.avif){kind=small}
A deepfake ecosystem on Telegram utilized the DeepNude AI software to allow users to generate non-consensual nude imagery of women and minors from submitted photos. The service, which operated via bots, gamified the harassment by allowing users to trade and rate images. Despite the original DeepNude software being taken down by its creators, the technology was reverse-engineered and deployed in this automated, paid-access format, impacting over 100,000 victims.
Seven channels were connected in a Telegram ecosystem centered around letting subscribers, as a paid service, generate non-consensual deepfake nudes using a bot from submitted photos of women, including underage girls and women who they know in real life.
The incident involves the targeted creation of humiliating sexual imagery of specific victims (women they know in real life) for personal gratification and harassment, which fits the boundary rule for synthetic content targeting specific victims.
The harm was caused by human actors who intentionally reverse-engineered, deployed, and used the DeepNude AI software to generate non-consensual pornography.
Limited Risk: The system generates deepfakes, which are explicitly classified under the EU AI Act as posing a moderate risk requiring specific transparency obligations to ensure users are aware the content is AI-generated.
Severity ratings are based on this scale.
Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.
Reported: The report explicitly describes financial losses, noting that targeted influencers had deepfakes sent to sponsors, costing them immense financial strain. It also mentions users paying around $1.28 to $1.50 for premium features.
Directly caused: Users paid a base fee of 100 rubles (around $1.28 to $1.50) to remove watermarks or skip queues, generating revenue for the bot creators.
Indirectly caused: Influencers and YouTubers suffered financial losses due to lost sponsorships when deepfakes were sent to their sponsors.
Inferred additional harm: Victims may have suffered further financial losses due to potential extortion or blackmail, though these are not quantified in the report.
Reported: The report explicitly describes toxic and malicious content created and spread directly by the incident.
Directly caused: The AI system directly generated over 100,000 non-consensual nude images of women and girls.
Indirectly caused: These generated images were shared, traded, and rated across Telegram channels with over 100,000 combined members.
Inferred additional harm: It is likely that many of these images were further disseminated to other pornographic websites and social media platforms, exposing millions of users to toxic content.
Reported: The report explicitly describes differential treatment, as the deepfake bot was specifically designed and used to target and strip women and girls.
Directly caused: The AI software was designed to exclusively generate nude images of women, systematically targeting them for sexual objectification.
Inferred additional harm: This technology disproportionately subjects women and girls to online harassment, reinforcing gender-based hostility and unequal safety in digital spaces.
Reported: The report explicitly describes violations of human and civil rights, specifically the right to personal security, reputation, and bodily autonomy.
Directly caused: The non-consensual sexualization of over 100,000 women and girls directly violated their fundamental rights to dignity, privacy, and personal security.
Inferred additional harm: The widespread availability of such tools creates a chilling effect, violating women's civil rights to freely participate in online spaces without fear of targeted sexual harassment.
Reported: The report explicitly describes privacy violations, noting that the bot was used to strip private individuals using photos taken from their social media.
Directly caused: The AI system generated synthetic private (nude) representations of individuals without their consent.
Indirectly caused: Malicious users harvested public social media photos of private individuals to generate and share non-consensual pornographic images.
Inferred additional harm: Widespread violation of personal privacy and informational self-determination for over 100,000 victims whose likenesses were weaponized.
Reported: The report explicitly describes psychological harm, noting that targeted individuals, including influencers, experienced immense emotional strain due to these deepfakes.
Indirectly caused: The creation and sharing of non-consensual nude images caused immense emotional strain and distress to targeted individuals.
Inferred additional harm: It is highly likely that a significant portion of the 100,000+ targeted women suffered severe anxiety, trauma, and feelings of violation upon discovering these deepfakes.
Reported: The report explicitly describes epistemic harm, noting that while some images are obviously fake, others can easily be mistaken for real pictures.
Directly caused: The AI generated highly realistic fake nude photographs of real individuals, creating false visual evidence.
Inferred additional harm: The proliferation of realistic deepfakes erodes public trust in photographic evidence and the shared reality of personal imagery.
Reported: The report explicitly describes a CSEA incident, noting that a limited number of the bot-generated images featured targets who appeared to be underage.
Directly caused: The AI system directly generated fake nude images of underage girls.
Indirectly caused: These simulated CSAM images were shared and traded within public Telegram channels.
Inferred additional harm: It is highly likely that more underage girls were targeted than the limited number identified, leading to the creation and spread of simulated CSAM.
The deployment of automated Telegram bots utilizing reverse-engineered DeepNude software to generate non-consensual pornography affected over 100,000 women and minors. While representing a massive violation of privacy and human rights, the national security impact remains minor as it lacks state-actor involvement, kinetic threats, or critical infrastructure disruption.