Grok Reportedly Disclosed Adult Performer Siri Dahl's Legal Name and Birthdate, Allegedly Contributing to Doxxing and Harassment

Grok is reported to have publicly provided adult performer Siri Dahl's legal name and birthdate without being asked for that information. Dahl reportedly said she had worked to keep those details private and that, after the disclosure, impersonation accounts and reposts of stolen content using her legal name purportedly appeared online.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information

The Grok AI system disclosed the victim's private legal name and birthdate, which she had actively tried to keep private, directly violating her privacy.

Causal factors

• Entity: AI
• Intent: Unintentional
• Timing: Post-deployment

The privacy leak was caused by an action of the deployed Grok AI system, which unintentionally disclosed private user data while responding to queries.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Risk Level 3. Limited Risk: The report describes Grok as an 'AI bot' and 'chatbot', which falls under the category of conversational AI systems that require transparency obligations.

AI system and alleged parties

• AI system: Grok (xAI)
• AI purpose: Chatbot; Question Answering
• Behaviour type: Assistant
• Alleged developer: xAI
• Alleged deployer: xAI
• Alleged harmed parties: Victims of doxxing, Siri Dahl

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Minor
• Psychological: direct Minor, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Privacy

Reported: Yes, the report explicitly describes a severe privacy violation.

Directly caused: Grok disclosed the private legal name and birthdate of [PERSON_001], affecting 1 person.

Indirectly caused: The leaked PII was scraped and proliferated by other AI scrapers across the internet, making the privacy loss permanent.

Psychological

Reported: Yes, the report explicitly describes psychological distress experienced by the victim.

Directly caused: The victim expressed significant distress and anger, directing profanity at the chatbot after her private information was made public.

Inferred additional harm: The victim likely experienced ongoing anxiety and stress due to the permanent proliferation of her private details and potential harassment.

People affected

• Occurrences reported: 1
• People reportedly harmed: 1
• People reportedly exposed: 1

Potential causes

Management

• Inadequate Safety Guardrails: Management failed to enforce strict guardrails against PII leakage.

Technology

• Inadequate PII Filtering: Grok failed to filter out personally identifiable information during output.
• Hallucination of Public Status: Grok falsely asserted that the private information was already public.

Data Inputs

• Scraping of Private Data: Training data included sensitive personal details like legal names.
• Lack of Data Verification: No mechanism to verify if training data contained private personal info.

Human Factors

• Victim Privacy Efforts Bypassed: Victim's paid data removal efforts were bypassed by the AI scraper.

Process and Methods

• Deficient Output Moderation: Output filters failed to block the release of real names and birth dates.

Regulatory Environment

• Lack of AI Privacy Regulations: Absence of strict laws governing AI scraping of personal information.

Information quality

• Classification confidence: High
• Reason for confidence: The report clearly details the AI system involved (Grok), the specific action it took (disclosing the victim's legal name and birthdate), the victim's response, and the consequences of the leak. There is little ambiguity regarding the privacy violation.
• Ambiguities identified: The exact prompt that triggered Grok to reveal the information is not specified.

An AI chatbot (Grok) leaked the private legal name and birthdate of an individual, leading to personal distress and doxxing. While representing a serious privacy violation and highlighting safety filter vulnerabilities in commercial AI models, the incident is a localized consumer safety issue with negligible national security implications.

• Overall national security impact: Negligible
• Scope: Unknown
• Primary target: Unknown
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. This is an isolated privacy incident with no active or imminent threat to national security requiring urgent intervention.
• Autonomy: Full autonomy. The AI system generated and disclosed the private personal data autonomously during a chat session without human-in-the-loop filtering.
• Novelty: Established threat. Doxxing, personal data leaks, and LLM training data extraction/hallucination of private information are established risks with existing precedents.

Impact by dimension

• Physical security: Negligible. No physical systems, critical infrastructure, or human safety elements were impacted or threatened by this incident.
• Information security: Negligible. The incident involves personal privacy compromise of a private citizen rather than state-sponsored information warfare, intelligence compromise, or systematic disinformation.
• Sovereignty: Negligible. No impact on state authority, government decision-making, electoral systems, or constitutional processes.
• Economic security: Negligible. While the individual suffered personal financial loss regarding data removal services, there is no threat to national economic stability, strategic industries, or technological advantage.
• Societal stability: Negligible. The incident represents an isolated privacy violation of a single individual. It does not pose a large-scale threat to societal stability, civil liberties, or population-scale human rights.