InfoSecBulletin Cybersecurity for mankind
Cybersecurity researcher Jeremiah Fowler discovered a data leak in an AI image generator tool and informed ExpressVPN. The exposed database was unprotected and held over a million images and videos (1,099,985 records).
Jeremiah Fowler stated that during the investigation, most of the documents he reviewed were pornographic images, including AI-generated or manipulated images of young individuals. These included face-swapped pictures of adults and minors on AI-created bodies. More troubling was the presence of unaltered real images of individuals, likely uploaded without their consent.
Claude, DeepSeek, and Qwen AI agents combinedly used to hit gov.t across Asia
India: C-DOT Launches 14 Local Quantum-Safe Technologies
14,000 Dahua cameras compromised: TP-Link flaws enable RCE
Microsoft Reveals Project Zenith Windows PCs Able to Run 30B+ AI Models Locally
Google issues warning of new Chrome zero-day flaw exploited
CrowdStrike’s ‘FalconFlank’ zero-day allows SYSTEM privileges
727,000 data exposes: French hospital fined €500,000
153 Million Driver’s License Surfaced on Dark Web: FBI Starts Investigation
Google Unveils Gemini 3.8 Flash Cyber to Identify and Auto-Patch Security Flaws
SonicWall SMA1000 SSRF Hits 10, Exploiting CVE-2026-83548
The database and its watermarked images were linked to a Silicon Valley company called SocialBook, which provides services for influencers and marketers, including AI tools for image and content generation.
During a review of SocialBook’s AI image-generation tool, it was found that it was linked to MagicEdit.app. This tool is available on the Apple App Store, credited to BoostInsider Inc., with support linked to socialbook.io and a copyright by “SOCIALBOOK.” While ownership details are unclear, MagicEdit seems connected to SocialBook, and BoostInsider might be a parent company or related developer. BoostInsider’s LinkedIn page lists offices in California, Beijing, Chengdu, and Shenzhen.
Jeremiah Fowler informed SocialBook and MagicEdit about a security issue, leading to the database being restricted from public access. He received a reply stating “Thank you for this responsible disclosure. We take this extremely seriously and we are conducting a full investigation into the scope of the exposure”.
MagicEdit is an AI-based image generation tool that allows users to turn text or pictures into various images, including adult content and face-swaps. The App Store notes that it’s for users over 18 and warns of potential sexual content or nudity.
Jeremiah Fowler suggests making social media profiles private to protect personal images from AI misuse, allowing only friends and family to view them. He also advises disabling public access to profile pictures and albums and regularly checking followers to limit who can see your content.
Laws now exist to help individuals facing sextortion or harassment by allowing the removal of nonconsensual images. In the U.S., The Take It Down Act (S.146), signed on May 19, 2025, criminalizes the publication or threat of nonconsensual intimate images, including AI-generated “deepfakes.”
