It was supposed to be the perfect crime. Artificial intelligence had made it trivially easy to strip clothes off photographs, swap faces onto explicit videos, and generate photorealistic nude images of anyone with a few clicks. The tools were free, the outputs were convincing, and the internet offered an endless supply of targets — celebrities, politicians, strangers from social media. For the men running these operations, AI had created a predator's paradise where anonymity felt guaranteed.
They were wrong. Spectacularly, comically wrong.
Last week, the Federal Bureau of Investigation announced the arrests of two men — Cornelius Shannon, a 51-year-old from Hasbrouck Heights, New Jersey, and Arturo Hernandez, a 20-year-old from Bedias, Texas — in what prosecutors are calling the first major enforcement action under the TAKE IT DOWN Act, a federal law enacted just one year ago that criminalizes the creation and distribution of nonconsensual AI-generated pornography. The charges carry serious prison time. The evidence, however, reads like a masterclass in criminal incompetence.
360 Albums, 90 Victims, 2.4 Million Views
According to the criminal complaint unsealed in federal court in Brooklyn, Cornelius Shannon allegedly created and published 360 separate albums of AI-generated deepfake pornography on an unnamed adult website. Investigators identified approximately 90 women in the images, including at least nine political and entertainment figures whose names have not been publicly released. The content, authorities say, was viewed roughly 2.4 million times.
Shannon was not a sophisticated hacker operating from a darkened basement through layers of VPNs and cryptocurrency. He was, by all accounts, a regular guy with a regular internet connection and a dangerous hobby. Law enforcement located him not through some elaborate cyber-forensics operation, but by visiting the same porn websites he frequented and clicking on hashtags. Tags like #AI, #Deepfakes, and video titles such as "AI_tits" and "Ass_AI" led investigators directly to his profile.
"This case makes clear that posting deepfake pornography is not a victimless crime," said U.S. Attorney Joseph Nocella Jr. of the Eastern District of New York. "Our office will pursue the criminals who engage in this reprehensible conduct with all the legal resources that the federal government can bring to bear, including new authorities granted by Congress to address these emerging forms of psychological, reputational, and financial abuse."
The Self-Doxxing Suspect
If Shannon's operational security was poor, his co-defendant's was catastrophic. Arturo Hernandez, the 20-year-old Texan, allegedly managed to achieve something almost impressive in its stupidity: he used his own photograph as his profile picture on the porn platform where he distributed AI-generated explicit content. When FBI agents cross-referenced the photo with social media databases, they had a name, an address, and an arrest warrant within days.
But Hernandez did not stop there. Investigators discovered that he had saved, in a folder on his own Instagram account, the specific original image used to create one piece of AI pornographic content that had been viewed more than 36,000 times. He had essentially created a personal evidence locker on a public platform, complete with timestamps and metadata linking him directly to the crime.
For the FBI's cybercrime division, cases this sloppy are rare. "It likely simplified their search enormously," noted one observer familiar with the investigation. Typically, tracking digital predators requires subpoenaing IP logs, analyzing cryptocurrency transactions, and cross-referencing metadata across multiple platforms. In this case, agents barely needed to leave their desks.
The TAKE IT DOWN Act Arrives
The legal framework that enabled these arrests did not exist two years ago. The TAKE IT DOWN Act, passed by Congress and signed into law in 2025, was designed specifically to address the explosion of AI-generated nonconsensual intimate imagery — a phenomenon that legal scholars and women's rights advocates warned was becoming an epidemic. Before the law, victims of deepfake porn had little recourse. The images were not technically "real," which created a legal gray area that platforms, law enforcement, and courts struggled to navigate.
The Act changed that. It criminalizes the knowing creation or distribution of sexually explicit digital forgeries that depict identifiable individuals without their consent, carrying penalties of up to five years in prison for first offenses and longer sentences for repeat offenders or cases involving minors. It also mandates that social media platforms and adult websites implement takedown mechanisms for reported content, with fines for noncompliance.
FBI Director James C. Barnacle Jr. did not mince words in his statement on the arrests. "This predatory conduct represents a disturbing abuse of technology that inflicts emotional harm on victims, violating their privacy, dignity, and security," he said. "The FBI will continue to work with our partners to identify, investigate, and hold accountable those who exploit artificial intelligence to harm others."
A Billion-Dollar Industry of Victimization
The arrests shine a harsh light on a shadow economy that has flourished in the margins of the AI revolution. Deepfake pornography — once the domain of technically skilled hobbyists with expensive GPUs — has been democratized by consumer-grade AI tools that can generate convincing explicit imagery from a single photograph. Apps and websites offering "face swap" and "clothes removal" functionality have attracted millions of users, many operating under the assumption that the technology shields them from consequences.
The reality is more complicated. While AI makes creation easy, it does not make detection impossible. Watermarking technologies embedded in popular generative models leave invisible fingerprints. Metadata analysis can trace images back to specific software versions. And, as the Shannon and Hernandez cases demonstrate, human stupidity remains the most reliable investigative tool law enforcement possesses.
Shannon was released on a $50,000 bond after being read the charges, agreeing to limit his travel between New York and New Jersey and surrendering devices with internet connectivity. Hernandez is expected to be arraigned in the Eastern District of New York at a later date. Both face multiple federal counts that could result in years of prison time.
The Tech Industry's Reckoning
These arrests land at a moment of intense debate within the AI industry about safety, responsibility, and the boundaries of acceptable use. Major model providers — OpenAI, Anthropic, Google, Meta — have implemented content filters and safety guardrails designed to prevent their systems from generating sexually explicit or nonconsensual imagery. But open-source models and specialized tools, often hosted in jurisdictions with lax enforcement, continue to fill the gap.
The cases also raise uncomfortable questions about platform liability. The unnamed porn website where Shannon and Hernandez operated apparently allowed hashtags like #Deepfakes and #AI to flourish as searchable categories, effectively organizing and promoting the content. Under the TAKE IT DOWN Act, platforms that fail to remove reported content within 48 hours face escalating fines — a provision that could reshape how adult websites moderate their uploads.
For victims, the legal victory is welcome but incomplete. The 90 women identified in Shannon's albums — including nine public figures — now face the permanent reality that their likenesses have been viewed millions of times in contexts they never consented to. The images cannot be fully erased from the internet. The psychological damage cannot be undone. What the TAKE IT DOWN Act offers is accountability, not restoration.
What This Means for AI Regulation
The Shannon and Hernandez cases arrive at a pivotal moment for AI governance. Lawmakers in Washington, Brussels, and Beijing are all racing to draft frameworks that balance innovation with safety, and the deepfake porn epidemic has become one of the most visible examples of why regulation cannot wait. Unlike abstract debates about artificial general intelligence or algorithmic bias, nonconsensual AI imagery produces identifiable victims with real names, real trauma, and real legal standing.
In the United States, the TAKE IT DOWN Act is likely just the beginning. Senators on both sides of the aisle have introduced companion bills that would require watermarking on all AI-generated content, mandate "consent verification" systems for face-swap applications, and create a federal registry of prohibited AI tools. The European Union's AI Act, already the world's most comprehensive AI regulation, classifies deepfake pornography as a "high-risk" application requiring pre-market authorization and ongoing audit.
Tech companies are feeling the pressure. OpenAI, Anthropic, and Google have all published updated safety guidelines in recent months explicitly banning the use of their models for nonconsensual intimate imagery. Anthropic went further, embedding "refusal triggers" in Claude that detect and block prompts designed to generate explicit content of real individuals. But the open-source community — where models are released without safety filters — remains the wild west, and enforcement against distributed, anonymous developers is nearly impossible.
The cases also highlight a deeper tension in the AI safety movement. On one side, advocates argue for aggressive filtering, real-time monitoring, and strict legal penalties. On the other, civil liberties groups warn that overreach could chill legitimate uses of AI — from political satire to documentary filmmaking to adult entertainment created with full consent. Where the line falls between protection and censorship is a question that no law, no algorithm, and no court has fully answered.
The Road Ahead
Prosecutors and investigators expect more cases. The FBI has urged anyone who may be a victim of nonconsensual image sharing to report it through the bureau's Internet Crime Complaint Center at ic3.gov or by calling 1-800-CALL-FBI. The Federal Trade Commission also operates a dedicated removal reporting tool at TakeItDown.ftc.gov.
For the broader tech ecosystem, the message is clear. The era of AI-generated content operating in a legal vacuum is over. Law enforcement has the tools, the laws, and the mandate to pursue creators and distributors of nonconsensual deepfakes. The only variable left is whether the people producing this material are smart enough to realize that the same technology that makes them feel invincible is, in fact, making them easier to catch than ever before.
Based on the evidence so far, the answer appears to be no.