified areas for improvement in its governance, training and data security practices.","causal_attribution":"The Authority's own account of its response; the review report itself was not inspected."},{"id":"c7","status":"reported","evidence":[{"locator":"The AI-related data breach was disclosed on what is a public holiday Monday in NSW, although it actually occurred over six months ago, between March 12 and 15.","relation":"supports","source_id":"s3"},{"locator":"said she received a preliminary report about the breach in July, and the final report on Friday.","relation":"supports","source_id":"s2"},{"locator":"\"I would prefer [for the RA] to advise people sooner, and I'm also informed they couldn't identify everybody, but I need to see the report first,\" she said.","relation":"supports","source_id":"s2"}],"assertion":"The breach was disclosed publicly on 6 October 2025, more than six months after the upload; the NSW Minister for Recovery told the ABC she had received a preliminary report about the breach in July and would have preferred people to be advised sooner.","causal_attribution":"iTnews's own observation of the disclosure timing and the Minister's statement to the ABC; the Authority attributes the delay to the time needed to identify affected people."}],"effects":[{"label":"personal and sensitive information of 2031 Resilient Homes Program participants was uploaded to ChatGPT without authorisation","claim_id":"c2","direction":"negative"},{"label":"a program participant reports concern about the deeply personal information held; the Authority apologised for possible distress","claim_id":"c4","direction":"negative"}],"sources":[{"id":"s1","url":"https://www.nsw.gov.au/departments-and-agencies/nsw-reconstruction-authority/resilient-homes-program-data-breach","kind":"official_statement","access":"read","language":"en","translation_note":"English original; full body read by curl on 2026-10-11 (page last updated 26 March 2026, with the 9 December 2025 update and FAQ on the same page).","independence_group":"nsw-ra-statement"},{"id":"s2","url":"https://www.abc.net.au/news/2025-10-06/data-breach-northern-rivers-resilient-homes-program-chatgpt/105855284","kind":"news_report","access":"read","language":"en","translation_note":"English original; full body read by curl on 2026-10-11. Relays the Authority statement; the participant and the Minister were interviewed separately within the same article.","independence_group":"nsw-ra-statement"},{"id":"s3","url":"https://www.itnews.com.au/news/nsw-gov-contractor-uploaded-excel-spreadsheet-of-flood-victims-data-to-chatgpt-620815","kind":"news_report","access":"read","language":"en","translation_note":"English original; full body read by curl on 2026-10-11. Relays the Authority breach notice; the disclosure-timing observation is the outlet's own.","independence_group":"nsw-ra-statement"},{"id":"s4","url":"https://www.nsw.gov.au/departments-and-agencies/nsw-reconstruction-authority/media-releases/northern-rivers-resilient-homes-program-data-breach","kind":"official_statement","access":"read","language":"en","translation_note":"English original; full body read by curl on 2026-10-11. Authority departmental release of the first notice, 6 October 2025.","independence_group":"nsw-ra-statement"}],"version":1,"ai_roles":["institutional_use"],"contexts":["privacy","public_services"],"unknowns":["Why the staff member uploaded the spreadsheet and what, if anything, was asked of ChatGPT; no ChatGPT output is described.","Whether OpenAI retained, deleted or used the uploaded data for training; the sources establish the upload to the service only.","Whether any participant suffered identity misuse or other realised loss; none is reported.","Whether the uploader was a temporary staff member or a contractor (the Authority uses both terms), and how many separate uploads occurred between 12 and 15 March 2025.","The findings of the independent review beyond the Authority's summary of it."],"geography":{"basis":"The data was held by the NSW Reconstruction Authority, a New South Wales government agency, and was uploaded by a former temporary staff member of that agency; the Authority describes the incident as a breach of its program data. The ABC describes the affected people as northern NSW residents of the Northern Rivers region. No court is involved.","court_countries":[],"event_countries":["AU"],"affected_person_countries":["AU"]},"publication":{"basis":"The Authority's notices, read in full on 2026-10-11, state that a staff member uploaded program participants' personal and sensitive information to ChatGPT without authorisation and that forensic analysis confirmed 2031 affected people. The disclosure of their information to a generative AI service without their knowledge is the recorded privacy harm. The upload rests on the Authority's own account, which the press relayed; no retention, training, public exposure or misuse is established. The uploader and affected people are not named.","reviewed_on":"2026-10-11"},"ai_involvement":{"basis":"The Authority states that a former temporary staff member uploaded a spreadsheet of program information to ChatGPT between 12 and 15 March 2025, that the upload was not authorised, and that forensic analysis confirmed 2031 people had some of their data uploaded. The reported transfer of their personal and sensitive information into the generative AI service is the AI connection to the privacy harm. This establishes the upload only. It does not establish retention by OpenAI, use for training, public exposure or a finding of illegality, and no ChatGPT output affecting participants is described.","status":"supported"},"person_relations":["received_personal_information"]},"name":"NSW Reconstruction Authority says a former temporary staff member uploaded 2031 Resilient Homes participants' personal data to ChatGPT without authorisation","summary":"The NSW Reconstruction Authority says that between 12 and 15 March 2025 a former temporary staff member (called a former contractor in its first notice) uploaded a Microsoft Excel spreadsheet of Northern Rivers Resilient Homes Program information, 10 columns and more than 12,000 rows, to ChatGPT, an AI platform the Authority had not authorised. The Authority disclosed the breach on 6 October 2025, estimating that up to 3000 people were affected, and later said external forensic analysis confirmed that 2031 people had some of their data uploaded, including names, contact details, addresses, dates of birth, sensitive personal and health information and limited financial commentary. It says no driver licence, Medicare, passport or Tax File Numbers were disclosed and that there is no evidence the data is publicly available or was accessed by a third party; whether OpenAI retained or used the data is not addressed. The Authority apologised, contacted affected people with ID Support NSW, offered to compensate the replacement of compromised identity documents and notified the NSW Privacy Commissioner. A program participant told the ABC the information was deeply personal and that they felt concerned. No misuse of the data is reported.","incidentDate":"2025-03-12","incidentEndDate":"2025-03-15","incidentKind":"bounded_series","incidentDatePrecision":"range","exposurePattern":"unknown","reportedDate":"2025-10-06","aiSystem":"ChatGPT (OpenAI), used through an unauthorised upload of program data by a person working for the NSW Reconstruction Authority","aiProduct":"ChatGPT","aiCompany":"OpenAI","severity":"low","verificationStatus":"credible","harmCategories":[],"harmOutcomes":["other_material_harm"],"harmOutcomeSummary":"The NSW Reconstruction Authority reports that personal and sensitive information of 2031 Resilient Homes Program participants was uploaded to ChatGPT without authorisation, a loss of privacy for those people; it reports no evidence of public exposure or third-party access, and no misuse is reported (the Authority's notices and press coverage relaying them).","frameworkFacets":[],"causationStatus":"alleged","participantUsersAffectedMin":0,"otherPeopleHarmedMin":2031,"affectedCountStatus":"exact","affectedCountEvidence":"The Authority states that external forensic analysis confirmed 2031 people had some of their data uploaded to ChatGPT. The upload of their personal information to the AI service is itself the privacy harm recorded, so those 2031 people are counted as other people harmed. The first notice's estimate of up to 3000 is not used; the 12,000 rows are rows, not people. The participant quoted by the ABC is not separately counted because the ABC does not say whether that person is among the 2031. The uploader is not counted.","victimAgeRange":"unknown","jurisdiction":"AU-NSW","platformType":"chatbot","outcomeType":"investigation_opened","outcomeStatus":"resolved","primarySourceUrl":"https://www.nsw.gov.au/departments-and-agencies/nsw-reconstruction-authority/resilient-homes-program-data-breach","primarySourceLabel":"NSW Reconstruction Authority, updated 26 March 2026: Resilient Homes Program data breach","firstPublishedAt":"2026-09-29T12:41:19.196147+00:00","updatedAt":"2026-10-11T03:10:38.11789+00:00","scopeVersion":"facts-v3","tags":["historical-2025"]},{"id":"2025-grok-non-consensual-image-generation","caseFacts":{"claims":[{"id":"c1","status":"corroborated","evidence":[{"locator":"'image generation and editing are currently limited to paying subscribers'; the standalone app/X tab complied with undress requests including NBC's consenting test subject.","relation":"supports","source_id":"s2"},{"locator":"AP: Grok let users 'undress people, putting females in transparent bikinis or revealing clothing'; some images appeared to include children.","relation":"supports","source_id":"s7"},{"locator":"'Over the past several weeks, Grok allowed users to create and publicly post sexually altered images of real people at the click of a button.'","relation":"supports","source_id":"s8"}],"assertion":"From late December 2025, Grok's image generation and editing on X and the standalone app let users generate sexualized images of real people at scale; xAI limited generation to paying subscribers on 9 January 2026, but NBC's own consenting test found the standalone app and X tab still complied with 'undress' requests.","causal_attribution":"The conduct is established by NBC's direct test plus official accounts; the paywall change's limited effect is NBC's finding."},{"id":"c2","status":"reported","evidence":[{"locator":"Genevieve Oh's analysis: 7,751 sexualized images in one hour Wednesday, up 16.4% from 6,659/hr Monday.","relation":"supports","source_id":"s2"},{"locator":"NYT via NC DOJ: 'generated and posted 4.4 million images, of which at least 41 percent were sexualized images of women' over nine days.","relation":"supports","source_id":"s8"},{"locator":"CCDH via Engadget: 'an estimated 3 million sexualized images over 11 days, including 23,000 of minors'.","relation":"supports","source_id":"s9"}],"assertion":"Scale analyses: Genevieve Oh's analysis found 7,751 sexualized images generated in one hour on a Wednesday (up 16.4% from 6,659/hour on Monday); the New York Times reported 4.4 million images over nine days, at least 41% sexualized images of women; an AP analysis of 20,000 images from 25 December-1 January found 2% appeared to be 18 or younger; CCDH estimated about 3 million sexualized images over 11 days including roughly 23,000 of minors.","causal_attribution":"Each figure belongs to its own analysis (Oh; NYT; AP via Fortune; CCDH); none is platform-confirmed and they are not merged. The AP 20,000-image analysis is carried via Fortune. The Bloomberg ~6,700/hour, 84-85x figure is recorded as unavailable."},{"id":"c3a","status":"reported","evidence":[{"locator":"'I felt horrified, I felt violated, especially seeing my toddler's backpack in the back of it'; image of her at 14 undressed, up ~12 hrs, removed after the Guardian sought comment.","relation":"supports","source_id":"s3"}],"assertion":"Ashley St. Clair said users sexualized images of her, including one of her at 14 that stayed up about 12 hours and was removed after the Guardian sought comment: 'I felt horrified, I felt violated.'","causal_attribution":"Her account to the Guardian; her own lawsuit is a separate held row and is not merged here."},{"id":"c3b","status":"reported","evidence":[{"locator":"'dehumanised and reduced into a sexual stereotype'; 'others asked Grok to generate more of her'; 'While it wasn't me that was in states of undress, it looked like me and it felt like me and it felt as violating.'","relation":"supports","source_id":"s1"}],"assertion":"Samantha Smith told the BBC she felt 'dehumanised and reduced into a sexual stereotype', and after she posted about it, others asked Grok to generate more of her.","causal_attribution":"Her account to the BBC."},{"id":"c3c","status":"reported","evidence":[{"locator":"'had seen an increase in people using Grok to undress her'; the 'sticking plaster' quote.","relation":"supports","source_id":"s4"}],"assertion":"Dr Daisy Dixon, a Cardiff University lecturer, told the BBC she had seen an increase in people using Grok to undress her and called the paywall change 'a sticking plaster'.","causal_attribution":"Her account to the BBC."},{"id":"c4","status":"corroborated","evidence":[{"locator":"IWF analysts found 'criminal imagery' of girls aged 11-13 apparently made with Grok.","relation":"supports","source_id":"s4"},{"locator":"AI Forensics' review: ~800 archived URLs, <10% apparent CSAM ('photorealistic people, very young'), ~70 URLs reported to EU regulators.","relation":"supports","source_id":"s5"}],"assertion":"The Internet Watch Foundation told the BBC its analysts found 'criminal imagery' of girls aged 11-13 apparently made with Grok; Wired and AI Forensics reviewed about 800 archived Grok Imagine URLs with under 10% apparent CSAM and reported about 70 URLs to EU regulators.","causal_attribution":"Two independent expert bodies' findings (IWF; AI Forensics); the minors are unnamed and uncounted per the counting rules."},{"id":"c5","status":"corroborated","evidence":[{"locator":"NBC: Ofcom 'urgent contact'; Starmer 'disgraceful... X has got to get a grip'.","relation":"supports","source_id":"s2"},{"locator":"ICO announcement: formal investigations into XIUC and X.AI; follows the 7 January contact.","relation":"supports","source_id":"s6"},{"locator":"AP via PBS: the EU's formal DSA investigation; 'materialized' risks; 'serious harm'.","relation":"supports","source_id":"s7"},{"locator":"NC DOJ release: the 35-AG letter and its demands.","relation":"supports","source_id":"s8"},{"locator":"Engadget: the Baltimore suit; City Solicitor Thompson's statement.","relation":"supports","source_id":"s9"},{"locator":"TechPolicy.Press: the Amsterdam order of 26 March.","relation":"supports","source_id":"s13"},{"locator":"Reuters headline (body unavailable): Ireland DPC inquiry of 17 February.","relation":"context","source_id":"s11"}],"assertion":"Formal regulatory and legal actions followed: Ofcom's urgent contact (5 Jan; response by 9 Jan; investigation announced 12 Jan); the UK ICO's formal investigations into XIUC and X.AI LLC (3 Feb); the European Commission's formal DSA investigation (26 Jan, risks 'materialized' into 'serious harm'); Ireland's DPC GDPR inquiry (17 Feb); 35 US state attorneys general's demand letter (23 Jan); Baltimore's consumer-protection suit (24 Mar; D. Md. 1:26-cv-02103); and an Amsterdam court order to stop generating or distributing non-consensual sexualized images in the Netherlands (26 Mar, Offlimits suit, penalty up to €10 million).","causal_attribution":"Each action is carried by an inspected official or news source; the California AG probe (NBC) and the Indonesia/Malaysia/Philippines blocks (Reuters bodies unavailable) are recorded in the outcome and reported in the narrative."},{"id":"c6","status":"corroborated","evidence":[{"locator":"AP: the X statement of 14 January ('bikinis, underwear or other revealing attire', where illegal).","relation":"supports","source_id":"s7"},{"locator":"BBC (16 Mar): Musk's 'Literally zero' post of 14 January.","relation":"supports","source_id":"s10"}],"assertion":"xAI's 14 January statement said it would stop allowing users to depict people in 'bikinis, underwear or other revealing attire' where illegal; Musk posted on 14 January that he was 'not aware of any naked underage images... Literally zero'.","causal_attribution":"The company's and Musk's statements are recorded as their positions; the IWF and AI Forensics findings stand in tension with 'Literally zero' and are preserved as contrary evidence."},{"id":"c7","status":"reported","evidence":[{"locator":"BBC (20 Apr 2026): the 3 Feb raid, the summons, Musk's non-appearance, the DOJ refusal, and the probe's scope.","relation":"supports","source_id":"s10"}],"assertion":"Paris police raided X's offices on 3 February and summoned Musk and Yaccarino for 20 April; Musk did not appear, and the US DOJ declined to assist France; the French probe includes complicity in possession or organised distribution of child sexual abuse material.","causal_attribution":"Single inspected chain (BBC); attributed accordingly."}],"effects":[{"label":"industrial-scale non-consensual sexualized imagery of real people, including apparent minors, generated by Grok","claim_id":"c1","direction":"negative"}],"sources":[{"id":"s1","url":"https://www.bbc.com/news/articles/c98p1r4e6m8o","kind":"news_report","access":"read","language":"en","translation_note":"Read in English on 2026-09-15 (2 Jan 2026). Samantha Smith's account.","independence_group":"bbc"},{"id":"s2","url":"https://www.nbcnews.com/tech/internet/x-paywall-ai-image-grok-app-bikini-allows-sexual-deepfakes-rcna252647","kind":"news_report","access":"read","language":"en","translation_note":"Read in English on 2026-09-15 (8 Jan 2026). Paywall change; NBC's own consenting test; Genevieve Oh's analysis; Starmer and Ofcom accounts.","independence_group":"nbc"},{"id":"s3","url":"https://www.theguardian.com/technology/2026/jan/05/elon-musk-ashley-st-clair-grok-fake-sexualised-images","kind":"news_report","access":"read","language":"en","translation_note":"Read in English on 2026-09-15 (5 Jan 2026). Ashley St. Clair's account.","independence_group":"guardian"},{"id":"s4","url":"https://www.bbc.com/news/articles/c99kn52nx9do","kind":"news_report","access":"read","language":"en","translation_note":"Read in English on 2026-09-15 (9 Jan 2026, McMahon/Cress). Dr Daisy Dixon; the IWF finding.","independence_group":"bbc"},{"id":"s5","url":"https://www.wired.com/story/grok-is-generating-sexual-content-far-more-graphic-than-whats-on-x/","kind":"news_investigation","access":"read","language":"en","translation_note":"Read in English on 2026-09-15 (7 Jan 2026, Burgess/Varner). AI Forensics' review of ~800 archived Grok Imagine URLs.","independence_group":"wired"},{"id":"s6","url":"https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/ico-announces-investigation-into-grok/","kind":"regulator_announcement","access":"read","language":"en","translation_note":"Read in English on 2026-09-15 (formal investigations into XIUC and X.AI LLC; follows the 7 January urgent-information contact).","independence_group":"ico"},{"id":"s7","url":"https://www.pbs.org/newshour/world/eu-investigates-musks-ai-chatbot-grok-over-sexual-deepfakes","kind":"wire_report","access":"read","language":"en","translation_note":"Read in English on 2026-09-15 (AP, Kelvin Chan; 26 Jan 2026). EU DSA investigation; X's 14 January statement.","independence_group":"ap"},{"id":"s8","url":"https://ncdoj.gov/attorney-general-jeff-jackson-leads-bipartisan-coalition-demanding-xai-stop-creating-and-remove-groks-nonconsensual-sexual-images/","kind":"regulator_press_release","access":"read","language":"en","translation_note":"Read in English on 2026-09-15 (23 Jan 2026). The 35-AG letter; quotes the New York Times' 4.4M/41% figure.","independence_group":"nc-doj"},{"id":"s9","url":"https://www.engadget.com/ai/baltimore-sues-xai-over-grok-deepfakes-214135922.html","kind":"news_report","access":"read","language":"en","translation_note":"Read in English on 2026-09-15 (24 Mar 2026). Baltimore suit; the CCDH estimate.","independence_group":"engadget"},{"id":"s10","url":"https://www.bbc.com/news/articles/crk151nn7j3o","kind":"news_report","access":"read","language":"en","translation_note":"Read in English on 2026-09-15 (20 Apr 2026). Paris raid; Musk's non-appearance; DOJ refusal to assist France.","independence_group":"bbc"},{"id":"s11","url":"https://www.reuters.com/sustainability/boards-policy-regulation/ireland-opens-probe-into-musks-grok-ai-over-sexualised-images-2026-02-17/","kind":"wire_report","access":"unavailable","language":null,"translation_note":"HTTP 401 on 2026-09-15; headline and date verified from the URL and snapshot; body not read.","independence_group":"reuters"},{"id":"s12","url":"https://www.bloomberg.com/news/articles/2026-01-07/","kind":"news_report","access":"unavailable","language":null,"translation_note":"HTTP 403 on 2026-09-15; the ~6,700/hour, 84-85x analysis is attributed from the historical record and secondary references; body not read.","independence_group":"bloomberg"},{"id":"s13","url":"https://www.techpolicy.press/dutch-court-orders-x-grok-to-stop-aigenerated-sexual-abuse-content/","kind":"news_report","access":"read","language":"en","translation_note":"Read in English on 2026-09-15 (27 Mar 2026). Amsterdam court order in the Offlimits case.","independence_group":"techpolicy-press"},{"id":"s14","url":"https://www.nbcnews.com/tech/tech-news/ashley-st-clair-sues-xai-grok-sexual-images-rcna254302","kind":"news_report","access":"read","language":"en","translation_note":"Read on 2026-09-15 (15 Jan 2026). St. Clair's suit; cross-reference to the related held row.","independence_group":"nbc"},{"id":"s15","url":"https://www.pacermonitor.com/public/case/64870891/MAYOR_AND_CITY_COUNCIL_OF_BALTIMORE_v_X_Corp_et_al","kind":"court_docket","access":"read","language":"en","translation_note":"Docket page read on 2026-09-15 (D. Md. 1:26-cv-02103; SpaceX dismissed without prejudice 17 Jul; MTD briefing under way as of 29 Jul).","independence_group":"court-record"}],"version":1,"ai_roles":["others_use"],"contexts":["everyday_life","justice"],"unknowns":["The Bloomberg analysis (~6,700 images/hour, 84-85x leading deepfake sites) could not be read (403) and is recorded without its body.","Whether the images remain hosted and downloadable (Wired's June 2026 follow-up, cited but not read) is unverified.","The N.D. Cal. class action's pseudonymity ruling of 30 July is known only through a blocked summary (internetcases 403).","The outcome of the Amsterdam order's penalty mechanism and xAI's compliance are not reported in the inspected sources.","The Indonesia/Malaysia/Philippines blocks and lifts are recorded from the historical record and headlines (Reuters/CNN bodies unavailable); dates may shift one day across carriers.","The historical claim of 'five countries acting within two weeks' is not precisely verified and is not claimed."],"geography":{"basis":"The generation and consumption were global and not tied to an inspected event location, so event and affected-person countries remain unknown rather than inferred from regulators or the company's seats. Court countries are limited to the documented proceedings: the US (Baltimore D. Md. suit; the related US suits) and the NL (Amsterdam court order). Regulatory actions by Ofcom, the ICO, the EU, the DPC, Indonesia, Malaysia and the Philippines are not courts.","court_countries":["US","NL"],"event_countries":[],"affected_person_countries":[]},"publication":{"basis":"Restored under the 2026-09-15 charter as a harmful-artifact crisis (depicted_or_impersonated). Named victims are adults who spoke publicly; minors are never named and never counted from image statistics. Each scale figure is attributed to its own analysis; the victims' accounts are single-chain and recorded as reported. Related xAI suits (St. Clair, Tennessee minors, others) are separate held rows and are not merged.","reviewed_on":"2026-09-15"},"ai_involvement":{"basis":"NBC's own consenting test confirmed the standalone Grok app and X tab complied with 'undress' requests after the 9 January paywall change; the victims' accounts, the IWF and AI Forensics reviews, and xAI's own 14 January restriction all establish the AI generation. The scale figures are attributed analyses, not platform-confirmed numbers.","status":"supported"},"person_relations":["depicted_or_impersonated"]},"name":"Grok non-consensual sexual image generation wave (December 2025 - January 2026)","summary":"From late December 2025, xAI's Grok image editing on X let users generate sexualized images of real people at industrial scale, including images of named women and apparent minors. Analyses attributed to Genevieve Oh (7,751 sexualized images in one hour, via NBC), the New York Times (4.4 million images in nine days, at least 41% sexualized images of women, via the NC AG), the AP (2% of a 20,000-image sample appearing to be minors, via Fortune) and CCDH (about 3 million sexualized images over 11 days including roughly 23,000 of minors, via Engadget) documented the scale. Named women — Ashley St. Clair, Samantha Smith and Dr Daisy Dixon — described being undressed by Grok and revictimized when they objected. The wave triggered formal actions by Ofcom, the UK ICO, the EU (DSA), Ireland's DPC, 35 US state attorneys general, the California AG, Baltimore (consumer-protection suit), an Amsterdam court order, country blocks in Indonesia, Malaysia and the Philippines, and a Paris police raid; xAI restricted generation to paying subscribers on 9 January and narrowed the feature on 14 January 2026.","incidentDate":"2025-12-25","incidentEndDate":"2026-01-14","incidentKind":"bounded_series","incidentDatePrecision":"range","exposurePattern":"repeated_interactions","reportedDate":"2026-01-02","aiSystem":"Grok (image generation and editing on X and the standalone app)","aiProduct":"Grok","aiCompany":"SpaceXAI (formerly xAI)","severity":"critical","verificationStatus":"verified","harmCategories":["minor_exploitation","third_party_harm_facilitation","barrier_erosion"],"harmOutcomes":["psychological_distress","reputational_harm"],"harmOutcomeSummary":"Mass non-consensual sexualized imagery of real people — including apparent minors — generated at industrial scale and amplified when victims objected, with named women describing violation and dehumanization and regulators on three continents opening formal actions.","frameworkFacets":[],"causationStatus":"established","participantUsersAffectedMin":0,"otherPeopleHarmedMin":3,"affectedCountStatus":"partial","affectedCountEvidence":"Three counted depicted persons: Ashley St. Clair (Guardian), Samantha Smith (BBC) and Dr Daisy Dixon (BBC), each named and speaking publicly. Further victims — including the minors in the IWF's apparent criminal imagery (girls 11-13) and the people in the analysis samples — are unquantified: hourly image rates, the 20,000-image sample and the CCDH estimate count images, not people, and are never converted.","victimAgeRange":"minor","jurisdiction":"XX","platformType":"assistant","outcomeType":"regulatory_action","outcomeStatus":"ongoing","primarySourceUrl":"https://www.bbc.com/news/articles/c98p1r4e6m8o","primarySourceLabel":"BBC (2 Jan 2026) — Samantha Smith's account of being undressed by Grok and revictimized when she objected","firstPublishedAt":"2026-01-11T12:19:47.670189+00:00","updatedAt":"2026-09-30T01:17:03.797947+00:00","scopeVersion":"facts-v3","tags":["grok","xai","csam","deepfakes","minor","sexual-images","industrial-scale","multi-country","eu-dsa","class-action","35-state-ag","depicted-or-impersonated"]}]}