400 Hidden AI Apps Expose a Major Child Safety Failure

Hidden AI deepfake apps have exposed a serious weakness in the systems families are repeatedly told will keep children safe. An investigation published by WIRED on 2 November 2026 uncovered a network of more than 400 connected apps and internet domains. Many appeared to offer ordinary AI features, such as pet portraits, language lessons or fitness advice. However, some could secretly expose tools for generating sexually abusive images and videos using photographs of real people.

The investigation raises a fundamental question for Apple, Google and Meta. If their app stores, advertising policies and review systems prohibit this abuse, how did the network reach so many people? Crucially, a child can become the target of a fabricated intimate image without ever downloading the app that produced it.

More than 400 connected apps and domains

Researchers from AI Forensics and security company Infoblox examined code, domains and advertising linked to the network. WIRED reported that 27 associated applications were available on Google Play in September 2026, with more than 350,000 downloads between them. Those download figures refer to identified Google Play apps, not every domain in the wider network. The investigation also described advertisements on Facebook and Instagram directing users to the tools.

The reported material was particularly disturbing. Some applications offered templates that could place a photographed person into violent or sexually explicit scenes without consent. Earlier reporting linked to the advertising investigation identified AI generated child sexual abuse material, including manipulated images of real children. CODA will not reproduce the images or direct readers to the offending applications.

Harmless AI apps concealed abusive features

According to WIRED, some apps displayed ordinary content when first opened, while a server determined whether a different interface would appear. Signals could include how the person arrived at the application, their language and identifiers associated with the device or session. Researchers said that arriving from a particular advertisement appeared to be one possible trigger. As a result, an app reviewer and an ordinary user could see very different experiences.

This matters because approval at the point of publication is not the same as continuous safety monitoring. Developers can change content fetched from remote websites after the initial review. Consequently, app stores must consider what applications can load later, not just what reviewers saw during approval. The issue is not that all ordinary AI tools are dangerous, but that seemingly harmless branding can disguise serious abuse.

Three layers of protection came under pressure

1. Apple and Google app stores

Both companies prohibit applications promoting nonconsensual sexual imagery. Nevertheless, WIRED found associated apps in their stores, sometimes carrying age ratings suitable for children. Apple told the publication that the affected apps had complied during review, but their developers later changed the remote content. Apple removed 19 apps after WIRED raised its findings and said it had strengthened its rules against such tactics.

2. Facebook and Instagram advertising

The network was promoted through advertisements on Meta platforms, giving abusive services a route to users. Meta told WIRED it had taken action against thousands of associated advertising accounts, business pages and user accounts, and blocked 209 apps from advertising. Those enforcement figures show the scale of the response, but they also raise difficult questions about how the advertisements were approved and why similar activity continued. Preventing repeat abuse requires identifying linked operators, not merely removing individual advertisements.

3. Payments and commercial incentives

Some of the services sold credits to generate images and accepted payments through mainstream payment infrastructure. This is not simply a problem of harmful content appearing online. It is also a commercial model in which abusive functionality can be advertised, distributed and monetised. Payment providers and platforms should be able to explain how they identify repeat operators and respond to credible evidence of abuse.

You don’t need the app to become a victim

A photograph taken at a school event, shared in a group chat or posted to a public account can potentially be misused by someone else. Artificial intelligence can fabricate intimate content that looks as though it depicts the child, even though no such event occurred. The image may then be circulated among classmates, used to humiliate the child or deployed as part of coercion and sextortion. The harm can be profound even when the image is entirely synthetic.

Importantly, this is not a question of blaming children or parents for sharing photographs. Responsibility for creating and distributing abusive material remains with those committing the abuse. Nevertheless, families and schools need clear guidance on privacy, image consent, early reporting and supportive responses when an incident occurs. Adults must understand that a fabricated image can still be a serious child protection matter.

This problem has already reached Ireland

The WIRED findings should not be dismissed as a distant technology story. In January 2026, The Journal reported advertisements for at least 16 nudification apps visible to Irish users. Some linked to Apple and Google app listings that appeared suitable for young users. That investigation found services capable of producing nonconsensual sexual imagery involving women and children.

CODA previously examined how nudify apps bypassed parental control expectations and how ordinary photographs were misused in face swap abuse. The new investigation strengthens a recurring concern. Families are encouraged to rely on controls and age ratings, yet these measures cannot stop someone elsewhere from creating an abusive image of their child. The platforms themselves must prevent abusive tools from reaching users.

What do Irish and European laws mean?

In Ireland, the Harassment, Harmful Communications and Related Offences Act 2020, often called Coco’s Law, provides important protections concerning the nonconsensual distribution of intimate images. However, the legal position depends on the particular conduct, image and circumstances, and the law should not be presented as a complete solution to every AI generated abuse scenario. Child sexual abuse material can also engage separate criminal offences. Victims should not be expected to determine the correct legal classification before seeking help.

At European level, the Digital Services Act imposes duties on online platforms concerning illegal content, transparency and systemic risks, depending on the service. In addition, EU Regulation 2026/1744 added targeted AI Act prohibitions relating to nonconsensual intimate material and child sexual abuse material. Although the amending regulation has entered into force, these new Article 5 prohibitions are scheduled to apply from 2 December 2026. We must distinguish a legal rule already adopted from one whose application date has not yet arrived.

What parents, schools and young people can do

No setting can guarantee that another person will not misuse a photograph. However, families can reduce unnecessary exposure and prepare children to respond safely. Schools should also ensure that image based abuse and synthetic content are explicitly addressed in safeguarding and online behaviour policies. These measures support children, but they do not remove the obligations of technology companies.

• Review who can see children’s photographs and avoid publishing unnecessary identifying information.
• Discuss consent and explain that a digitally fabricated intimate image is not harmless simply because it is fake.
• If an image is circulated, do not forward it or ask others to send copies, especially when it may depict a child.
• Preserve nonexplicit evidence such as URLs, usernames and messages where safe to do so, and seek guidance before handling suspected child sexual abuse material.
• Report the content to the platform and contact the Irish Internet Hotline for support with intimate image abuse. Contact An Garda Síochána where threats, exploitation or suspected criminal offences are involved.

The real test is whether protections work

Apple, Google and Meta have reported substantial action against this network. Their responses matter, and deliberately deceptive developers bear responsibility for their conduct. Nevertheless, repeated removals after harm is identified are not equivalent to preventing abusive services from operating. Independent testing, ongoing monitoring and meaningful regulatory scrutiny are needed to establish whether safeguards function in practice.

CODA’s position is clear. Parents should stay involved in their children’s digital lives and use available safety settings, but they cannot be expected to compensate for weaknesses in the platforms that distribute and profit from these technologies. Protecting children online requires effective prevention, accessible reporting, timely removal and accountability across the entire technology ecosystem.

References

• WIRED, Hundreds of Mundane AI Apps Are Hiding Sexually Abusive Deepfake Features (2 November 2026)
• The Journal, Multiple apps encouraging Irish users to swap women’s faces onto pornographic images and videos (January 2026)
• EUR-Lex, Regulation (EU) 2026/1744
• European Commission, Article 5 of the EU AI Act
• Irish Internet Hotline, Intimate image abuse

Further reading from CODA

• Teens Can Still Access Nudify Apps Despite Apple and Google Parental Controls
• TikTok Face-Swap Craze Turns Ordinary Photos into Deepfake Image Abuse
• Child Safety Features Failed Independent Tests

About Children of the Digital Age

Children of the Digital Age provides online safety education and training for schools, parents and organisations. Our guides support practical conversations about online behaviour and the choices people make. However, education and app settings do not replace safeguarding or professional support.

Send a message

Contact Children of the Digital Age to enquire about online safety education, parent sessions or training for your school or organisation.