Secret Desires AI Platform Reportedly Exposed Nearly Two Million Sensitive Images in Cloud Storage Leak

The erotic AI chatbot and image-generation platform Secret Desires reportedly left nearly two million sensitive images and videos publicly exposed in misconfigured cloud storage. The leaked files reportedly included personal photos, workplace and university information, and explicit AI-generated deepfakes of women and girls. The content reportedly became inaccessible shortly after journalists contacted the platform.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information

The incident involved a massive leak of non-public sensitive information, including PII (names, schools, workplaces) and private explicit media, directly compromising user privacy.

Additional risk subdomains

• 1.2 Exposure to toxic content: The leak exposed explicit adult content and potentially illegal material, including potential child sexual abuse material indicated by filenames referencing minors.
• 4.3 Fraud, scams, and targeted manipulation: The platform enabled the creation of nonconsensual explicit deepfakes using face-swap features on scraped images of public and private individuals.

Causal factors

• Entity: Human
• Intent: Unintentional
• Timing: Post-deployment

The data exposure was caused by a human error in configuring cloud storage, which was an unintentional security oversight occurring after the AI service was deployed.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The system is described as a 'chatbot' and an 'AI image generator' that creates 'deepfakes', which fall under transparency obligations for generative AI under the EU AI Act.

AI system and alleged parties

• AI system: Secret Desires
• AI purpose: Chatbot; Deepfake Image Generation
• Behaviour type: Tool
• Alleged developer: Secret Desires
• Alleged deployer: Secret Desires
• Alleged harmed parties: Women, People depicted in Secret Desires deepfakes, General public, Epistemic integrity

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Severe. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Substantial, indirect Negligible
• Differential treatment: direct Negligible, indirect Substantial
• Civil rights: direct Severe, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Severe, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Substantial

Malicious content

Reported: The report explicitly describes the creation and exposure of explicit deepfakes and potential child sexual abuse material.

Directly caused: The platform's face-swap feature directly generated explicit deepfakes of public and private individuals, and nearly two million of these files were exposed.

Inferred additional harm: The exposed explicit content could be further circulated on other platforms, leading to wider dissemination of nonconsensual pornography.

Differential treatment

Reported: The report explicitly notes that the vast majority of deepfake targets are women, indicating a gender-based dimension to the harm.

Indirectly caused: The proliferation of nonconsensual deepfakes disproportionately targets and harms women and girls, reinforcing gender-based harassment.

Civil rights

Reported: The report explicitly describes violations of privacy rights and risks to child safety.

Directly caused: The exposure of personal data and intimate images violated the fundamental right to privacy for up to two million users.

Inferred additional harm: The potential exposure of minors' images violates children's rights to protection from sexual exploitation and abuse.

Privacy

Reported: The report explicitly describes a massive privacy violation involving the exposure of personal data and intimate images.

Directly caused: Nearly two million explicit images and videos, along with PII such as names, schools, and workplaces, were left publicly accessible due to misconfigured cloud storage.

Inferred additional harm: The exposed PII and intimate media could be exploited by malicious actors for targeted doxing, identity theft, or blackmail.

Child sexual exploitation and abuse

Reported: The report explicitly describes the presence of files with names suggesting they contained images of underage victims.

Indirectly caused: The platform's features allowed the generation of explicit content that potentially depicted minors, which was then exposed in the leak.

Inferred additional harm: It is highly likely that some of the exposed files constituted child sexual abuse material (CSAM), posing severe ongoing risks to the affected minors.

People affected

• Occurrences reported: 1
• People reportedly harmed: 2000000
• People reportedly exposed: 2000000

Potential causes

Management

• Prioritizing Growth Over Safety: Security was not built in early, focusing instead on rapid user acquisition.
• Immature Startup Governance: Quickly growing startup lacked mature risk assessment and security posture.
• Lack of Response and Transparency: The company failed to respond to press requests regarding the exposure.

Technology

• Exposed Cloud Storage Buckets: Publicly accessible cloud containers left sensitive files open to the internet.
• Defunct Faceswap Vulnerabilities: Retained explicit media generated by a now-defunct face-swapping tool.
• Lack of Built-in Security Controls: Absence of private-by-default buckets, encryption, or access controls.

Data Inputs

• Scraped Social Media Images: Images were mined from public social networks and yearbook photos.
• Exposed Personally Identifiable Data: Usernames, workplaces, and universities were stored alongside explicit media.
• Illegal Underage Filenames: Some exposed files used terms indicating potential underage content.

Human Factors

• User Demand for Limitless Intimacy: High demand for NSFW AI content drove rapid adoption with low safety awareness.
• Targeting of Vulnerable Individuals: Nonconsensual deepfakes disproportionately targeted women and public figures.
• Low User Technical Barriers: Simplified AI tools allowed users with no experience to generate deepfakes.

Process and Methods

• Poor Cloud Configuration Management: Mundane and widespread failure to secure cloud storage containers.
• Inadequate Active Monitoring: Failure to actively monitor and filter synthetic sexual imagery of minors.
• Absence of Provenance Standards: Lack of systemwide watermarking and traceability standards like C2PA.

Regulatory Environment

• Trailing Compliance and Liability Laws: Legal frameworks and deepfake legislation are lagging behind AI advancements.
• Controversial Legal Measures: Laws like the Take It Down Act face free speech enforcement challenges.

Information quality

• Classification confidence: High
• Reason for confidence: The reports from 404 Media and Mashable provide consistent, detailed accounts of the data exposure, the nature of the exposed files, and the specific platform involved (Secret Desires). The technical cause (misconfigured cloud storage) and the scale of the leak (nearly two million files) are clearly documented.
• Ambiguities identified: The exact number of unique individuals affected is not specified, only the number of files (nearly two million) and that there are 'potentially millions of logged-in users'.

A massive data breach of the AI platform Secret Desires exposed nearly two million sensitive files, including explicit deepfakes and PII of influencers and everyday users. While representing a severe privacy violation and potential child safety risks, the national security impact is minor, primarily posing long-term blackmail and harassment risks manageable under standard cybercrime procedures.

• Overall national security impact: Minor
• Scope: Multiple nations
• Primary target: No clear primary
• Other affected: Unknown
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. The immediate security exposure was resolved, but the long-term risks of leaked data exploitation remain a strategic privacy and security concern.
• Autonomy: Human-controlled. The AI platform acts as a tool, generating content and executing face-swaps based on direct human prompts and inputs.
• Novelty: Evolved capability. Represents an evolved threat where AI-generated nonconsensual intimate media is aggregated and exposed at scale due to standard cloud misconfigurations.

Impact by dimension

• Physical security: Negligible. No physical infrastructure, kinetic targeting systems, or critical utilities were affected by this digital data exposure.
• Information security: Minor. Exposed personal details and explicit deepfakes of public figures and influencers could be exploited for targeted blackmail, though no active state-sponsored info operations are indicated.
• Sovereignty: Negligible. No disruption to state authority, electoral processes, or core government operations was reported.
• Economic security: Negligible. The incident involves a commercial startup's database leak, with no strategic technology theft or threat to national economic stability.
• Societal stability: Minor. Massive privacy violation exposing intimate media and personal details of up to two million users, posing severe risks of harassment and blackmail, manageable under standard cybercrime laws.