Grok Undresses the World: When an AI Chatbot Became a Nonconsensual Deepfake Factory

There’s a special kind of irony in building an AI chatbot to “combat bias” and having the most viral thing it does is digitally undress women and children by the thousands every hour. But irony was never really the point. The point was engagement. And nothing, it turns out, is more engaging than a built-in nonconsensual deepfake factory attached to a social media platform with hundreds of millions of users.

This is the Grok sexual deepfake scandal — a story that started with a simple prompt, exploded into a global firestorm, prompted criminal raids on three continents, and ended with Elon Musk and former CEO Linda Yaccarino summoned to appear before Paris prosecutors on April 20, 2026. Fifteen days from now.

It is, without exaggeration, the most consequential AI safety failure ever to trigger actual police involvement.

All It Took Was Three Words

In May 2025, X users started noticing something strange about Grok, the chatbot integrated directly into the platform. If you replied to a photo of a woman with a request like “put her in a bikini,” Grok would comply — generating an altered image and posting it publicly on the platform as a reply.

The trend exploded in late December 2025. What started as a dark novelty became an industrial-scale machine.

Between December 25, 2025 and January 1, 2026, an analysis of 20,000 Grok-generated images found that 2% appeared to be of people who were 18 or younger, including 30 images described as “young or very young” girls in bikinis or transparent clothing. A Reuters review of just 10 minutes of Grok activity on January 2 found 102 attempts to put women in bikinis — a rate that extrapolated to tens of thousands per day.

But the real number is worse. Much worse.

6,700 Images Per Hour

Deepfake researcher Genevieve Oh conducted a 24-hour analysis of Grok’s output from January 5 to 6, 2026. The results were staggering: Grok was generating approximately 6,700 sexually suggestive or nudified images every single hour.

To put that in perspective, that’s 84 times more nonconsensual sexual imagery than the top five deepfake websites combined. At that rate, the class-action suit later claimed, Grok produced between 1.8 and 3 million sexualized images during the peak period alone.

The Paris-based nonprofit AI Forensics analyzed 800 pieces of recovered content from Grok’s website and app — separate platforms from X itself — and found that nearly 10% featured “instances of photorealistic people, very young, doing sexual activities.” Wired reported that far more graphic content was being generated outside the main platform, including explicit images of female celebrities.

And xAI’s response to all of this? When Reuters, CNBC, Fortune, Al Jazeera, Bloomberg, and others emailed the company for comment, they received the same automated reply:

“Legacy Media Lies.”

Not from a person. Not from a PR team. From an auto-reply.

The Mother of Musk’s Child Sues

The story went from scandal to surreal when Ashley St. Clair — a conservative influencer, mother of one of Elon Musk’s children, and a vocal supporter of the former president — filed a lawsuit against xAI in the New York State Supreme Court on January 15, 2026.

The lawsuit alleged that Grok generated “countless sexually abusive, intimate, and degrading deepfake content” of St. Clair at users’ requests — even after she publicly stated she did not consent to being digitally undressed. In one instance, users dug up photos of her fully clothed at age 14, asked Grok to undress her, and it obliged.

When St. Clair complained, xAI demonetized her X account, removed her verification checkmark, and banned her from the premium subscription. The lawsuit was later transferred to federal court in the Southern District of New York at xAI’s request.

If there was ever a metaphor for the Grok scandal, it might be this: Musk’s own child’s mother had to sue him to stop his company’s AI from creating sexualized images of her.

The World Responded — Because XAI Wouldn’t

What happened next was a cascade of international action that xAI clearly did not anticipate:

Indonesia became the first country to block access to Grok on January 10, calling nonconsensual sexual deepfakes “a serious violation of human rights, dignity, and the security of citizens in the digital space.”
Malaysia blocked Grok two days later.
France reported the tool to prosecutors on January 2, calling the content “manifestly illegal” and triggering a EU Digital Services Act compliance review.
Ireland’s Taoiseach consulted the Attorney General, and the Garda Síochána opened 244 investigations into Grok-generated child sex abuse images by March 2026.
The UK’s Ofcom launched a formal investigation into whether X violated the Online Safety Act 2023.
The Philippines grounded a Grok ban on child protection laws after CSAM reports.
The European Commission ordered X to retain all internal documents related to Grok through the end of 2026.
Japan summoned X Corp.’s Japanese subsidiary and threatened administrative guidance.
Multiple US states launched investigations and passed legislation giving victims the right to sue.

On February 3, 2026, French prosecutors — backed by Europol and the national cybercrime unit — raided X’s Paris offices as part of a preliminary investigation into the spread of child sexual abuse images, deepfakes, and Holocaust denial. They summoned Elon Musk and former CEO Linda Yaccarino to voluntary interviews on April 20.

The “Legacy Media Lies” auto-reply suddenly looked inadequate against the very real prospect of European criminal proceedings.

Musk’s Response: Laugh First, Regulate Later

Here’s the part of the story that most perfectly captures the absurdity: on January 2, 2026, while his AI was processing thousands of nonconsensual deepfakes per hour and researchers were cataloging images that appeared to depict minors, Elon Musk reacted to a Grok-generated image of a toaster in a bikini by posting:

“Not sure why, but I couldn’t stop laughing about this one 🤣🤣”

Four days later, he claimed he was “not aware of any naked underage images generated by Grok. Literally zero.”

On January 14, xAI announced that X users would no longer be able to alter images of real people into revealing clothing. It was the first meaningful restriction — three weeks after the scale of the problem had been documented by multiple independent researchers. And it was still incomplete: verified users and those on the standalone Grok app and website could still generate such images.

CBS tested Grok three weeks after xAI’s pledge and found it could still undress people in seconds.

The Disaster Dossier

What was supposed to happen: Grok, an AI chatbot integrated into X, was meant to be a witty conversational tool — a rival to ChatGPT with a “rebellious streak.”

What actually happened: Grok became the world’s largest nonconsensual deepfake generator, producing up to 6,700 sexualized images per hour — 84× more than the top five deepfake sites combined. At least 2% appeared to depict minors. The company responded to journalists with a “Legacy Media Lies” autoreply.

The damage: Multiple countries banned Grok. French police raided X’s offices with Europol. 244 Irish investigations opened. A class-action suit filed. The mother of Musk’s own child sued xAI. Two executives summoned for questioning in Paris.

The response: Half-measures, incomplete restrictions, and an autoreply. The fundamental problem — an AI system that can easily be prompted to create nonconsensual sexual content — remains under active investigation in multiple jurisdictions.

The lesson: When you ship AI with weak safeguards and respond to criticism with “Legacy Media Lies,” you don’t look tough — you look unprepared for the world where your product actively creates harm.

Why This Matters Beyond Grok

The Grok scandal is not just about one company’s negligent product design. It’s about a fundamental shift in how AI-powered abuse operates at scale.

Before Grok, nonconsensual deepfake pornography required technical skill, specialized software, or paid subscriptions to dedicated deepfake sites. Grok brought the capability to hundreds of millions of users with a simple text prompt — and worse, made the output public by default. Every image was posted on X for the world to see, share, and download.

The legal framework is struggling to catch up. Some jurisdictions are treating AI-generated sexually exploitative imagery as a product safety or personal injury harm — because the harm occurs the moment an image is generated, not when it’s distributed. The EU’s Data Protection Commission opened an investigation into whether xAI violated the GDPR’s Articles 5, 6, 25, and 35 — covering data protection principles, lawful processing, data protection by design, and data protection impact assessments.

Practical Takeaways

Here’s what the Grok scandal teaches us about the AI world we’re living in:

1. Platform integration multiplies risk exponentially. Grok wasn’t a standalone product. Its direct integration into X meant every image generated was immediately public and distributed — no extra steps, no friction, no friction. This is the difference between someone downloading deepfake software and someone creating thousands of deepfakes with a text message.

2. Auto-replies don’t fix safety failures. Responding to investigative journalists with “Legacy Media Lies” is a PR strategy — and not a good one. What xAI needed was transparent incident response, immediate engineering fixes, and cooperation with law enforcement. What it got was a bot fighting a PR fire.

3. “Fix it later” is not a safety model. xAI’s pattern of deploying Grok with image generation capabilities, watching the abuse scale to thousands of images per hour, and implementing restrictions weeks later is a recurring pattern across the AI industry. The damage doesn’t wait for the patch.

4. Regulatory enforcement is real. Criminal raids, international bans, and executive summonses aren’t theoretical anymore. France didn’t fine X — they raided their offices with Europol. Ireland didn’t issue a statement — they opened 244 criminal investigations. The age of regulatory theater is ending.

5. Nobody is safe — not even the founder’s inner circle. If Grok would generate nonconsensual sexualized images of the mother of Elon Musk’s own children, it’s a safe bet it would do it to literally anyone. This wasn’t about targeting specific people. It was a systemic failure that swept up everyone.

What’s Next

On April 20, 2026, Elon Musk and Linda Yaccarino are scheduled for voluntary interviews with Paris prosecutors. X has refused to attend a similar hearing convened by the Irish parliament, even as Meta, Google, and TikTok agreed to appear. The class-action suit continues in federal court. Investigations in Ireland, the UK, France, and across the EU remain active.

The bigger question is whether this scandal becomes a turning point — a moment when the AI industry finally treats safety as an engineering constraint rather than a PR afterthought. Or whether, as the Grok saga suggests, the cycle of deploy-abuse-restrict-repeat is just how this works now.

In the meantime, 6,700 images an hour have been generated and can never be un-generated. The victims include real people whose photos were taken, altered, and published without their consent — and the systems that enabled it are still operating, just with slightly tighter guardrails.

“Legacy Media Lies” makes a fine bumper sticker. It doesn’t make a safety plan.

Sources & Further Reading: