AI image generator GenNomis exposed prompts and generated images
What happened
Researcher Jeremiah Fowler found an unprotected database belonging to South Korean AI image service GenNomis holding about 93,500 generated images and the prompts used to create them, including explicit deepfakes. Public access was restricted after he reported it.
GenNomis, run by South Korean company AI-NOMIS, offers AI image generation and face-swapping. Researcher Jeremiah Fowler found a database with no password or encryption holding about 47.8 GB of data: more than 93,000 generated images and the text prompts behind them. Many were explicit, including face-swapped images of real people such as celebrities, and some appeared to depict minors, which the service's own rules prohibited. The exposure showed how such tools can be used to create non-consensual and illegal imagery.
How it happened
Leaky AI product: Exposed datastore. A database, storage bucket or server behind an AI product was left open on the internet without a password.
Sources do not say whose AI model was involved. The product was GenNomis, a type of AI-powered app.
Impact
Data was exposed. Data involved: chat logs. The impact was confined to one organization and its users or customers. Sources give a figure of 93,485.
Severity is rated Medium, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It became public on 31 Mar 2025.
After Fowler sent a disclosure notice, the database was secured and the GenNomis and AI-NOMIS websites went offline. The company did not respond publicly.