GenNomis database exposes AI-generated child sexual abuse material and explicit deepfakes
An unsecured database operated by South Korean AI company GenNomis exposed over 93,000 AI-generated images, including child sexual abuse material and non-consensual deepfake imagery of celebrities, due to lack of encryption or password protection. Security researcher Jeremiah Fowler discovered the breach in early March, and both GenNomis and parent company AI-Nomis subsequently shut down their websites.
What happened
Cybersecurity researcher Jeremiah Fowler discovered an unsecured database belonging to South Korea-based AI company GenNomis containing 93,485 images and 47.8 GB of data, with no password protection or encryption. The exposed database contained AI-generated explicit images, including depictions of celebrities such as Ariana Grande, the Kardashians, and Beyoncé de-aged to look like children, as well as AI-generated child sexual abuse material.
The database included JSON files detailing user prompts and links to generated content. GenNomis offered AI-powered tools for creating images from text prompts, swapping faces, and generating AI personas, with a marketplace for buying and selling user-generated images in over 45 artistic styles. Following discovery in early March, GenNomis took down the exposed database, and both GenNomis and AI-Nomis websites subsequently went offline.
Reported impact
Security researcher Jeremiah Fowler stated the exposure was 'terrifying' and 'horrifying how easy it is to create that content.' According to Fowler, 96 percent of all deepfakes online are pornographic, with 99 percent involving women who did not consent.
Law professor Clare McGlynn noted the incident demonstrates 'the disturbing extent to which there is a market for AI that enables such abusive images to be generated' and emphasized that creation, possession, and distribution of child sexual abuse material should not be dismissed as rare.
Index analysis
The incident exposed critical vulnerabilities in the AI image generation industry, with the database lacking basic security measures. The exposure demonstrates how AI image-generation tools can be weaponized to create non-consensual sexual content of adults and child sexual abuse material.
Governance controls
Fowler emphasized the importance of implementing robust security measures and user verification processes to prevent future breaches and protect vulnerable individuals. The incident prompted wider discussion about the need for stricter regulations and ethical guidelines within the AI image generation industry.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.