Yearbook Photos turned into AI Porn

Consent is key when it comes to nudity. That's in real life and with AI. This is a lesson that one AI company learned the hard way.

Earlier this year, a massive data exposure at Secret Desires, an AI roleplay and image generation platform, has revealed how millions of real women’s photos were uploaded and turned into graphic AI porn without their knowledge.

The leak occurred at the same time the United States enacted new federal protections aimed at combating nonconsensual intimate deepfakes, placing the company’s practices in direct conflict with the spirit and requirements of the law.

Secret Desires AI left nearly 1.8 million image and video files in unsecured Microsoft Azure cloud storage containers for months.

Reporters reviewing the exposed data found high school yearbook photos, university graduation snapshots, selfies taken in bedrooms, workplace headshots, and files labeled with full first and last names.

Many images appeared to have been pulled from private social media accounts or personal devices. These real photos were stored alongside AI-generated pornographic videos produced by the platform’s face-swapping tool, which was marketed to paying subscribers until early 2025. The face swap feature has since been removed from the platform.

Prompts visible in the filenames showed that some users attempted to generate sexual content featuring subjects described as seventeen years old. Several videos in the exposed “live photos” folder depicted extremely young-looking individuals despite Secret Desires AI's written prohibition on any sexual content involving minors.

The presence of these files indicates that the platform processed uploads and prompts that directly violated its own rules and likely federal law.

Secret Desires AI promoted itself as a secure, privacy-focused environment. But is it? On its website, the company claimed to offer bank-level encryption, strict access controls, and unreadable message storage. It told users that their privacy was “sacred” and that all data was used only to enhance their personal experience. These promises stood in sharp contrast to the reality of open, publicly accessible cloud containers that allowed anyone with the URLs to view the data inside.

About an hour after reporters contacted the company, the leaked files became inaccessible. SecretDesires.AI CEO Jack Simmons did not respond to questions about why the data was unprotected or how long it had been exposed.

The leak arrives during a major shift in United States law. The TAKE IT DOWN Act, signed in May 2025, established the strongest federal rules to date governing nonconsensual intimate images, including AI-generated depictions.

The law criminalizes the publication of intimate imagery without consent and covers both authentic and digitally created material. It requires online platforms to implement systems that allow victims to request the removal of their images. Platforms must act within strict timelines and prevent duplicates from reappearing once notified.

The law defines “digital forgeries” as intimate images created through software or computer-generated means. This definition applies directly to the face-swapped pornographic videos found in Secret Desires AI leaked containers.

Although criminal enforcement falls to federal authorities, the law also places obligations on platforms. Companies have until May 2026 to build complaint systems that comply with the act.

Legal experts say the leak highlights the problem the TAKE IT DOWN Act was intended to address. It shows how easily AI tools can be used to create explicit content of real people who never participated, never consented, and in many cases may not know the platform exists.

It also shows the challenges platforms face when they advertise strict security and ethical rules but operate without the safeguards needed to protect user data.

The Secret Desires AI rules mirror some of the act’s core principles by prohibiting sexual depictions of anyone under eighteen and banning content intended to cause public harm. They warn that violations may result in suspension or a permanent ban.

Yet not as the presence of thousands of real photos of women who had no connection to the platform, combined with sexualized prompts referencing minors, demonstrates failures in both moderation and data protection.

To be fair, the company has worked to upgrade its security and site protocols since the leak was revealed. This is good news and the kind of thing we like to hear.

Companies such as Wowify.AI offer compliance filter tools to help AI websites enforce their content rules and remain compliant.

"You can't take compliace serious enough," says Steve Lightspeed of Wowify.AI.

Not all AI services have adopted these safeguards, but with this leak now in the news, hopefully other AI companies will take notice.

The intersection of this leak with the new federal law places increased scrutiny on platforms that offer face-swapping, voice cloning, or intimate AI roleplay services.

Under the TAKE IT DOWN Act, companies that receive reports from victims must respond quickly or face potential consequences.

The exposed files at SecretDesires.AI show how the misuse of these tools can extend beyond the users who upload the images. The leak allowed sensitive files to circulate outside the platform entirely, creating risks the new law seeks to reduce. As more people discover that their private photos were stored and processed by Secret Desires without their knowledge, the act may become a key mechanism for victims seeking removal and accountability.

The company is just 1 of many AI that have been caught. But at least they have taken steps to prevent this from happening in the future by closing the source of the leak and tightening up enforcement measures regarding their policies. That, to me, is a huge step in the right direction, one that I hope other AI startups take note of.