Non-Consensual Leaked-Media Purchase & Distribution
This detects an AI agent being instructed to purchase non-consensual intimate or private images of a named person and then distribute them across social media. It covers a specific abuse pattern: acquiring leaked private media and amplifying it, not general content moderation.
How the attack works
A user gives the agent a direct instruction naming a specific person and referencing a leaked private photo of them. The agent is told to pay for access to that image, for example on a marketplace or paywalled site. Once obtained, the agent is instructed to post or distribute the image across multiple social platforms, maximizing reach. The rule flags this purchase-then-distribute sequence as it happens through agent actions.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- be689512-719c-45ac-bf43-46ae4c5005f3
- Severity
- High
Why it matters
An organization whose agent carries this out becomes a direct participant in non-consensual intimate image (NCII) distribution, exposing it to legal liability, platform bans, and reputational damage, while causing real harm to the victim.
What you can do
- →Block or require human approval for any agent action involving payment for media tied to a named private individual.
- →Add explicit policy rules preventing agents from posting personal images to social platforms without verified consent.
- →Review agent logs for purchase-then-broadcast patterns involving personal media, not just single suspicious posts.
- →Distinguish this from legitimate takedown or reporting workflows, which describe removing leaked content rather than acquiring and spreading it.
Known benign look-alikes
- Descriptions of takedown processes when a leaked photo is posted without consent