Teenager Makes Deepfake Pornography of 50 Girls at Bacchus Marsh Grammar School in Australia

A teenage male was arrested following the creation and distribution of AI-generated non-consensual sexually explicit images of approximately 50 female students at Bacchus Marsh Grammar in Australia. The images were created by scraping photos from social media and processing them through AI 'nudifying' applications. The incident caused widespread trauma among the student body and has prompted investigations by Victoria Police and calls for increased cyber safety education and platform regulation.

At Bacchus Marsh Grammar, a school in Victoria state in Australia, an adolescent male made deepfake pornography of 50 girls, ages 9 to 12. He then allegedly uploaded the pictures to Instagram, and others subsequently shared them on Snapchat.

Source: AI Incident Database

Risk classification

  • Primary risk domain: 4 Malicious actors
  • Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The perpetrator used AI to generate humiliating and sexually explicit deepfake imagery targeting specific female classmates for personal harassment and degradation.

Additional risk subdomains

  • 1.2 Exposure to toxic content: The incident involved the creation and social media distribution of highly graphic, non-consensual sexually explicit content depicting minors.

Causal factors

  • Entity: Human
  • Intent: Intentional
  • Timing: Post-deployment

The incident was caused by a human decision to deliberately scrape photos and use an AI app to generate and distribute non-consensual explicit images.

EU AI Act risk tier

  • Risk tier: 3 Limited Risk

Limited Risk: The system is an AI-generated content generator used to create deepfakes, which falls under transparency obligations for synthetic media under the EU AI Act.

AI system and alleged parties

  • AI system: AI nudifying app
  • AI purpose: Deepfake Image Generation; Image Generation
  • Behaviour type: Tool
  • Alleged developer: Unknown deepfake technology developers
  • Alleged deployer: Unnamed adolescent male, Snapchat users, Instagram users
  • Alleged harmed parties: Bacchus Marsh Grammar students, Bacchus Marsh Grammar girls

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

  • Physical: direct Negligible, indirect Negligible
  • Infrastructure: direct Negligible, indirect Negligible
  • Property: direct Negligible, indirect Negligible
  • Financial: direct Negligible, indirect Negligible
  • Environmental: direct Negligible, indirect Negligible
  • Malicious content: direct Minor, indirect Minor
  • Differential treatment: direct Negligible, indirect Minor
  • Civil rights: direct Negligible, indirect Minor
  • Democracy: direct Negligible, indirect Negligible
  • Privacy: direct Negligible, indirect Minor
  • Psychological: direct Negligible, indirect Minor
  • Epistemic: direct Minor, indirect Minor
  • Child sexual exploitation and abuse: direct Substantial, indirect Substantial

Malicious content

Reported: The report explicitly describes the creation and distribution of highly graphic, toxic, and sexually explicit synthetic content.

Directly caused: The AI application directly generated highly graphic, non-consensual nude composite images of 50 underage girls.

Indirectly caused: The generated explicit images were shared and circulated across social media platforms, including Instagram and Snapchat.

Differential treatment

Reported: The reports explicitly describe this incident as a gendered cultural issue targeting young women and girls.

Indirectly caused: Female students were systematically targeted, sexualized, and harassed, reflecting and reinforcing misogynistic societal dynamics.

Civil rights

Reported: The reports discuss the violation of the girls' rights to safety, respect, and bodily autonomy.

Indirectly caused: The non-consensual creation and distribution of sexually explicit deepfakes violated the personal dignity, privacy, and civil rights of the 50 targeted girls.

Privacy

Reported: The reports describe the unauthorized scraping of personal photos from social media accounts.

Indirectly caused: The perpetrator violated the privacy of approximately 50 girls by scraping their personal photos from social media (including private accounts) to use as inputs for the AI app.

Psychological

Reported: The reports explicitly describe severe psychological distress, trauma, and anxiety among the targeted students and their peers.

Indirectly caused: Approximately 50 female students experienced severe trauma, anxiety, and distress after discovering that their likenesses had been used to create explicit fake nudes.

Inferred additional harm: It is highly likely that the wider school community, including parents and friends, suffered ongoing anxiety and psychological distress regarding online safety and privacy.

Epistemic

Reported: The reports describe the creation of highly realistic synthetic images that falsely depict individuals in explicit scenarios.

Directly caused: The AI system generated highly realistic, convincing fake nude images of the victims.

Indirectly caused: The distribution of these deepfakes created false representations of the girls, causing confusion and distress among peers who saw them.

Child sexual exploitation and abuse

Reported: The reports explicitly note that the faked explicit images of minors are designated as child sexual abuse material (CSAM).

Directly caused: The AI application was used to generate sexually explicit images of underage girls, which legally constitutes CSAM.

Indirectly caused: The generated CSAM depicting approximately 50 underage girls was distributed and shared on social media platforms.

People affected

  • Occurrences reported: 1
  • People reportedly harmed: 51
  • People reportedly exposed: 50

Potential causes

Management

  • Schrodingers Business Model: Tech platforms prioritize growth and engagement over user safety and moderation.
  • Slow Institutional Response: Schools and authorities struggled to proactively prevent deepfake distribution.

Technology

  • AI Nudifying Apps: Easily downloadable apps instantly generate highly realistic fake nude images.
  • Advanced Deepfake Tech: Neural networks create altered images that are indistinguishable from reality.

Data Inputs

  • Scraped Social Photos: Recognisable features were scraped from targeted girls' social media profiles.
  • Private Account Bypass: Images were obtained despite girls having set their accounts to private.

Human Factors

  • Misogynistic Attitudes: A gendered cultural problem where boys lack respect and standards of behaviour.
  • Desire to Exert Power: The creation of deepfakes was driven by a desire to exert power over girls.
  • Lack of Cyber Awareness: Young people lack awareness of the long-term harm caused by sharing deepfakes.

Process and Methods

  • Weak School Policies: Schools lacked updated safety policies to address the deepfake phenomenon.
  • Insufficient Supervision: Parents failed to monitor children's online activity and creation of deepfakes.

Regulatory Environment

  • Unregulated AI Software: A lack of strict regulations allowed abusive nudifying apps to remain online.
  • No Platform Liability: Platforms make money from content but take no legal responsibility for hosting.

Information quality

  • Classification confidence: High
  • Reason for confidence: The reports are highly consistent across multiple reputable news sources, providing clear details about the incident, the number of victims, the mechanism, and the societal/legal context.
  • Ambiguities identified: The specific name of the AI app used is not identified.
  • Alternative interpretations: None.

A teenage male in Australia used an AI 'nudifying' application to create and distribute non-consensual sexually explicit deepfakes of approximately 50 female classmates. While causing severe psychological harm to the victims and sparking national debate on AI regulation, the incident's national security impact remains minor, with no threat to critical infrastructure, sovereignty, or intelligence capabilities.

  • Overall national security impact: Minor
  • Scope: Single nation
  • Primary target: Australia
  • Alleged perpetrator: Individual

Threat characteristics

  • Imminence: Long-term. The immediate crisis is localized and resolved by law enforcement, representing an ongoing policy and regulatory challenge rather than an imminent national security threat.
  • Autonomy: Human-controlled. The AI application was directly controlled and operated by a human user who scraped photos and processed them through the tool.
  • Novelty: Evolved capability. Image-based abuse is an established threat, but the ease of access to consumer-grade AI 'nudifying' tools represents an evolved and highly accessible capability.

Impact by dimension

  • Physical security: Negligible. No physical systems, kinetic weapons, or critical infrastructure were targeted or compromised in this incident.
  • Information security: Negligible. The incident involves localized harassment and image-based abuse rather than state-sponsored information warfare, intelligence compromise, or systemic disinformation.
  • Sovereignty: Negligible. No impact on government decision-making, electoral systems, sovereign borders, or state authority.
  • Economic security: Negligible. No strategic technology theft, financial system compromise, or threats to economic stability were reported.
  • Societal stability: Minor. While causing severe psychological harm and violating the privacy of 50 students, the societal impact remains localized and manageable through standard law enforcement and school procedures.
Explore in the interactive Incident Tracker