Class Action Adds Stability AI as a Defendant Over Alleged AI-Generated CSAM

Class Action Adds Stability AI as a Defendant Over Alleged AI-Generated CSAM

An amended complaint filed July 7, 2026 in a federal class action over AI-generated child sexual abuse material adds Stability AI as a defendant alongside xAI and brings the number of plaintiffs to five. The suit, pending in the Northern District of California, invokes Masha's Law, 18 U.S.C. sec. 2255. Every allegation described below is a claim in a complaint, not a proven fact.

Information last verified on August 5, 2026. This is a developing story; the allegations described are claims in a complaint and have not been proven in court. We update it as the record changes.

Jurisdiction scope: This case is pending in federal court in the Northern District of California and applies federal statutes plus California state-law claims. See our deepfake laws hub for how states and Congress regulate AI-generated intimate imagery generally.

What Happened

The case is captioned Doe 1 v. X.AI Corp., No. 5:26-cv-02246, pending before U.S. District Judge P. Casey Pitts in the U.S. District Court for the Northern District of California. It began in March 2026 when plaintiffs connected to Tennessee sued xAI, alleging its Grok tool generated sexually explicit images of minors from ordinary photos. RecordingLaw covered that original filing separately; see our background report on the initial xAI/Grok suit.

On July 7, 2026, the plaintiffs' attorneys, including the firm Lieff Cabraser Heimann & Bernstein, filed an amended complaint naming Stability AI as a co-defendant for the first time and adding two new pseudonymous plaintiffs, bringing the total to five. One new plaintiff, identified as Jane Doe 4 and connected to Wyoming, alleges a family member used Grok to generate more than 7,000 sexually explicit images of her from a single photo taken when she was 11. A second, identified as Jane Doe 5 and connected to Wisconsin, alleges that an adult relative of one of her classmates used a photo of her taken when she was 14 to generate the images. Both are unproven claims pleaded in the complaint; neither has been tested at trial.

The amended complaint alleges that Stability AI released its Stable Diffusion 1.0 model as an open-weight model despite allegedly knowing the training data included CSAM, and that the company has declined to change its guardrails since, allegedly enabling third-party "nudify" apps built on top of the open model. The complaint separately alleges that xAI failed to adequately report Grok-generated CSAM to NCMEC's CyberTipline, alleging that roughly 90 percent of xAI's reports were not actionable by law enforcement because the reports allegedly omitted user-identifying information. Neither company has been found liable; these remain contested claims in an active complaint.

The addition of Stability AI is what makes the amendment notable. xAI operates Grok, a proprietary hosted tool it runs and can update. Stability AI, by contrast, is alleged to be liable not for operating a service but for having released model weights that third parties then used or adapted. That framing places a model maker, rather than only a service operator, in the defendant's chair.

What the Law Actually Says

The amended complaint invokes 18 U.S.C. sec. 2255, the federal civil remedy for child-exploitation victims sometimes called Masha's Law. That statute lets a person who was a minor victim of specified federal child-exploitation offenses, including production or distribution of child pornography under 18 U.S.C. sec. 2251 and sec. 2252, sue for actual damages or liquidated damages of at least $150,000, plus attorney's fees and costs. A claim under sec. 2255 generally must be brought within ten years after the plaintiff turns 18, or within ten years after the plaintiff reasonably discovers the violation and the resulting injury, whichever is later. Establishing a sec. 2255 claim requires proving the underlying conduct meets the elements of one of the referenced criminal statutes; that has not been established in this case.

The complaint also invokes federal CSAM and trafficking statutes and California state-law claims, including product-liability and negligence theories aimed at the model makers rather than only the individuals who allegedly generated the images. That framing is what makes the amended complaint notable: it asks whether a company that builds and distributes an image-generation model can be held liable when someone else uses that model, or a derivative built from its released weights, to produce CSAM. No court in this case has ruled on that theory's merits.

Separately, federal law imposes mandatory reporting duties on electronic service providers. Under 18 U.S.C. sec. 2258A, a provider that obtains actual knowledge of apparent CSAM on its service must report it to NCMEC's CyberTipline as soon as reasonably possible. The amended complaint's allegation is not that xAI failed to report at all, but that many of its reports allegedly lacked the user-identifying information law enforcement needs to act on them. Whether that allegation is accurate, and whether it supports a legal claim, is for the court to decide.

For general background on how U.S. law treats AI-generated intimate imagery, including state deepfake statutes, see our deepfake laws hub. California's own deepfake statute is discussed on our California deepfake laws page; this case proceeds in federal court under federal claims plus California state-law claims, not under that state statute directly.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

Adding Stability AI raises a question not yet squarely tested against a model maker in this context: whether a company can be held liable for what a downstream user does with a model it released, particularly an open-weight model it does not directly operate after release. That differs from suing xAI over Grok, a proprietary, hosted tool xAI runs and can update. Once model weights are released publicly, as Stable Diffusion's were, the releasing company has limited ability to control how third parties fine-tune, strip guardrails from, or repackage the model into standalone apps.

That distinction is why the amendment has been described as testing new territory for generative AI liability. A hosted-model claim resembles product-liability theories courts already apply to software a company continues to operate. An open-weight claim asks a court to extend liability further upstream, to the release decision itself, without ongoing operational control over misuse. How a court will resolve that question here is not something we predict, and no ruling on either theory's merits has issued.

The reporting allegation is a second thread worth watching. Federal law already requires service providers to report apparent CSAM to NCMEC, but the complaint's theory is about the completeness of those reports, not their existence. If that distinction gains traction, it could matter for how any provider structures its CyberTipline submissions, though no court has adopted the theory here.

How This Affects You

This section describes general legal information, not advice for any individual situation.

Federal law provides a civil remedy, 18 U.S.C. sec. 2255, for people who were minors when victimized by conduct meeting the elements of specified federal child-exploitation offenses, including production of CSAM. It carries a $150,000 statutory-damages floor and generally must be brought within ten years of the victim turning 18, or within ten years of reasonably discovering the injury, whichever is later. Whether a particular set of facts qualifies is a legal determination that depends on the specific statute and evidence involved.

Anyone who has directly experienced AI-generated exploitative imagery, or is a parent or guardian of a minor who has, can report the material through NCMEC's CyberTipline (CyberTipline.org) and consult a licensed attorney about legal options. This case remains unresolved, including whether either defendant is found liable for anything. Readers should not treat any allegation described here as an established fact.

This is general legal information, not legal advice. This article describes federal litigation pending in California and general federal law; it is not a substitute for advice from a licensed attorney about any specific situation. Verified August 5, 2026. All allegations described are unproven claims in a complaint.

Related articles

• Deepfake laws in the United States: state-by-state overview
• Tennessee teens sue xAI over Grok-generated deepfake images (background)
• California deepfake laws
• DEFIANCE Act: a federal civil remedy for deepfake porn victims

---

Last updated: 2026-08-05. This is a developing story; details verified as of 2026-08-05.