Woman in Kyrgyzstan Alleged a Former Classmate Used an AI Bot to Create a Nude Image From Her Instagram Photo

A 23-year-old woman in Kyrgyzstan said a former classmate used a Telegram AI bot to create a nude image from her Instagram photo without consent; it reached his contacts. She reported reputational and psychological harm. He acknowledged bot use but attributed circulation to a hack of his Telegram account. Creation timing and responsibility for sharing remain disputed.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The incident involves the creation of humiliating sexual imagery targeting a specific victim to damage her reputation, which fits under targeted manipulation and abuse.

Additional risk subdomains

• 1.2 Exposure to toxic content: The generated nude deepfake was distributed to multiple contacts, exposing them to non-consensual sexual content.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The harm was caused by a human decision to use an AI tool to generate a non-consensual sexualized image of a classmate, which was then distributed.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The system is an AI-generated content tool used to create deepfakes, which carries specific transparency obligations under the EU AI Act.

AI system and alleged parties

• AI system: None named
• AI purpose: Deepfake Image Generation; Image Retouching
• Behaviour type: Tool
• Alleged developer: Synthetic media generation technology developers, Synthetic image generation technology developers, Deepfake technology developers
• Alleged deployer: Synthetic media creators, Deepfake creators, Chynybek Aaliev
• Alleged harmed parties: Women and girls, Women, Victims of non-consensual deepfakes, Privacy, Epistemic integrity, Aima Yunusbaeva

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Minor, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Malicious content

Reported: Yes, a sexualized deepfake image was created and distributed.

Directly caused: An AI-generated nude photo of the victim was created using a Telegram bot and sent to at least 7 contacts.

Privacy

Reported: Yes, her public Instagram photo was used without consent to generate a nude image.

Directly caused: The perpetrator downloaded the victim's photo from her Instagram page without her consent to generate a nude deepfake.

Psychological

Reported: The report explicitly describes severe psychological stress and anxiety experienced by the victim.

Directly caused: Aima Yunusbaeva experienced severe psychological stress, anxiety, and distress after learning her classmate generated and distributed a nude deepfake of her.

People affected

• Occurrences reported: 1
• People reportedly harmed: 1
• People reportedly exposed: 8

Potential causes

Technology

• AI Nudification Bots: Telegram bots easily generate realistic non-consensual deepfake porn.
• Realistic Image Generation: Deepfake was highly realistic, making it difficult to prove it was fake.

Data Inputs

• Public Social Media Photos: The source photo was easily downloaded from a public Instagram account.

Human Factors

• Intentional Misuse of AI: User deliberately used AI to strip classmate's photo for amusement.
• Phishing Vulnerability: User entered account confirmation code into a malicious Telegram bot.

Process and Methods

• Flawed Technical Investigation: Investigators lacked AI literacy, confusing ChatGPT with Telegram bots.
• Delayed Forensic Analysis: Police failed to conduct timely technical audit of devices and accounts.

Regulatory Environment

• Weak Deepfake Regulations: Ambiguous laws fail to deter and properly penalize deepfake creation.
• Lack of Platform Control: Telegram fails to proactively ban automated AI nudification bots.

Information quality

• Classification confidence: High
• Reason for confidence: The report provides detailed first-hand accounts from both the victim and the accused, along with statements from the police and legal counsel. While there is a dispute over whether the distribution was due to a hack or intentional action, the core facts of the AI's use to generate the deepfake and the resulting harm are clear.
• Ambiguities identified: There is a conflict between the victim's claim that the perpetrator intentionally sent the images and the perpetrator's claim that his account was hacked and the images were sent automatically.
• Alternative interpretations: The distribution of the image could have been a malicious hack targeting the perpetrator rather than a direct intentional act of distribution by him, though he admits to generating the image.

An individual in Kyrgyzstan used a public AI Telegram bot to create and distribute a non-consensual sexualized deepfake of a classmate. While causing severe personal and psychological harm to the victim, the incident remains a localized criminal and harassment issue with negligible direct implications for national security.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: Kyrgyzstan
• Alleged perpetrator: Chynybek Aziizovich Aaliev

Threat characteristics

• Imminence: Long-term. The incident is a localized, completed event with no imminent threat of national security escalation.
• Autonomy: Human-controlled. The AI system acted as a tool directly controlled by a human user who uploaded the image and initiated the generation process.
• Novelty: Established threat. The use of AI-powered deepfake bots to generate non-consensual sexualized imagery of individuals is a well-established and persistent threat.

Impact by dimension

• Physical security: Negligible. No physical systems, critical infrastructure, or human safety threats were involved in this localized digital harassment incident.
• Information security: Negligible. The incident involves personal harassment using deepfakes, rather than state-sponsored information warfare, intelligence compromise, or mass surveillance.
• Sovereignty: Negligible. No threat to state authority or core government operations, though local police response was reportedly influenced by domestic nepotism.
• Economic security: Negligible. No impact on national economic stability, strategic industries, or technological competitive advantage.
• Societal stability: Minor. The incident represents a severe violation of individual privacy and human rights through non-consensual deepfake pornography, but remains a localized case with limited scale.