{"schema_version":"0.10.0","id":"LR-2026-0363","record_version":1,"title":"Exposed database of AI image generator apps leaked over one million images","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":51.8,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":6.0,"completeness":5.12,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: WIRED · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: WIRED · subject to change"}]},"sources_hash":"f6f57126c32280b9b5b2bd27320ec8959a6c109e530b0299f0ad4ee9a02c2fd5"},"system":{"model_name":null,"model_version":null,"developer":"DreamX","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"production","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2025-12-05","incident_class":"privacy_leakage","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"An AI image generator startup, DreamX, which operates the MagicEdit and DreamPal apps, left a database exposed and accessible to anyone online. The database held more than one million images and videos made with its tools, most of them pornographic, and some appearing to depict children. Security researcher Jeremiah Fowler found the unsecured database in October and reported it. After he contacted the company, it closed access to the database and launched an internal investigation, and the apps were later removed from app stores. The sources do not say how long the data was left open, and they give no date for the discovery beyond the month.","tags":[],"date_detected":null,"near_miss":null,"root_cause":"infrastructure","root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK04","secondary_risks":["RK15","RK12"]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":1099985,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Test: data of others touched with a bounded scope stated. Fact: the exposed database contained 1,099,985 records.","harm_class":["privacy"],"affected_description":"Innocent people, including underage people, whose images were used without consent in sexual content.","protected_class_involved":null,"data_categories_exposed":["images","videos"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.wired.com/story/huge-trove-of-nude-images-leaked-by-ai-image-generator-startups-exposed-database/","publisher":"WIRED","date":"2025-12-05","type":"press","title":"Huge Trove of Nude Images Leaked by AI Image Generator Startup’s Exposed Database - WIRED","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.developer":"C","system.deployment_context":"C","event.incident_class":"C","event.root_cause":"C","event.detection_method":"C","impact.records_exposed":"C","impact.harm_class":"C","impact.data_categories_exposed":"C","impact.affected_description":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.summary":"C","system.autonomy_level":"D","event.trigger":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"“We take these concerns extremely seriously,” says a spokesperson for a startup called DreamX, which operates MagicEdit and DreamPal."}],"system.deployment_context":[{"source_index":0,"quote":"The MagicEdit and DreamPal websites and mobile applications were accessible until WIRED got in touch with those who run it."}],"event.incident_class":[{"source_index":0,"quote":"Multiple websites—including MagicEdit and DreamPal—all appeared to be using the same unsecured database, says security researcher Jeremiah Fowler, who discovered the security flaw in October."}],"event.root_cause":[{"source_index":0,"quote":"Multiple websites—including MagicEdit and DreamPal—all appeared to be using the same unsecured database, says security researcher Jeremiah Fowler, who discovered the security flaw in October."}],"event.detection_method":[{"source_index":0,"quote":"Multiple websites—including MagicEdit and DreamPal—all appeared to be using the same unsecured database, says security researcher Jeremiah Fowler, who discovered the security flaw in October."}],"impact.records_exposed":[{"source_index":0,"quote":"The exposed database Fowler discovered contained 1,099,985 records, the researcher says, with “nearly all” of them being pornographic in nature."}],"impact.harm_class":[{"source_index":0,"quote":"“The real issue is just innocent people, and especially underage people, having their images used without their consent to make sexual content,” says Fowler, a prolific hunter of exposed databases, who published the findings on the ExpressVPN blog."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"“It was all images and videos,” Fowler says, noting the absence of any other file types."}],"impact.affected_description":[{"source_index":0,"quote":"“The real issue is just innocent people, and especially underage people, having their images used without their consent to make sexual content,” says Fowler, a prolific hunter of exposed databases, who published the findings on the ExpressVPN blog."}],"impact.severity":[{"source_index":0,"quote":"The exposed database Fowler discovered contained 1,099,985 records, the researcher says, with “nearly all” of them being pornographic in nature."}],"impact.severity_because":[{"source_index":0,"quote":"The exposed database Fowler discovered contained 1,099,985 records, the researcher says, with “nearly all” of them being pornographic in nature."}],"event.summary":[{"source_index":0,"quote":"An AI image generator startup left more than 1 million images and videos created with its systems exposed and accessible to anyone online, according to new research reviewed by WIRED."},{"source_index":0,"quote":"“We take these concerns extremely seriously,” says a spokesperson for a startup called DreamX, which operates MagicEdit and DreamPal."},{"source_index":0,"quote":"The exposed database Fowler discovered contained 1,099,985 records, the researcher says, with “nearly all” of them being pornographic in nature."},{"source_index":0,"quote":"“The real issue is just innocent people, and especially underage people, having their images used without their consent to make sexual content,” says Fowler, a prolific hunter of exposed databases, who published the findings on the ExpressVPN blog."},{"source_index":0,"quote":"Multiple websites—including MagicEdit and DreamPal—all appeared to be using the same unsecured database, says security researcher Jeremiah Fowler, who discovered the security flaw in October."},{"source_index":0,"quote":"After Fowler got in touch with the AI-image-generator firm, the spokesperson says, it closed access to the exposed database and launched an “internal investigation with external legal counsel.”"},{"source_index":0,"quote":"An Apple spokesperson said the apps have been removed from the App Store."}]},"notes_on_gaps":"Only one source (WIRED, press) was given. The year of discovery is not stated (only October), so date_detected is left out. date_occurred is not stated, and the sources say it is unclear how long the data was exposed. date_disclosed is taken from the article's publication date header (2025-12-05), not from the body text. Because the 1,099,985 record count is the only stated count, impact.third_parties_affected_count is left out. The sources do not identify an adversary, trigger, or whether any attacker accessed the data, so adversarial_actor and trigger are left out. The developer's safeguard claims (prompt regulation, input filtering, moderation API) are unverified company statements and were not recorded as held controls. The J8 link and the remediation control J8 are my judgement that closing public exposure of a database relates to inventory of exposed services. The company's statement that no operational systems were compromised was not used. The order of the Google suspension relative to the October discovery is not stated, so it is placed first as a judgement. Country is not stated, so context.country is left out. Severity moderate was chosen because the scope is stated (1,099,985 records) and others' data was touched, not major, since no count of affected parties is given. Reversibility and direct loss are not stated. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: WIRED · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"The database was left unsecured and accessible to anyone online, a flaw the security researcher Jeremiah Fowler found in October.","quote":"Multiple websites—including MagicEdit and DreamPal—all appeared to be using the same unsecured database, says security researcher Jeremiah Fowler, who discovered the security flaw in October.","source_index":0,"grade":"C"},{"step":"reached","text":"Some images appeared fully AI-made, while others looked hyperrealistic and based on real people, according to the researcher.","quote":"Overall, some images in the database appeared to be entirely AI, including anime-style imagery, while others were “hyperrealistic” and appeared to be based on real people, the researcher says.","source_index":0,"grade":"C"},{"step":"caught","text":"The researcher reported the exposed database to the US National Center for Missing and Exploited Children.","quote":"Fowler reported the exposed database to the US National Center for Missing and Exploited Children, a nonprofit that works with tech companies, law enforcement, and families on child-protection issues.","source_index":0,"grade":"C"},{"step":"done","text":"After the researcher contacted the firm, it closed access to the database and launched an internal investigation with external legal counsel.","quote":"After Fowler got in touch with the AI-image-generator firm, the spokesperson says, it closed access to the exposed database and launched an “internal investigation with external legal counsel.”","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.wired.com/story/huge-trove-of-nude-images-leaked-by-ai-image-generator-startups-exposed-database/"]},"analysis":{"sections":{"timeline":[{"text":"Google suspended MagicEdit and another BoostInsider app for policy violations; the exact order relative to the October discovery is not stated.","quote":"However, when a BoostInsider account questioned why it had two apps, including MagicEdit, suspended by Google earlier this year on support pages, a Google community “expert” account replied, saying the apps included “sexually explicit content” or nudity.","source_index":0,"when":"earlier this year"},{"text":"Security researcher Jeremiah Fowler discovered the unsecured database.","quote":"Multiple websites—including MagicEdit and DreamPal—all appeared to be using the same unsecured database, says security researcher Jeremiah Fowler, who discovered the security flaw in October.","source_index":0,"when":"October"},{"text":"At the time of discovery, about 10,000 new images were being added to the database every day.","quote":"At the time, Fowler says, around 10,000 new images were being added to the database every day.","source_index":0,"when":"October"},{"text":"Fowler reported the exposed database to the US National Center for Missing and Exploited Children.","quote":"Fowler reported the exposed database to the US National Center for Missing and Exploited Children, a nonprofit that works with tech companies, law enforcement, and families on child-protection issues.","source_index":0,"when":null},{"text":"After Fowler contacted the firm, it closed access to the exposed database and launched an internal investigation.","quote":"After Fowler got in touch with the AI-image-generator firm, the spokesperson says, it closed access to the exposed database and launched an “internal investigation with external legal counsel.”","source_index":0,"when":null},{"text":"The MagicEdit and DreamPal websites and apps stayed accessible until WIRED contacted those who run them.","quote":"The MagicEdit and DreamPal websites and mobile applications were accessible until WIRED got in touch with those who run it.","source_index":0,"when":null},{"text":"Apple removed the apps from the App Store.","quote":"An Apple spokesperson said the apps have been removed from the App Store.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.wired.com/story/huge-trove-of-nude-images-leaked-by-ai-image-generator-startups-exposed-database/"]}}