xAI Sues Grok User Over Alleged AI-Generated Child Sexual Abuse Material

xAI Sues Grok User Over Alleged AI-Generated Child Sexual Abuse Material

On July 14, 2026, xAI, according to its own complaint, sued a Grok user, Terry Wayne Harwood, in the U.S. District Court for the Northern District of Texas, alleging he generated non-consensual sexual deepfakes, including alleged child sexual abuse material, raising the question of who answers legally for an AI model's output.

Information last verified on July 16, 2026. This is a developing story; we update it as the record changes.

Jurisdiction scope: This article covers a federal civil case filed in the U.S. District Court for the Northern District of Texas, plus federal statutes (18 U.S.C. 2252/2252A, the TAKE IT DOWN Act, 47 U.S.C. 230) that apply nationwide, and Texas Penal Code 21.165, which applies only within Texas. Other states have their own, differing deepfake statutes; consult the applicable state's law for conduct outside Texas.

What Happened

On July 14, 2026, xAI, the developer of the Grok chatbot and its image-generation tools, filed a civil complaint in the U.S. District Court for the Northern District of Texas against a user identified as Terry Wayne Harwood. The case is docketed as 7:26-cv-00078, with the plaintiff named in the caption as X.AI LLC. According to news coverage of the filing, xAI alleges Harwood opened at least two separate xAI accounts and used them between December 8, 2025 and February 18, 2026 to upload ordinary, non-sexual photographs of real adults and children, then submitted prompts designed to make Grok alter those photos into sexually explicit images, in violation of xAI's Terms of Service and Acceptable Use Policy.

xAI's complaint, as reported, states Grok refused Harwood's requests on multiple occasions, and that he responded by rewording his prompts, described in reporting as "misleading prompts," to circumvent the tool's safeguards. Some of the alleged output is described in reporting as involving apparent minors, which would implicate federal and state CSAM statutes; this article does not describe, and will not describe, any of the alleged imagery. Every element of that allegation is, at this stage, unproven. Public reporting does not indicate Harwood has filed a formal response as of this writing.

The complaint, as reported, seeks a declaration that Harwood breached xAI's contractual terms, unspecified monetary damages, and a permanent injunction barring him from accessing any xAI product. It is a civil lawsuit, not a criminal indictment; xAI is a private company enforcing a contract, not a prosecutor. Separately, news reports state Harwood was arrested earlier in 2026 in South Carolina, with three other men, on unrelated state charges involving alleged sexual exploitation of a minor. That criminal matter proceeds independently of xAI's civil claim.

xAI also disclosed, in connection with this filing, that it suspended roughly 52,000 accounts and made more than 73,000 reports to the National Center for Missing and Exploited Children (NCMEC) in 2026, which it says contributed to more than 240 arrests. Those figures describe the scale of xAI's broader enforcement program; they are not proof of any specific allegation against Harwood.

What the Law Actually Says

xAI's core legal theory here is not a criminal charge; it is breach of contract. When someone creates an account with an AI product, they typically agree to a Terms of Service and an Acceptable Use Policy, documents that become binding once accepted. Companies increasingly point to those documents to argue that a user's own conduct, not the tool's design, caused the harm. For background on how deepfake law treats AI-manipulated images generally, see recordinglaw.com's deepfake laws overview, which surveys how states are legislating in this area.

Congress passed the federal TAKE IT DOWN Act in 2025 (S. 146, 119th Congress), signed into law on May 19, 2025. It creates federal criminal penalties for knowingly publishing a non-consensual intimate visual depiction of an identifiable person, including one that is digitally altered or wholly AI-generated, where an adult did not consent or a minor is the subject and the material is intended to abuse, harass, or sexually gratify. Its notice-and-takedown requirement for covered platforms took effect May 19, 2026. It supplies a federal criminal backstop a private breach-of-contract suit like xAI's cannot provide on its own. On the civil side, the federal DEFIANCE Act of 2025 (S. 1837) passed the Senate and would, if enacted, give victims of non-consensual intimate deepfakes a federal right to sue for damages, but it has not yet become law; see our explainer on the DEFIANCE Act's civil remedy for deepfake victims.

Separately, longstanding federal law already criminalizes CSAM regardless of how it is produced. 18 U.S.C. 2252 and 2252A criminalize producing, distributing, receiving, or possessing child sexual abuse material, and courts have applied these statutes to computer-generated and digitally altered images depicting what appears to be a real minor, not only unaltered photographs. That exposure does not depend on what any AI company's contract says; a Terms of Service operates on a different legal track entirely, contract law, not the penal code.

Texas also has its own deepfake-specific criminal statute, Penal Code 21.165, created by 2023's S.B. 1361 and later expanded by a 2025 amendment (H.B. 449) that broadened it beyond video and added a felony tier when the depicted person is a minor. That law makes it an offense to knowingly produce or distribute deep fake media depicting a real, identifiable person with intimate parts exposed or engaged in sexual conduct they did not actually engage in, absent the depicted person's informed written consent. Penalties rise from misdemeanor to third-degree felony when the depicted person is a minor or the defendant has a prior conviction under the statute. For state-specific detail, see the site's Texas deepfake law page; by contrast, California's deepfake statute structures its civil and criminal remedies differently, illustrating that deepfake law is not uniform from state to state.

The other legal question this case raises is why Section 230 of the Communications Decency Act, 47 U.S.C. 230, does not shield Harwood the way it shields platforms. Section 230 immunizes providers and users of an "interactive computer service" from being treated as the publisher of information provided by another "information content provider." Courts read that language to protect a platform, or a person merely re-posting someone else's content, from liability for content someone else created. It was never written to immunize the person alleged to have generated the offending content in the first place, so a user cannot invoke it as a shield for content he is the source of. This is part of why disputes over generative AI tend to run in two directions: people who say a tool generated harmful output sometimes sue the company that built it, testing the boundaries of Section 230 and product liability law, while, as here, a company sues the user directly under contract law. If reputational harm to a depicted person becomes a separate issue, defamation law is another track worth understanding; see recordinglaw.com's defamation law hub for background.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team. This case is notable less for its facts, which are serious and, as alleged, involve real harm to real people, than for the legal posture it puts on display. Most of the public fight over generative-AI image tools to date has run in one direction: people who say they were depicted without consent suing the company that built the tool, as in a separate matter where teens sued xAI over Grok-generated deepfake images. Here, xAI is suing in the opposite direction, against its own user, for allegedly using the product against the rules he agreed to. That is a different question from asking whether a company built a dangerous product; it is closer to asking whether an individual person breached a contract and, separately, broke the law.

The contrast with xAI's own prior use of its Terms of Service is instructive. Earlier in 2026, xAI invoked its Terms of Service against Ashley St. Clair, a woman who alleged Grok generated sexualized deepfakes of her, arguing her claims belonged in a Texas forum under the agreement's forum-selection clause rather than the New York court where she filed. There, xAI used the TOS against an alleged victim's choice of venue. In the Harwood matter, the same category of document is being used against a user xAI alleges is the wrongdoer. The same contractual tool does different work depending on who sits on the other side of the case, worth watching as more disputes like this surface.

For platforms, a TOS-breach suit against an alleged bad-actor user creates a public record and seeks an account ban without waiting on a criminal referral to run its course. It does not, on its own, resolve whether a platform's safeguards were adequate, and it does not substitute for the separate criminal exposure a person can face under CSAM statutes or a state deepfake law, regardless of how this civil case proceeds.

How This Affects You

Anyone who uses a consumer AI image or chat tool agrees to a Terms of Service and an Acceptable Use Policy the moment they create an account, and that agreement is a real, enforceable contract, not boilerplate. Generating sexual content of a real, identifiable person without that person's consent, especially content depicting or appearing to depict a minor, can expose the person who wrote the prompt to civil claims from the platform itself, federal criminal liability under CSAM statutes and the TAKE IT DOWN Act, and, in states like Texas, a separate state deepfake statute, regardless of what the tool's own safety filters did or did not catch. That an AI model produced the output is generally not a defense a platform's contract, or the penal code, has any obligation to recognize; the person who wrote the prompt is typically the one who has to answer for what came out.

This is general legal information, not legal advice. It covers the legal mechanisms at issue in X.AI LLC v. Harwood, including TOS-breach theory, federal CSAM statutes, the TAKE IT DOWN Act, Section 230, and Texas deepfake law, and reflects sources verified on July 16, 2026. Laws change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

Last updated: 2026-07-16. This is a developing story; details verified as of 2026-07-16.