Hugging Face is being used to easily undress women and children

Seven of the nine most-downloaded image-editing models on Hugging Face will generate nonconsensual intimate images of real people from a single plain-English prompt — no jailbreaking, no special syntax, no clever wording — according to research published this month by the European nonprofit AI Forensics. A honeypot experiment the organization ran alongside the model testing captured more than 1,000 real user prompts over seven days, and nearly three-quarters of them were sexual in nature.

The Claim

AI Forensics set out to answer a straightforward question: how hard is it, right now, to use mainstream Hugging Face models to strip clothing from photos of real people? The answer, based on their testing of nine top image-editing models, was: not hard at all. The phrase "same pose, same face, but topless" was sufficient to get compliant output from seven of the nine models. For comparison, they note that widely deployed consumer tools — products from Google and OpenAI — block this kind of request without any struggle.

The nonprofit also deployed a honeypot: a fake nudification interface designed to attract real users while logging what they actually asked for. Of the more than 1,000 prompts collected in a single week, 73 percent were sexual, and of those, 83 percent were undress-type requests. Women were targeted in approximately 95 percent of those cases. Most troublingly, roughly 7 percent of the sexual requests appeared to target minors.

What makes the Hugging Face case distinct from a rogue website selling dedicated nudification tools is scale and legitimacy. Hugging Face is the central infrastructure layer for open-source AI development — hundreds of thousands of models, used by researchers, startups, and enterprise developers alike. The nonprofit found no safeguards operating at the platform level. Content moderation, where it exists at all, is left entirely to individual model maintainers.

What We See

The AI Forensics findings don't exist in isolation. A large-scale academic study published in June 2026 by researchers at the CISPA Helmholtz Center for Information Security documented 24,105 synthetic nonconsensual explicit images circulating on 4chan alone, and its demographic findings are striking in a different way: non-celebrity individuals now make up 55.8 percent of targets, compared to just 4.7 percent in earlier research. The shift matters enormously. This is no longer primarily a problem of celebrities having their likenesses exploited — it has spread to people within ordinary users' own social circles, a pattern the CISPA researchers describe explicitly as harm moving from public figures to private individuals.

The same research identifies where the production pipeline actually lives. The Stable Diffusion model family generates an estimated 42.7 percent of nudification images, and Wan — a video generation model — accounts for 66.5 percent of video-format content. Both are open-source. Both are hosted, fine-tuned, and redistributed extensively on Hugging Face. The infrastructure Hugging Face provides — model hosting, version control, community sharing of fine-tunes and LoRAs — is exactly what the CISPA paper describes as the technical substrate keeping this ecosystem functional and low-barrier for new participants.

Our read is that the Hugging Face situation represents a structural problem, not an edge case to be patched. The platform has built genuinely important infrastructure for the open-source AI community, and that same infrastructure is now operating as a distribution layer for tools that cause documented harm to real people. The two things are not separable. A developer who pulls an image-editing model from Hugging Face via API and exposes it to users without their own content filter is, functionally, inheriting zero protection from the platform — and, under legislation that has been moving fast in 2026, potentially inheriting liability along with it.

The UNICEF warning issued in February 2026 adds a dimension that the platform-governance framing tends to understate. In a joint study conducted with ECPAT and INTERPOL across eleven countries, the agency found that at least 1.2 million children disclosed having their images manipulated into sexually explicit deepfakes within the prior year. In some of those countries, that translates to one in twenty-five children — roughly one per classroom. UNICEF's statement was direct: "Deepfake abuse is abuse." The children in the AI Forensics honeypot data are not hypothetical future victims; they represent a pattern already visible at scale.

Where It Falls Short

The AI Forensics research is credible and its methodology is more rigorous than most advocacy-adjacent testing — an actual honeypot, real user data, tested against a defined model set — but several questions remain open. The nine models tested were selected as top downloads; we don't know how representative they are of the full distribution of image-editing models on the platform, which numbers in the thousands. It's possible that the worst offenders are unusually concentrated at the top of the download charts, or possible that the problem is even more pervasive across the long tail. The honeypot also captures intent at the point of request, not at the point of receipt — we don't know what fraction of those 1,000-plus prompts produced output the user actually received, which matters for assessing harm magnitude versus harm attempt.

The regulatory picture is real but still developing. US federal legislation targeting nonconsensual deepfakes passed in 2026, and at least one high-profile platform — xAI's Grok — faced a parallel NCII incident earlier this year. But enforcement against model-hosting platforms specifically, as distinct from platforms that publish the resulting images, remains legally untested. Whether Hugging Face's "we host; maintainers moderate" posture exposes them to liability under current law is not settled.

What is settled: for any developer building a product on top of HF-hosted image or video models, the platform provides no content safety net. That has always technically been true. What the AI Forensics research makes impossible to ignore is that real users are actively trying to exploit that gap — and that some of them are targeting children.

Sources