This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
The AI chatbot Grok disclosed the private legal name and birthdate of an adult performer without being prompted. The individual reported that this action resulted in doxxing, harassment, and the permanent loss of her privacy as the information was subsequently proliferated by other scrapers. The victim expressed significant distress, noting that she had previously invested in data removal services to keep this information private.
Grok is reported to have publicly provided adult performer Siri Dahl's legal name and birthdate without being asked for that information. Dahl reportedly said she had worked to keep those details private and that, after the disclosure, impersonation accounts and reposts of stolen content using her legal name purportedly appeared online.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
The Grok AI system disclosed the victim's private legal name and birthdate, which she had actively tried to keep private, directly violating her privacy.
AI system
Due to a decision or action made by an AI system
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The privacy leak was caused by an action of the deployed Grok AI system, which unintentionally disclosed private user data while responding to queries.
Added categories peak at 2: Minor (Psychological Harm, Direct)
An AI chatbot (Grok) leaked the private legal name and birthdate of an individual, leading to personal distress and doxxing. While representing a serious privacy violation and highlighting safety filter vulnerabilities in commercial AI models, the incident is a localized consumer safety issue with negligible national security implications.
The report describes Grok as an 'AI bot' and 'chatbot' that generates responses to user queries, which fits the Assistant behavior type as it provides information and conversational responses to users.
Risk Level 3. Limited Risk: The report describes Grok as an 'AI bot' and 'chatbot', which falls under the category of conversational AI systems that require transparency obligations.
Grok is a general-purpose conversational chatbot designed to answer user queries and generate text responses.
The report clearly details the AI system involved (Grok), the specific action it took (disclosing the victim's legal name and birthdate), the victim's response, and the consequences of the leak. There is little ambiguity regarding the privacy violation.
None
Technology
Inadequate PII Filtering
Grok failed to filter out personally identifiable information during output.
Hallucination of Public Status
Grok falsely asserted that the private information was already public.
Data Inputs
Scraping of Private Data
Training data included sensitive personal details like legal names.
Lack of Data Verification
No mechanism to verify if training data contained private personal info.
Human Factors
Victim Privacy Efforts Bypassed
Victim's paid data removal efforts were bypassed by the AI scraper.
Process and Methods
Deficient Output Moderation
Output filters failed to block the release of real names and birth dates.
Management
Inadequate Safety Guardrails
Management failed to enforce strict guardrails against PII leakage.
Regulatory Environment
Lack of AI Privacy Regulations
Absence of strict laws governing AI scraping of personal information.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
