Grok (xAI) and Internet Crime Investigations

Grok is the AI assistant developed by xAI and built into X. xAI reports apparent child sexual abuse material to NCMEC, as federal law requires, and has become one of the larger sources of those reports. Recent cases show Grok tips leading to search warrants and arrests. This page gives general background on Grok and how investigations involving it often happen.

Background and History of Grok

Elon Musk founded xAI in 2023, and Grok was released that November. xAI later combined with X, and in 2026 the combined business became part of SpaceX, according to public filings and reporting. Grok is available inside X, in stand-alone apps, and on the web. Some xAI legal pages now appear under the SpaceX name. See also the X (Twitter) page.

Grok Features and Services

Grok answers questions, searches X posts and the web, and generates images and video through features that xAI has marketed under the “Grok Imagine” name. Users can use Grok without a separate account through X, or through a separate xAI or Grok account.

How People Use Grok

Grok is used legitimately by a large number of people to get quick answers, follow real-time news and conversations on X, summarize information, write, code, and create images. Its connection to X lets users ask about current events as they unfold. Developers and businesses can build Grok into their own products through xAI’s API, and through xAI for Government, xAI offers Grok to federal, state, local, and national security customers to help make government services faster and more efficient. For many people, Grok is a fast, everyday tool for information and creativity.

How Many People Use Grok?

A 2026 SpaceX securities filing put monthly active users across X and Grok combined at about 550 million as of March 2026, with about 117 million using Grok features. In a 2026 court filing, xAI said that more than 2.6 million xAI accounts had been registered from Texas alone.

How Investigations Involving Grok Often Begin

Many investigations involving Grok do not start with a police officer stumbling onto something. They start with a report. Online providers based in the United States are required by federal law to report apparent child sexual abuse material that they become aware of to the National Center for Missing & Exploited Children (NCMEC), which runs the CyberTipline. NCMEC reviews each report, tries to work out where the user is located, and makes reports available to the appropriate law enforcement agency, often an Internet Crimes Against Children (ICAC) task force or a federal agency such as Homeland Security Investigations or the FBI. For more on what happens after a report is made, see what a CyberTipline report is and what happens next.

AI platforms add something new to investigations: the user’s own words. Prompts, uploaded files, generated images, and conversation history can all be stored by the provider, and they can also be found on a phone or computer. Investigators may seek AI records to show what a person was thinking or planning, or to show that a person tried to create or upload illegal content. The firm discusses how police obtain these records in how police get AI records and how chats are used in court in AI chats and prompts as evidence.

NCMEC’s 2025 data lists 135,373 CyberTipline reports from X.AI. A June 2026 Senate Judiciary Committee release said xAI “submitted over 135,000 reports involving suspected online child exploitation to NCMEC’s CyberTipline in 2025 and has submitted over 127,000 reports thus far in 2026.” The Committee reported that xAI has since resubmitted earlier reports with more complete user and location information and now includes subscriber information and image-generation prompts. NCMEC has likewise noted significant improvements in xAI’s reports in early 2026. In a 2026 court filing, xAI stated that its 2026 reports to NCMEC had resulted in at least 299 arrests.

A general caution: do not create, request, or share sexual or intimate images of any real person without that person’s consent, and never of a minor. AI-generated images can lead to criminal investigations even when no real photograph was used. See AI-generated images and deepfakes.

What Records Grok May Have and How Police Request Them

When investigators want records from Grok, they generally have to use legal process. In broad terms, basic account and subscriber information is often requested with a subpoena, more detailed records with a court order, and the content of messages or files with a search warrant, although the exact rules depend on the type of data, the jurisdiction, and the circumstances. Investigators also commonly send a preservation request, which asks the company to hold onto existing records while the legal process is prepared. What a company actually has depends on its products, its retention practices, and the user’s own settings, and those practices change over time.

xAI’s published law enforcement page says it accepts requests only through its legal request portal and will disclose data only in response to a subpoena, court order, or search warrant, and that it will not honor vague or overly broad requests. Based on the Senate releases, records relevant to a Grok investigation may include account details such as names, email addresses, and phone numbers, IP addresses, session data, and the prompts used to generate images.

Connecting a Grok Account to a Person

A record showing that a Grok account did something is not the same thing as proof that a particular person did it. Investigators typically try to connect an account to a person using things like the email address or phone number used to register, IP addresses from logins, subscriber records from an internet or wireless provider, device identifiers, payment records, and what is found on devices during a search. Each link in that chain can raise questions: shared homes and shared Wi-Fi, devices used by more than one person, VPNs, carrier networks that place many customers behind one IP address, compromised accounts, and gaps in the records. These are the kinds of issues a defense attorney may look at closely, case by case, under current law. The firm discusses this further in how police connect online accounts to a person.

Examples From Reported Cases

The examples below are drawn from public announcements and news reports. They are described generally and without names. Charges are only accusations, and anyone charged is presumed innocent unless proven guilty in court. These summaries are not a prediction of how any other case will turn out.

• In Pennsylvania in 2026, NCMEC forwarded several CyberTipline reports from xAI flagging images allegedly generated with Grok. Detectives traced the email address and IP address to a home, and during the search the Grok app was allegedly logged into the reported account. The charges are allegations.
• In South Carolina in 2026, a NCMEC tip about activity on Grok led to a search warrant and an arrest. The charges are allegations.
• In Tennessee in 2026, CyberTipline reports from both Google and xAI, covering two Google accounts and one xAI account, led to a search warrant and an arrest. The charges are allegations.

Related Articles on InternetCrime.com

• Platform Investigations: all platforms
• AI Crimes
• AI-Generated Images and Deepfakes
• AI Image Generation and the Law
• AI Deepfake Adult Image Charges
• How Police Get AI Records
• What Is a CyberTipline Report?
• X (Twitter) Investigations

If You Are Under Investigation Involving Grok

If police have contacted you, if a search warrant has been served, or if you believe an investigation involving a Grok account may be underway, it is important to get legal advice before taking any action on your own. Attorney Ron Frey generally advises speaking with an attorney before answering questions or agreeing to a search. Whether a person may be required to provide a password or unlock a device depends on the circumstances, the jurisdiction, and any search warrant or court order involved, so that decision should be made with an attorney’s advice (see should I provide my password to the police or FBI?).

You have the right to remain silent. Anyone accused of a crime is presumed innocent unless proven guilty in court. Laws change and vary from state to state and between state and federal court, and the way they apply depends on the specific facts. Please don’t rely on the internet or on AI tools to evaluate your situation. Every case is different, and contacting an attorney is a priority to get tailored advice.

Attorney Ron Frey of The Frey Law Firm, LLC has been practicing law for over two decades and represents people nationally in internet and computer crime investigations and charges. He is a conference speaker and published author.

Attorney Ron Frey Is Available for a Free Initial Confidential Consultation: Call or Text (844) 766-3739. In Florida, call (813) 775-2276. You can also reach the firm through the contact page.

References

• U.S. Senate Judiciary Committee, press release on improved child safety reporting by technology companies (June 2026)
• U.S. Senate Judiciary Committee (Grassley), “Grassley’s Big Tech Investigation Yields Child Safety Results”
• U.S. Senate Judiciary Committee, press release on CyberTipline reporting by technology companies (2026)
• NCMEC, “2025 CyberTipline Reports by Electronic Service Providers (ESP)”
• NCMEC, CyberTipline Data
• Space Exploration Technologies Corp. (SpaceX), Form S-1 registration statement (SEC, 2026)
• xAI complaint, U.S. District Court for the Northern District of Texas (July 2026), via CourtListener
• xAI, Legal Request (law enforcement) page
• Bucks County Herald, Pennsylvania Grok case (2026)
• WMBF News, Horry County Grok tip arrest (June 2026)
• Coastal Carolina News, “Horry County Man Arrested on Child Exploitation Charges” (June 2026)
• Metro Nashville Police Department, news release (2026)
• xAI, “Announcing xAI for Government”

Important: This page provides general information only. It is not legal advice, and it is not a complete or current statement of the law or of any company’s policies. Laws, court decisions, and platform practices change, and their effect depends on the facts of each case and on how courts interpret them. User figures and report counts come from the sources listed and may since have changed. Platform names and logos are trademarks of their owners and are used only to identify the services discussed; The Frey Law Firm, LLC is not affiliated with or endorsed by any of these companies. Please don’t rely on this page, or on any other information online, to make decisions about your situation. Talk with a lawyer. Reading this page or contacting The Frey Law Firm, LLC does not create an attorney-client relationship. Last reviewed: October 26, 2026.