This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
The AI platform Secret Desires suffered a massive data breach where nearly two million sensitive files, including personal photos and explicit AI-generated deepfakes, were left publicly accessible in misconfigured cloud storage. The exposed data included personally identifiable information such as names, workplaces, and universities, alongside content potentially depicting minors. The incident highlights the severe security risks associated with adult-oriented AI services that aggregate intimate user data and synthetic media.
The erotic AI chatbot and image-generation platform Secret Desires reportedly left nearly two million sensitive images and videos publicly exposed in misconfigured cloud storage. The leaked files reportedly included personal photos, workplace and university information, and explicit AI-generated deepfakes of women and girls. The content reportedly became inaccessible shortly after journalists contacted the platform.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
Also classified as
The leak exposed explicit adult content and potentially illegal material, including potential child sexual abuse material indicated by filenames referencing minors.
The platform enabled the creation of nonconsensual explicit deepfakes using face-swap features on scraped images of public and private individuals.
The incident involved a massive leak of non-public sensitive information, including PII (names, schools, workplaces) and private explicit media, directly compromising user privacy.
Human
Due to a decision or action made by humans
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The data exposure was caused by a human error in configuring cloud storage, which was an unintentional security oversight occurring after the AI service was deployed.
Added categories peak at 4: Severe (Psychological Harm, Inferred)
A massive data breach of the AI platform Secret Desires exposed nearly two million sensitive files, including explicit deepfakes and PII of influencers and everyday users. While representing a severe privacy violation and potential child safety risks, the national security impact is minor, primarily posing long-term blackmail and harassment risks manageable under standard cybercrime procedures.
The AI system is described as an image generator and chatbot that performs specific, user-directed functions such as generating 'spicy' roleplay images and executing face swaps based on direct inputs.
Limited Risk: The system is described as a 'chatbot' and an 'AI image generator' that creates 'deepfakes', which fall under transparency obligations for generative AI under the EU AI Act.
The platform is explicitly described as an erotic chatbot and AI image generator that offered a face-swap feature.
The reports from 404 Media and Mashable provide consistent, detailed accounts of the data exposure, the nature of the exposed files, and the specific platform involved (Secret Desires). The technical cause (misconfigured cloud storage) and the scale of the leak (nearly two million files) are clearly documented.
None
Technology
Exposed Cloud Storage Buckets
Publicly accessible cloud containers left sensitive files open to the internet.
Defunct Faceswap Vulnerabilities
Retained explicit media generated by a now-defunct face-swapping tool.
Lack of Built-in Security Controls
Absence of private-by-default buckets, encryption, or access controls.
Data Inputs
Scraped Social Media Images
Images were mined from public social networks and yearbook photos.
Exposed Personally Identifiable Data
Usernames, workplaces, and universities were stored alongside explicit media.
Illegal Underage Filenames
Some exposed files used terms indicating potential underage content.
Human Factors
User Demand for Limitless Intimacy
High demand for NSFW AI content drove rapid adoption with low safety awareness.
Targeting of Vulnerable Individuals
Nonconsensual deepfakes disproportionately targeted women and public figures.
Low User Technical Barriers
Simplified AI tools allowed users with no experience to generate deepfakes.
Process and Methods
Poor Cloud Configuration Management
Mundane and widespread failure to secure cloud storage containers.
Inadequate Active Monitoring
Failure to actively monitor and filter synthetic sexual imagery of minors.
Absence of Provenance Standards
Lack of systemwide watermarking and traceability standards like C2PA.
Management
Prioritizing Growth Over Safety
Security was not built in early, focusing instead on rapid user acquisition.
Immature Startup Governance
Quickly growing startup lacked mature risk assessment and security posture.
Lack of Response and Transparency
The company failed to respond to press requests regarding the exposure.
Regulatory Environment
Trailing Compliance and Liability Laws
Legal frameworks and deepfake legislation are lagging behind AI advancements.
Controversial Legal Measures
Laws like the Take It Down Act face free speech enforcement challenges.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
