When Safeguards Fail: Testing Grok’s AI Controls on X

Using proprietary intelligence collection methods, Alice analyzed a sample of 95 pieces of violative content — including the sexualization of minors and non-consensual intimate imagery (NCII) — sourced from threat actor activity across X and adjacent platforms. Alice did not generate this content; all material was identified through monitoring of real-world abuse activity. The findings show that NCII and child sexualization content continues to be generated and distributed via Grok months after X declared its safeguards active, with removal rates falling well below the platform’s stated zero-tolerance commitments.

Introduction

On January 15, 2026, X’s official safety account announced that it had implemented significant new technical safeguards to prevent Grok, its AI system, from generating non-consensual nudity and child sexual exploitation material. The statement was unambiguous: these restrictions would apply to all users, including paid subscribers, and X had conducted proactive sweeps to remove violative content already on the platform.

This announcement followed growing public scrutiny around Grok’s ability to generate and manipulate image-based content, including the sexualization and nudification of real individuals and minors. As generative AI systems become increasingly embedded within large-scale social platforms, these capabilities introduce a new category of risk, where harmful content can be produced, modified, and distributed within the same ecosystem. The January 15 announcement was X’s answer to that pressure.

We decided to test it.

Following the announcement, Alice conducted an independent investigation to assess whether the newly introduced safeguards translated into meaningful outcomes in practice. What we found raises serious questions, not just about X’s enforcement, but about the broader challenge of implementing effective AI safety controls within large-scale social platforms.

The Intelligence: What We Found

Enforcement Gaps Following Safeguard Deployment

The numbers tell the story plainly. To assess the effectiveness of X’s updated safeguards, Alice re-examined a previously identified sample of violative content surfaced prior to the January 15 policy announcement, spanning confirmed cases of minor sexualization and adult NCII generated or distributed through Grok.

Alice’s independent verification found that of CSAM cases Alice had previously identified prior to January 15, 83.3% remained active on the platform at the time of re-examination.

Of the adult NCII cases previously documented, 94.1% of the adult NCII sample was still accessible, untouched by X’s stated proactive sweeps. The gap between what was promised and what was observed is not marginal, it is the dominant finding.

Continued Generation of Violative Content Post-Safeguards

The enforcement gap was only part of the picture. In parallel, Alice conducted additional collection following the January 15 rollout to assess whether new controls prevented further abuse. They did not, at least not consistently.

Despite the introduction of technical restrictions, new instances of violative content continued to be identified, including both adult NCII and minor sexualization, spanning confirmed cases as well as high-risk edge cases involving youth-coded individuals. In total, Alice analyzed 20 additional instances of CSAM and 45 instances of adult NCII generated and distributed by Grok after xAI’s proactive platform sweeps. Notably, some of these cases were generated after January 15, with instances documented as recently as April 2026, meaning the content was produced after the safeguards were purportedly in place.

Premium Access as a Partial Control — Not a Safety Mechanism

X introduced access restrictions limiting image generation to paid subscribers, framing this as an additional accountability layer. In practice, it functions differently.

Alice identified multiple instances of violative content generated through premium accounts after the safeguard rollout. More significantly, in several cases where a non-premium user submitted a high-risk prompt, Grok did not issue a refusal or a safety warning. Instead, it responded by informing the user that image generation was a premium feature, and provided a link to subscribe.

That distinction is critical.

A system that redirects potentially harmful intent toward a paywall is not blocking the behavior, it is monetizing the pathway to it.

Model Behavior and Edge Case Risk

Beyond explicit violations, analysis also identified risks in how the model handles ambiguous or contextually complex prompts. In several instances, Grok generated sexualized outputs in response to prompts that were not overtly explicit, including clothing modifications or removal involving real individuals. Additionally, repeated interactions within comment threads demonstrated how outputs could become progressively more sexualized through iterative prompting.

These patterns highlight challenges in the model’s ability to consistently identify and block high-risk content, particularly in cases involving:

• Non-explicit prompts with implicit intent
• Youth-coded subjects where age is not explicitly confirmed
• Contextual or stylized requests that mask harmful outcomes

Adversarial Adaptation and Safeguard Probing

Alice also observed active user behavior aimed at testing and mapping Grok’s new boundaries. Across X and external forums, users were seen probing the AI directly to identify gaps in its refusal logic, sharing successful prompt strategies with others to circumvent restrictions, and documenting successful methods for generating restricted content to bypass filters.

This behavior is not incidental. It reflects a community actively adapting to newly introduced controls, iterating in near real-time, and distributing knowledge of what works.

What This Means

Grok is not just generating content, it is transforming existing inputs and amplifying harmful ecosystems.

The findings above point to a fundamental challenge that extends beyond X. It highlights a broader challenge in the implementation of safety controls for generative AI systems integrated into social platforms. When safety controls are designed as fixed, rule-based interventions, they can be mapped and exploited. The January 15 safeguards appear to function as a static layer applied to a dynamic, adversarial environment, and the results reflect that mismatch.

Several patterns are worth highlighting for platforms and trust and safety practitioners more broadly.

1. Access-based restrictions do not eliminate risk, they reshape it. Limiting generation to paid users introduces friction, but as our findings show, that friction does not prevent harmful outcomes when the underlying model still responds to high-risk prompts with redirects rather than refusals.Edge cases carry disproportionate risk. A significant portion of the violative content identified did not involve explicitly prohibited prompts. It involved youth-coded subjects, indirect framing, and cumulative escalation; scenarios that binary or keyword-based classification approaches are structurally poor at catching.
2. Once content exists, it persists and spreads. Grok-generated imagery was redistributed manually by users into comment threads where the bot had declined new requests. Videos generated through Grok’s photo-to-video features depicted subjects in sexualized scenarios and were shared independently of the original generation event. The content lifecycle does not end at creation.

Taken together, these patterns suggest that safeguards designed as isolated interventions are insufficient in environments where user behavior, model capabilities, and platform dynamics are all continuously evolving.

The Intelligence Advantage

What distinguishes the environments where AI misuse scales is not just the content itself, it is the behavioral layer surrounding it: how users probe and adapt to systems, how outputs migrate across platforms, and how harmful patterns emerge through signals that are individually ambiguous but collectively significant.

The findings from this analysis point to a broader shift in how abuse manifests. Rather than originating solely within a single platform, harmful behaviors are increasingly composed across multiple layers, combining AI-generated content, user interactions, and off-platform ecosystems where techniques are shared and refined. This includes the use of circumvention strategies, iterative prompting, and migration to external platforms to bypass safeguards.

Identifying these risks early requires continuous cross-surface monitoring, the ability to interpret high-risk edge cases before they reach explicit violation thresholds, and intelligence frameworks that evolve alongside the behaviors they track. Static detection approaches, however well-designed, are outpaced in environments where adversarial adaptation is both fast and distributed. As AI systems continue to evolve, so too must the intelligence frameworks used to understand and mitigate their misuse.

Understanding these dynamics is critical for any platform operating in AI-enabled environments, where risk does not always present itself through explicit violations, but emerges through patterns, edge cases, and cross-platform activity.

If your platform is facing similar challenges, Alice’s intelligence experts can help identify emerging abuse patterns, assess risk exposure, and develop proactive mitigation strategies. Learn more about our Intelligence offering or speak with an expert.