{"schema_version":"0.10.0","id":"LR-2026-0576","record_version":1,"title":"Probe finds Grok broke Canadian law by creating sexual deepfakes","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":60.6,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":6.0,"completeness":5.44,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":2,"reports_independent":0,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"dc98af226b04e810c9f03519d76cdab8178a788c5976a7187915369642cfc74b"},"system":{"model_name":"Grok","model_version":null,"developer":"xAI","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"AI-powered image generation","safeguard_state":"no appropriate safeguards at launch","production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-06-11","incident_class":"harmful_output","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Grok, an AI-powered image generation tool offered by X Corp and xAI, was used to create and share sexualized deepfakes. Canada’s privacy commissioner found that the companies violated federal private-sector privacy law by launching the tool without appropriate safeguards at the outset. At one point the tool allowed more than 6,000 sexualized deepfake images per hour, and the investigation cited statistics on the volume of images. The investigation, opened in January, examined whether the companies obtained valid consent. The companies then introduced new safeguards and proactive sweeps and committed to quarterly and third-party audit reports. The company declined a recommendation to suspend the tool. Investigations by the UK, the European Union and California followed.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":"provider","adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":"no; company declined recommendation to suspend the tool","remediation":"new safeguards and proactive sweeps to detect and remove harmful content","precursor_events":null,"primary_risk":"RK15","remediations":[{"by":null,"kind":"fix","date_reported":null,"controls_added":["I3","F2"],"quote":"X and xAI have introduced “new measures, including safeguards to reduce the risk that their tool will be misused to produce sexualized deepfakes, and proactive sweeps to detect and remove this harmful content on their platforms,” he added.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","harm_class":["privacy"],"affected_description":"women and children targeted by sexualized deepfakes","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://globalnews.ca/news/11899687/grok-sexual-deepfake-report/","publisher":"Global News","date":"2026-06-11","type":"press","title":"Grok AI broke Canada’s laws, created 6K sexual deepfakes per hour: probe - National - Global News","archived_url":null,"attachment":"first_report"},{"url":"https://iapp.org/news/a/opc-finds-grok-chatbot-and-deepfakes-violated-canada-s-privacy-law","publisher":"IAPP","date":"2026-06-11","type":"press","title":"OPC finds Grok chatbot and deepfakes violated Canada's privacy law - IAPP","archived_url":null}],"per_field_confidence":{"system.developer":"C","system.model_name":"C","system.intended_use":"C","system.safeguard_state":"C","event.incident_class":"C","event.responsible_party":"C","event.remediation":"C","event.operations_paused":"C","context.country":"C","impact.harm_class":"C","impact.affected_description":"C","impact.severity":"D","event.primary_risk":"D","event.remediations":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"“The investigation has found that X Corp and xAI violated Canada’s federal private sector privacy law by launching the Grok AI-powered image generation tool without implementing appropriate safeguards at the outset,” privacy commissioner Philippe Dufresne said in a press conference in Ottawa Thursday."}],"system.model_name":[{"source_index":1,"quote":"An investigation by the Office of the Privacy Commissioner of Canada found X Corp. and xAI violated the country's federal private-sector privacy law by launching the Grok AI-powered image generation tool — which at one point allowed users to create and share more than 6,000 sexualized deepfake images per hour — without appropriate safeguards."}],"system.intended_use":[{"source_index":1,"quote":"An investigation by the Office of the Privacy Commissioner of Canada found X Corp. and xAI violated the country's federal private-sector privacy law by launching the Grok AI-powered image generation tool — which at one point allowed users to create and share more than 6,000 sexualized deepfake images per hour — without appropriate safeguards."}],"system.safeguard_state":[{"source_index":0,"quote":"“The investigation has found that X Corp and xAI violated Canada’s federal private sector privacy law by launching the Grok AI-powered image generation tool without implementing appropriate safeguards at the outset,” privacy commissioner Philippe Dufresne said in a press conference in Ottawa Thursday."}],"event.incident_class":[{"source_index":0,"quote":"“This lack of protection allowed users to create and share sexualized deepfakes largely targeting women and children,” he added."}],"event.responsible_party":[{"source_index":0,"quote":"“The investigation has found that X Corp and xAI violated Canada’s federal private sector privacy law by launching the Grok AI-powered image generation tool without implementing appropriate safeguards at the outset,” privacy commissioner Philippe Dufresne said in a press conference in Ottawa Thursday."}],"event.remediation":[{"source_index":0,"quote":"X and xAI have introduced “new measures, including safeguards to reduce the risk that their tool will be misused to produce sexualized deepfakes, and proactive sweeps to detect and remove this harmful content on their platforms,” he added."}],"event.operations_paused":[{"source_index":1,"quote":"While these efforts have reduced incidents of sexualized deepfakes by 50%, Dufresne said the company declined to implement a recommendation to suspend the image generating tool until all appropriate safeguards were implemented."}],"context.country":[{"source_index":0,"quote":"Billionaire Elon Musk’s Grok AI violated Canada’s privacy laws and, at one point, generated more than 6,000 sexual deepfake images per hour, Canada’s privacy commissioner found."}],"impact.harm_class":[{"source_index":0,"quote":"The investigation looked at whether the companies involved are complying with privacy law and whether they obtained “valid consent” to collect, use and disclose personal information to create deepfakes, including explicit content."}],"impact.affected_description":[{"source_index":0,"quote":"“This lack of protection allowed users to create and share sexualized deepfakes largely targeting women and children,” he added."}],"impact.severity":[{"source_index":0,"quote":"Billionaire Elon Musk’s Grok AI violated Canada’s privacy laws and, at one point, generated more than 6,000 sexual deepfake images per hour, Canada’s privacy commissioner found."}],"event.remediations":[{"source_index":0,"quote":"X and xAI have introduced “new measures, including safeguards to reduce the risk that their tool will be misused to produce sexualized deepfakes, and proactive sweeps to detect and remove this harmful content on their platforms,” he added."}],"event.summary":[{"source_index":0,"quote":"Billionaire Elon Musk’s Grok AI violated Canada’s privacy laws and, at one point, generated more than 6,000 sexual deepfake images per hour, Canada’s privacy commissioner found."},{"source_index":0,"quote":"“The investigation has found that X Corp and xAI violated Canada’s federal private sector privacy law by launching the Grok AI-powered image generation tool without implementing appropriate safeguards at the outset,” privacy commissioner Philippe Dufresne said in a press conference in Ottawa Thursday."},{"source_index":1,"quote":"While these efforts have reduced incidents of sexualized deepfakes by 50%, Dufresne said the company declined to implement a recommendation to suspend the image generating tool until all appropriate safeguards were implemented."},{"source_index":0,"quote":"The investigation looked at whether the companies involved are complying with privacy law and whether they obtained “valid consent” to collect, use and disclose personal information to create deepfakes, including explicit content."},{"source_index":0,"quote":"X and xAI have introduced “new measures, including safeguards to reduce the risk that their tool will be misused to produce sexualized deepfakes, and proactive sweeps to detect and remove this harmful content on their platforms,” he added."},{"source_index":0,"quote":"The wave of images drew a global backlash, with the U.K., the European Union and California launching investigations of their own."}]},"notes_on_gaps":"No source states the date the harm began, the date of disclosure of the findings beyond press dates, the detection date, a loss amount, a count of affected third parties, or a trigger. The sources do not describe Grok as an autonomous agent, so agent_involved, failure_class and related agent fields are omitted. Root cause is omitted because the sources say safeguards were absent, not that an existing control failed. Severity major is my judgement under the regulator-involved test. Responsible party provider is my judgement from the findings against X Corp and xAI; the company argued users create the content, which I did not adopt. Deployment as production is inferred from public launch and user access. Control I3 as missing and the controls_added mapping of F2 to proactive sweeps are my inferences from the new process and sweeps described. Timeline order between the statistics, the declined suspension and the foreign investigations is my ordering where sources give no dates. The model name Grok is taken from the tool name in the sources. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"CA","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Grok, an AI-powered image generation tool launched by X Corp. and xAI, was in use to generate images.","quote":"An investigation by the Office of the Privacy Commissioner of Canada found X Corp. and xAI violated the country's federal private-sector privacy law by launching the Grok AI-powered image generation tool — which at one point allowed users to create and share more than 6,000 sexualized deepfake images per hour — without appropriate safeguards.","source_index":1,"grade":"C"},{"step":"went_wrong","text":"Users were able to create and share sexualized deepfakes largely targeting women and children, which the regulator linked to the lack of protection.","quote":"“This lack of protection allowed users to create and share sexualized deepfakes largely targeting women and children,” he added.","source_index":0,"grade":"C"},{"step":"reached","text":"At one point the tool allowed more than 6,000 sexualized deepfake images per hour to be created and shared.","quote":"An investigation by the Office of the Privacy Commissioner of Canada found X Corp. and xAI violated the country's federal private-sector privacy law by launching the Grok AI-powered image generation tool — which at one point allowed users to create and share more than 6,000 sexualized deepfake images per hour — without appropriate safeguards.","source_index":1,"grade":"C"},{"step":"caught","text":"The privacy commissioner opened an investigation in January into the spread of sexualized deepfakes.","quote":"Dufresne launched an investigation in January to examine the proliferation of sexualized deepfakes created by Grok and shared on the X social media platform.","source_index":0,"grade":"C"},{"step":"done","text":"The companies committed to quarterly reports and independent third-party audits on safeguard improvements.","quote":"In response, the companies have committed to, among other things, provide quarterly reports as well as independent third-party audit reports on improvements to safeguards with evidence to demonstrate their effectiveness.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://globalnews.ca/news/11899687/grok-sexual-deepfake-report/","https://iapp.org/news/a/opc-finds-grok-chatbot-and-deepfakes-violated-canada-s-privacy-law"]},"analysis":{"sections":{"timeline":[{"text":"Statistics cited by the investigation show Grok sharing 1.8 million sexualized images from 29 Dec. 2025 and an estimated 3 million sexualized deepfakes between 29 Dec. 2025 and 8 Jan. 2026.","quote":"While the OPC investigation cites statistics — including that Grok shared 1.8 million sexualized images since 29 Dec. 2025 and the Center for Countering Digital Hate's estimation that Grok generated approximately 3 million sexualized deepfakes, including 23,000 images of children, between 29 Dec. 2025 and 8 Jan. 2026 — Dufresne said the OPC lacks abilities to effectively enforce the violation of Canada's Personal Information Protection and Electronic Documents Act.","source_index":1,"when":"since 29 Dec. 2025"},{"text":"The privacy commissioner launched an investigation.","quote":"Dufresne launched an investigation in January to examine the proliferation of sexualized deepfakes created by Grok and shared on the X social media platform.","source_index":0,"when":"January"},{"text":"X Corp. and xAI implemented safeguards after the investigation began.","quote":"Since the OPC's investigation began in January, Dufresne said X Corp. and xAI have implemented safeguards to reduce the risk of Grok's use to produce sexualized deepfakes, including a process for “anticipating and mitigating privacy issues associated with image-generation tools and other novel products” and regular reports to the OPC to “explain and demonstrate the effectiveness of their safeguards.” Dufresne said the OPC will receive these reoccurring reports “until we are satisfied that the issues have been fully resolved.”","source_index":1,"when":"since January"},{"text":"The company declined a recommendation to suspend the tool; the regulator said incidents were reduced by 50%.","quote":"While these efforts have reduced incidents of sexualized deepfakes by 50%, Dufresne said the company declined to implement a recommendation to suspend the image generating tool until all appropriate safeguards were implemented.","source_index":1,"when":null},{"text":"The privacy commissioner announced the findings that the companies violated federal privacy law.","quote":"“The investigation has found that X Corp and xAI violated Canada’s federal private sector privacy law by launching the Grok AI-powered image generation tool without implementing appropriate safeguards at the outset,” privacy commissioner Philippe Dufresne said in a press conference in Ottawa Thursday.","source_index":0,"when":"Thursday"},{"text":"The companies committed to quarterly reports and independent third-party audit reports.","quote":"In response, the companies have committed to, among other things, provide quarterly reports as well as independent third-party audit reports on improvements to safeguards with evidence to demonstrate their effectiveness.","source_index":0,"when":null},{"text":"The U.K., the European Union and California launched their own investigations.","quote":"The wave of images drew a global backlash, with the U.K., the European Union and California launching investigations of their own.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://globalnews.ca/news/11899687/grok-sexual-deepfake-report/","https://iapp.org/news/a/opc-finds-grok-chatbot-and-deepfakes-violated-canada-s-privacy-law"]}}