FBI Reported Surge of Extortion Cases of AI Media Featuring Sexual Explicit Activities

The FBI reported an increase in sextortion cases featuring the use of fake, including AI-generated, images or videos created from content posted on their social media sites or web postings, provided to the malicious actor upon request, or captured during video chats.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The incident involves malicious actors using AI deepfake technology to target specific individuals for blackmail, extortion, and targeted harassment to obtain financial payment or illicit content.

Additional risk subdomains

• 1.2 Exposure to toxic content: The AI-generated sexually explicit deepfakes are circulated on public forums, social media, and pornographic websites, exposing victims and online users to highly toxic and non-consensual sexual content.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The sextortion schemes and harassment are driven by the intentional decisions and actions of malicious human actors utilizing deployed AI deepfake generation tools.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Risk Level 3. Limited Risk: The report describes AI-generated content such as deepfakes, which are explicitly classified under Limited Risk due to transparency obligations to ensure users are aware of the AI's synthetic nature.

AI system and alleged parties

• AI system: unspecified
• AI purpose: Deepfake Video Generation; Deepfake Image Generation
• Behaviour type: Tool
• Alleged developer: Unknown deepfake technology developers
• Alleged deployer: Unknown scammers, Sextortionists, Blackmailers
• Alleged harmed parties: Unnamed victims in sextortion schemes, Teenagers targeted in sextortion scams

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Negligible. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Minor
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Minor
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Minor
• Psychological: direct Negligible, indirect Minor
• Epistemic: direct Negligible, indirect Minor
• Child sexual exploitation and abuse: direct Negligible, indirect Substantial

Malicious content

Reported: Yes, the report explicitly describes the creation and circulation of sexually explicit deepfake videos and images.

Indirectly caused: Malicious actors use AI tools to generate sexually explicit deepfakes of victims and circulate them on social media, public forums, and pornographic websites.

Inferred additional harm: It is likely that thousands of explicit deepfake images and videos have been generated and distributed across various online platforms, exposing a wide audience to non-consensual toxic content.

Civil rights

Reported: Yes, the report describes violations of victims' rights to privacy, personal dignity, and freedom from harassment and extortion.

Indirectly caused: The non-consensual creation and public distribution of sexually explicit images depicting real individuals violates their fundamental rights to personal dignity and privacy.

Inferred additional harm: Widespread deployment of these tools likely results in systemic violations of the civil rights and privacy of thousands of individuals, particularly women and minors who are disproportionately targeted.

Privacy

Reported: Yes, the report explicitly describes how victims' personal photos are harvested without consent to create explicit deepfakes.

Indirectly caused: Malicious actors compromise victims' privacy by copying their benign social media photos and using them to generate non-consensual sexually explicit content.

Inferred additional harm: Thousands of individuals likely have had their personal images harvested and manipulated without their knowledge or consent, representing a massive scale of privacy violations.

Psychological

Reported: Yes, the report explicitly mentions that victims are vulnerable to embarrassment, harassment, and long-term re-victimization.

Indirectly caused: The creation and circulation of non-consensual sexually explicit deepfakes, combined with extortion demands, causes severe distress, embarrassment, and harassment to an unspecified number of victims, including minors.

Inferred additional harm: It is highly likely that hundreds or thousands of victims suffer severe psychological trauma, anxiety, and depression due to the ongoing threat of public exposure and the difficulty of removing explicit content from the internet.

Epistemic

Reported: Yes, the report describes the creation of highly realistic fake videos and images that appear true-to-life in likeness to the victims.

Indirectly caused: The generation of realistic deepfakes creates false visual evidence of individuals participating in sexually explicit acts, misleading anyone who views the content.

Inferred additional harm: The proliferation of realistic deepfakes erodes public trust in visual media and makes it difficult for individuals to prove the falsity of fabricated compromising material.

Child sexual exploitation and abuse

Reported: Yes, the report explicitly states that minor children are among the victims whose photos are altered into explicit content for sextortion.

Indirectly caused: Malicious actors use AI to alter photos of minor children into sexually explicit content, which is then used to extort them or is circulated on pornographic websites.

Inferred additional harm: Given the uptick in reports, it is highly likely that numerous minors have been subjected to AI-facilitated sexual exploitation and abuse, though exact numbers are not disclosed in the public warning.

People affected

• Occurrences reported: 1
• People reportedly harmed: 100
• People reportedly exposed: 1000

Potential causes

Management

• Lack of Proactive Protections: Platform management fails to restrict public access to user photos.
• Inadequate User Education: Platforms do not adequately warn users about deepfake exploitation risks.
• Lack of Privacy by Default: Default platform settings leave user profiles and friend lists public.

Technology

• Advanced Deepfake Software: AI tools create realistic videos using only a single image of a face.
• Easily Bypassed Guardrails: Built-in safety checks to prevent abuse are easy to skirt in practice.
• Underground Market Tools: Unregulated deepfake services are available in underground markets.

Data Inputs

• Public Social Media Photos: Scammers harvest benign photos posted on public social media accounts.
• Captured Video Chat Media: Malicious actors record and capture images during video conversations.
• Unrestricted Web Postings: Personal images are easily copied from open web postings and search.

Human Factors

• Oversharing Personal Media: Users post personal photos and videos online without realizing the risks.
• Accepting Unknown Requests: Users accept friend requests and communicate with unfamiliar individuals.
• Weak Account Security: Lack of complex passwords and MFA allows accounts to be easily hacked.

Process and Methods

• Difficult Content Removal: Victims face major challenges in removing circulated content from the web.
• Inadequate Content Filtering: Platforms struggle to detect and block AI-generated explicit content.
• Unmonitored Image Sharing: Direct messaging and public forums allow easy sharing of fake media.

Regulatory Environment

• Difficult Statute Enforcement: Enforcing federal criminal statutes is hard across digital platforms.
• Inadequate Cyber Laws: Existing legal frameworks struggle to keep pace with rapid AI progress.
• Lack of Platform Liability: Regulations do not hold platforms liable for hosting deepfake content.

Information quality

• Classification confidence: High
• Reason for confidence: The FBI warnings provide clear, authoritative, and consistent information regarding the mechanics of the sextortion schemes, the role of AI deepfake technology, and the nature of the harms caused to victims. While specific statistics on the exact number of victims or financial losses are absent, the overall risk profile and taxonomic classifications are highly clear and unambiguous.
• Ambiguities identified: The reports do not specify the exact software packages or AI models used, nor do they provide precise statistical data on the number of victims or total financial losses.
• Alternative interpretations: None. The reports clearly describe a malicious human-driven extortion scheme leveraging AI tools.

The FBI issued a public warning regarding scammers using AI deepfake tools to generate realistic sexually explicit videos from single benign photos for sextortion. This evolved threat primarily impacts societal stability and individual privacy, particularly targeting minors and non-consenting adults, requiring active intervention from federal law enforcement.

• Overall national security impact: Substantial
• Scope: Single nation
• Primary target: United States
• Other affected: Unknown
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Near-term. The threat is actively developing with an observed uptick in reports, requiring ongoing monitoring and public safety alerts.
• Autonomy: Human-controlled. The AI deepfake tools are directly operated by human scammers who select targets, generate the media, and execute the extortion.
• Novelty: Evolved capability. Sextortion is an established crime, but the integration of AI to generate highly realistic explicit videos from a single photo represents a significant evolution.

Impact by dimension

• Physical security: Negligible. The incident involves digital extortion and synthetic media creation, posing no threats to physical infrastructure, kinetic systems, or physical safety.
• Information security: Negligible. No compromise of intelligence capabilities, classified models, or state-sponsored disinformation campaigns targeting national institutions is reported.
• Sovereignty: Negligible. The activity does not target government decision-making, electoral systems, or state sovereignty.
• Economic security: Minor. Victims face financial losses from ransom demands, but the economic impact is localized to individuals and does not threaten strategic industries or financial systems.
• Societal stability: Substantial. The widespread use of deepfakes for sextortion of minors and adults represents a notable threat to privacy and human rights, warranting national warnings from the FBI.