This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Students in Malta, some as young as 12, have been targeted by perpetrators using AI-powered 'nudify' apps to create and distribute non-consensual sexual imagery. These images were used for humiliation and blackmail, often following relationship rejections. The incident highlights the growing risk of AI-enabled harassment and the challenges faced by victims and parents in seeking legal recourse.
Beginning sometime in October 2024, students ranging in age from 12 to 20 in schools in Malta were targeted in deepfake nude incidents. The attackers have been superimposing the faces of some of the students over the bodies of naked girls or using "nudify" apps to "undress" the photos, which have reportedly been sent to the victims over WhatsApp in order to humiliate them or in some cases blackmail them.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to gain a personal advantage over others such as through cheating, fraud, scams, blackmail or targeted manipulation of beliefs or behavior. Examples include AI-facilitated plagiarism for research or education, impersonating a trusted or fake individual for illegitimate financial benefit, or creating humiliating or sexual imagery.
Also classified as
The incident involves the creation and distribution of non-consensual sexual content depicting minors, exposing victims and peers to highly toxic material.
The incident involves the targeted creation of humiliating sexual imagery of specific victims to blackmail and harass them, which aligns with sub-domain 4.3 under Boundary Rule B1.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The harm was caused by human perpetrators intentionally using deployed AI deepfake apps to generate and distribute non-consensual sexual imagery to humiliate and blackmail victims.
Added categories peak at 4: Severe (Child Sexual Exploitation & Abuse (CSEA), Inferred)
Classmates and peers in Malta and Spain utilized AI-powered apps to generate and distribute non-consensual sexual imagery of minors for blackmail and harassment. While constituting severe violations of privacy and child protection rights, the national security impact remains minor and localized, manageable through standard legal, educational, and social welfare frameworks.
The AI system operates as a tool, performing the specific, well-defined function of generating a synthetic image based on a direct user-provided photo input, without exhibiting independent planning or agency.
Risk Level 3: Limited Risk. The report describes the use of deepfake-generating apps, which fall under the category of AI-generated content requiring specific transparency obligations under the EU AI Act.
The primary function of the AI system described is to analyze a person's photo and generate a realistic, fake naked image of them.
The reports from Malta and Spain provide clear, factual accounts of the incidents, including the number of victims, their ages, the technology used, and the social/legal impacts. There is little ambiguity about the events.
None.
Technology
AI Image Reconstruction
AI apps reconstruct realistic naked bodies from clothed photos.
Accessible Deepfake Tools
Easy access to powerful AI image manipulation tools on mobile.
Data Inputs
Unrestricted Photo Access
Publicly available photos of victims are used as input for AI.
Human Factors
Malicious Intent by Peers
Classmates use AI tools for revenge, blackmail, or humiliation.
Lack of Digital Responsibility
Minors generate and share harmful content without understanding impact.
Process and Methods
Easy Sharing on Chat Apps
Rapid dissemination of AI deepfakes via platforms like WhatsApp.
Reluctance to Report
Parents avoid reporting to prevent further trauma to victims.
Management
Lack of App Safety Controls
App creators fail to implement controls preventing abuse of their AI.
Regulatory Environment
Gaps in Criminal Responsibility
Perpetrators are often under the legal age of criminal responsibility.
Inadequate Legal Frameworks
Existing laws fail to address rapid rise of AI-generated abuse.
Systemic Delays in Justice
Slow legal processes deter victims' families from seeking justice.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
