When AI Can Undress You Without Consent: A Wake-Up Call for Sri Lanka

AI image generation promised creativity, but it has also revealed alarming risks, including a growing “bikini trend.” On platforms powered by generative AI, a simple prompt or a tweet can now instantly turn ordinary photos into sexualized images or videos, without the subject’s knowledge or consent. The impact on the victim is real, permanent, and deeply personal.

Elon Musk’s Grok is under growing global scrutiny as discussions unfold over its failure to prevent the creation of harmful content. Experts and stakeholders are raising urgent concerns about the platform being used to produce child sexual abuse material (CSAM), non-consensual intimate images (NCII), and degrading sexual content targeting women and minors, fueling debates on AI safety standards.  

This is no longer a hypothetical risk. Anyone with images publicly available online is exposed. The technology can turn these images into harmful content at scale, with virtually no safeguards, even for the most severe abuses, including child sexual abuse material.  

 On X (formerly Twitter), users have been openly directing AI chatbots to turn images of women and girls into sexualized versions, using nothing more than a sentence. No special skills are needed, and the original subject often never finds out. There are still very few effective controls to prevent these images from spreading.  

The risk is amplified by accessibility. Grok now allows users to edit or generate videos and images in “spicy,” “funny,” or “normal” modes, effectively putting sexual harassment tools into everyone’s hands and escalating the threat globally.

A dangerous divide is separating responsible tech companies from negligent ones. Major players like Google and Meta have implemented “SynthID” or C2PA standards, invisible digital watermarks that permanently label an image as computer-generated. This allows the public to distinguish fact from fiction. xAI’s Grok does not enforce this. Current documentation confirms that Grok-generated images lack these embedded safeguards, making it nearly impossible to prove an image is fake once it leaves the platform. Grok stated, “Based on our xAI’s documentation and public reports, Grok-generated images do not currently include embedded AI labels or metadata. We are aware of the concerns around privacy and misuse.”  

Many AI-generated images circulate as if they were real. Once they are shared, copied, or downloaded, it is extremely hard to correct the record. For women, minors, and public figures, this is not entertainment it is a fast-growing, global form of digital sexual violence.

The Real Harm Behind “Just AI”

Supporters of these tools often argue that the technology itself is neutral and that misuse is the fault of individuals. This argument no longer holds. When a platform’s own AI system allows non-consensual sexual manipulation of real people at scale, the harm is no longer incidental. It is platform-amplified.  

Victims have reported feelings of shame, fear, and helplessness. Some have withdrawn from online spaces entirely. Others have been targeted repeatedly after speaking out. Once an image goes viral, reporting and takedowns offer little comfort. The internet does not forget.  

Following public backlash, the Grok account itself issued an apology, acknowledging that it had generated and shared an AI-altered image of two young girls in sexualized attire based on a user prompt. The statement admitted a failure of safeguards and conceded that the content potentially violated child sexual abuse material laws. While the post was later removed, it had already accumulated millions of views, underscoring how quickly such harm can spread before any corrective action is taken.  

 This is why many experts argue that AI-powered image manipulation has crossed a line. It is no longer simply a content moderation issue. It is a matter of safety, dignity, and fundamental rights.  

Where Does Sri Lanka Stand?

This negligence is particularly dangerous for Sri Lanka. Our digital literacy is uneven and misinformation spreads rapidly through platforms like Facebook, TikTok, and WhatsApp. When AI-generated “nudified” images circulate, there is no embedded digital marker to prove they are fake, and to the average viewer they appear real. In a conservative society where reputation carries immense weight, such images can destroy lives and humiliate families before victims even know they exist.  

Sri Lanka’s Personal Data Protection Act, No. 9 of 2022, was designed to protect individuals from misuse of their personal data. A photograph of a person is personal data. When that image is altered to create sexually explicit or misleading content, it raises serious legal questions. When an algorithm in a foreign server twist that photo, who answers for it? Can our Online Safety Act catch an abuse generated instantly by a chatbot? These are not theoretical policy debates, they are urgent governance gaps.  

At present, these questions remain largely unanswered.  

This raises a critical question: can existing child protection laws and the Online Safety Act, which was specifically enacted to protect children and women from online harm, effectively address situations where abuse is not manually created, but generated instantly by a platform’s own AI in response to a simple user prompt? When platforms themselves become the engine of content creation, legal responsibility and accountability become increasingly unclear.  

If a schoolgirl’s photograph can be altered into explicit content by a stranger overseas, which law protects her? Which authority acts? How fast can justice move compared to viral spread?  

These are no longer theoretical policy debates.   

They are urgent governance gaps. Other nations are moving fast. India recently issued a stern notice giving xAI 72 hours to fix the issue or lose its “safe harbor” legal liability protections. This means if xAI did not comply, they could be sued for the content users post.  

We must ask: Where does Sri Lanka stand, and what about the safety and privacy of Sri Lankan users?  

 Our regulatory response needs to be just as sharp. We have two major pieces of legislation, but it is unclear if they can handle this specific threat.  

Open Access, Zero Guardrails

Even if stricter laws are introduced tomorrow, there is another uncomfortable truth. The technology is already out in the open. Many AI models that can perform similar image manipulation are freely available, can run on personal computers, and operate with no restrictions at all.  

This means enforcement alone will not be enough.  

Platform companies must take responsibility at the design level. If an AI system can realistically undress a real person on request, then the safeguards have already failed. Blaming users after the harm is done is not protection. It is damage control.  

Public statements about consequences ring hollow when senior figures openly joke about the results of these trends. Mixed signals from leadership undermine any claim of seriousness.  

What Needs to Happen Now in Sri Lanka

First, platforms operating in Sri Lanka must be held to clear standards, regardless of where they are headquartered. If a service is accessible here, it must respect local laws on data protection, child safety, and obscenity.  

Second, platform Trusted Partners (TPs), Civil Society organisations, and Media institutions must be proactive. This is not just a tech issue. It is a gender issue, a child rights issue, and a human dignity issue.  

Third, public awareness is critical. Parents, educators, and young people need to understand that a simple photo shared online can be weaponised. Privacy settings matter. Digital literacy is no longer optional.  

Finally, regulators must ask hard questions. Are current laws sufficient, people aware about those laws? Do authorities have the technical capacity to respond? And most importantly, are platforms being allowed to move faster than the protections meant to keep people safe?  

A Line Has Been Crossed

AI generated images can be funny, creative, and useful. But when it allows anyone to strip another person of dignity with a single line prompt, society must draw a line.  

For Sri Lanka, the warning is clear. Technology will not wait for us to catch up. If we do not act now, the cost will be borne by those already most vulnerable.  

The question is not whether AI can do this.  

 The question is whether we are willing to allow it.  

This is not “content creation.” It is a violation.