AI Risk Wire

Cases › produced harmful content › LR-2026-0773

Alleged AI-generated explicit deepfakes of schoolmates by a Form Five student, Seremban school (Malaysia)

Preliminary Why: Publisher not yet named · subject to change

Status: action reported, no fix

Severity moderate
Reported 17 Oct 2026
Industry education

No source states: loss or records, developer and model, agent tool, could do, deployer.

Severity moderate: Test: data or systems of others touched with bounded scope stated. Fact: parents' lawyer alleges around 200 images of female schoolmates at one school, an allegation not independently confirmed.

A Form Five student at a school in Seremban is alleged to have used artificial intelligence to generate explicit deepfake images of female schoolmates. The lawyer for a group of parents says the images were found on a phone left unattended in the school surau and discovered by a Form Two student on Aug 12, and that the student forwarded several of them to his older sister. The lawyer alleges around 200 images were produced. Five police reports lodged in August reportedly have produced no developments, and the school reportedly gave the student a one-week suspension. Parents want a formal probe to determine whether the images were shared on social media and an assurance that they were deleted. All of these points are allegations made by the parents' lawyer and have not been independently confirmed in the source.

What happened

1 · What it was doingA Form Five student allegedly used AI to generate explicit deepfake images of female schoolmates.
2 · What went wrongAn unlocked phone left in the school surau held explicit photographs of schoolmates digitally altered using AI.
3 · What it reached or didThe student forwarded several of the images to his older sister, a Form Five student at the same school, and parents were alerted.
4 · How it was caughtA Form Two student discovered the phone on Aug 12 and the matter came to light.

What was done

Despite meetings involving the school, its board of governors, the PTA and the education department, the student was given a one-week suspension, according to the lawyer.

Risks

Privacy harm to a person
Primary41 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Application

Data minimisation · Sensitive-data checks on outbound data · Human approval for high-impact actions · Output filtering and redaction · People told they are dealing with AI · Risk assessment per deployment

Infrastructure / target

Bot and scraping defences

Evidence

No source states: when it happened, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.

Show the full account: 5 items from the primary sources

What happened, in order

  1. April last year Earlier precedent: a 16-year-old in Johor was charged for generating similar deepfake images.
  2. Aug 12 A Form Two student discovered the unlocked phone in the school surau and the explicit images were found.

Not dated in the sources:

  • The student forwarded several images to his older sister, which alerted parents.
  • Meetings with school and education bodies were held and the student was given a one-week suspension.
  • Parents' lawyer publicly urged police to open an investigation at a press conference.
Show every field, with its source and grade

What happened

Earliest source we hold
2026-10-17
D inferred by us from the described behaviour, reason shown
Who caught it
an outside party
C one secondary source states it
What went wrong
produced harmful content
C one secondary source states it
primary risk
RK15
D inferred by us from the described behaviour, reason shown

Impact

Severity
moderate
D inferred by us from the described behaviour, reason shown
Why this severity
Test: data or systems of others touched with bounded scope stated. Fact: parents' lawyer alleges around 200 images of female schoolmates at one school, an allegation not independently confirmed.
D inferred by us from the described behaviour, reason shown

Context

Industry
education
C one secondary source states it
Country
Malaysia
C one secondary source states it

Notes on gaps

Most facts are allegations by the parents' lawyer and are not independently confirmed. The phone being left unlocked and unattended is not a stated AI control. No remediation by the school or any AI provider is reported. The source does not state whether images were shared further or whether they were deleted.

LR-2026-0773 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON