ChatGPT Allegedly Defamed Norwegian User by Inventing Child Homicide and Imprisonment

In August 2024, ChatGPT is reported to have falsely claimed that Norwegian citizen Arve Hjalmar Holmen had killed his two sons and been sentenced to 21 years in prison. The fabricated response allegedly included specific details about the supposed crime, despite Holmen never being accused or convicted of any offense. The incident prompted a GDPR complaint for defamation and inaccurate personal data.

Risk classification

• Primary risk domain: 3 Misinformation
• Primary risk subdomain: 3.1 False or misleading information

The AI system generated completely false and defamatory information claiming the user had murdered his children and served prison time, which is a clear instance of generating false and misleading information.

Additional risk subdomains

• 7.3 Lack of capability or robustness: The incident is a classic example of AI hallucination, representing a fundamental lack of capability and robustness in the model's factual retrieval.

Causal factors

• Entity: AI
• Intent: Unintentional
• Timing: Post-deployment

The false and defamatory biography was generated by the ChatGPT AI system after its deployment, representing an unintentional hallucination error by the model.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Risk Level 3. Limited Risk: The system is a chatbot (ChatGPT), which falls under the category of AI systems that pose a moderate risk and require specific transparency obligations to ensure users are informed they are interacting with an AI.

AI system and alleged parties

• AI system: ChatGPT (OpenAI)
• AI purpose: Chatbot; Question Answering
• Behaviour type: Assistant
• Alleged developer: OpenAI
• Alleged deployer: OpenAI
• Alleged harmed parties: Arve Hjalmar Holmen

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Minor, indirect Negligible
• Epistemic: direct Minor, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Privacy

Reported: The report describes a complaint filed under data protection laws, though the primary issue is the inaccuracy of the generated data.

Directly caused: The AI system processed and outputted inaccurate personal data (hometown, family details) linked to a highly damaging false criminal accusation, violating GDPR accuracy principles.

Psychological

Reported: The report explicitly describes psychological distress and fear experienced by the affected individual.

Directly caused: Arve Hjalmar Holmen was deeply troubled and scared by the false output, stating that the prospect of someone reading and believing the false murder accusation was highly damaging and frightening.

Epistemic

Reported: The report explicitly describes epistemic harm in the form of AI-driven fabrication and defamation-by-hallucination.

Directly caused: ChatGPT fabricated a detailed, false story claiming a private citizen was convicted of murdering his two sons and sentenced to 21 years in prison.

People affected

• Occurrences reported: 1
• People reportedly harmed: 1
• People reportedly exposed: 1

Potential causes

Management

• Lack of Transparency: OpenAI did not reply to access requests regarding internal data sources.
• Inadequate Safety Testing: Deploying models without resolving severe hallucination and defamation risks.

Technology

• Next-Token Prediction Model: Model predicts likely words, causing factual errors and wild assertions.
• Black Box Nature of LLMs: Lack of transparency makes it impossible to trace how outputs are generated.
• Inherent LLM Hallucinations: Generative AI systems naturally invent information and present it as fact.

Data Inputs

• Lack of Real-Time Web Search: The model lacked live search capabilities to verify real-time facts.
• Improper Data Blending: Correct personal details were incorrectly blended with unrelated tragic events.

Human Factors

• Plausibility of False Outputs: Highly plausible responses trick users into believing false info is correct.
• Influence of Prior Queries: Previous searches by the user potentially biased the chatbot's generation.

Process and Methods

• Insufficient Safeguards: Relying on a small text disclaimer rather than technical prevention methods.
• Inadequate Output Verification: No real-time verification process to filter out defamatory biographies.

Regulatory Environment

• GDPR Accuracy Violations: Failure to comply with European data protection rules regarding personal data.
• Lack of Pre-deployment Audits: Absence of regulatory mandates requiring pre-deployment safety audits.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide consistent, detailed accounts of the specific prompt used, the exact false output generated by ChatGPT, the user's reaction, and the legal actions taken. There are no major conflicting details regarding the core incident.

A Norwegian citizen filed a GDPR complaint against OpenAI after ChatGPT generated a highly defamatory, false biography accusing him of murder. While the incident highlights significant issues with AI hallucinations and data privacy, its national security impact is negligible, representing a localized regulatory and civil rights concern rather than a threat to state security.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: Norway
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. This represents an ongoing technological capability and regulatory concern regarding AI hallucinations rather than an active crisis.
• Autonomy: Human-supervised. The AI system generated the response autonomously based on a user prompt, operating as an assistant with human oversight.
• Novelty: Established threat. Large language model hallucinations and the generation of false biographical details are well-documented, recurring issues.

Impact by dimension

• Physical security: Negligible. The incident involves text generation and poses no threat to physical systems, critical infrastructure, or human safety.
• Information security: Negligible. While the AI generated false information, it was an isolated hallucination rather than a coordinated disinformation campaign or intelligence compromise.
• Sovereignty: Negligible. The incident does not affect state authority, territorial control, elections, or core government decision-making processes.
• Economic security: Negligible. There is no indication of threats to financial systems, strategic technology theft, or economic stability.
• Societal stability: Minor. The incident represents a minor impact on individual privacy and data protection rights under GDPR, but lacks large-scale societal or national security implications.