A landmark investigation by AI Forensics has laid bare the sheer scale of child sexual abuse material (CSAM) circulating on Telegram. The report, published in March 2026, documents how the platform's unique combination of features, large public groups, bot automation, and minimal moderation, has created what researchers describe as an industrial-scale abuse ecosystem.
This isn't a story about a few bad actors slipping through the cracks. It's a story about infrastructure.
The scale of the problem
AI Forensics monitored over 200 Telegram channels and groups suspected of sharing CSAM over a six-month period. Their findings are staggering:
- Over 500,000 unique images and videos flagged as potential CSAM were identified across the monitored channels
- Automated bots were found distributing material on demand, operating 24/7 with no human intervention
- Monetisation networks linked abuse content to cryptocurrency payments, creating a self-sustaining economy
- Cross-platform recruitment funnelled users from mainstream social media into Telegram's closed groups
The report notes that Telegram's architecture makes it uniquely suited to this kind of abuse. Unlike platforms with centralised feeds (Instagram, TikTok, YouTube), Telegram's group and channel structure means content can be distributed to thousands of subscribers without ever appearing in a public search or recommendation algorithm.
How the ecosystem works
The AI Forensics report maps out a four-stage pipeline:
1. Recruitment
Predators use mainstream platforms. Instagram, TikTok, Discord, and gaming chat, to identify and groom potential victims. Once initial contact is established, conversations are moved to Telegram where oversight is minimal.
2. Production
The report documents the use of AI-generated CSAM alongside real abuse material. Generative AI tools are being used to:
- Create synthetic CSAM from innocuous photos of children
- "Age down" images of adults to create child-like content
- Generate entirely fictional abuse scenarios
This blurs the line between real and synthetic material, making detection harder and potentially desensitising viewers.
3. Distribution
Telegram bots serve as automated distribution hubs. Users send a command, and the bot delivers content, sometimes free, sometimes behind a paywall. These bots can serve thousands of users simultaneously and are trivially easy to recreate when taken down.
4. Monetisation
Premium channels and bot-mediated payments (primarily in cryptocurrency) create financial incentives for producers. The report found pricing structures ranging from $5 for "starter packs" to $500+ for custom-produced material.
What makes Telegram different
The report draws a sharp contrast between Telegram and other major platforms:
---------- · ------------------- · --------------- · ----------------- · ----------------
Meta (Facebook/Instagram) · PhotoDNA + AI · Yes (NCMEC hash DB) · Limited · ~15,000 content moderators
Google (YouTube) · CSAI Match · Yes · Limited · ~10,000 content moderators
TikTok · AI classifiers · Yes · Limited · ~40,000 content moderators
Telegram · None reported · None reported · None · Minimal
Telegram has historically positioned itself as a privacy-first platform, resisting government pressure to implement content scanning. While this stance has legitimate free-speech implications, the AI Forensics report argues that it has created a safe harbour for the worst kinds of abuse.
The AI detection gap
Traditional CSAM detection relies on hash matching, comparing images against databases of known abuse material maintained by organisations like NCMEC (National Center for Missing & Exploited Children) and the IWF (Internet Watch Foundation).
This approach has a fundamental limitation: it only catches known material. New content, AI-generated content, and material that has been slightly modified (cropped, filtered, re-encoded) can evade hash-based detection entirely.
The AI Forensics report calls for a new generation of detection tools that combine:
- Perceptual hashing, matching visually similar images even after modification
- AI classification, identifying abuse content based on visual patterns, not just exact matches
- Behavioural analysis, detecting grooming patterns, distribution networks, and monetisation structures
- Synthetic content detection, identifying AI-generated CSAM
What platforms can do
The report makes several recommendations for platforms:
Implement proactive scanning
Not just hash matching, but AI-powered content classification that can detect new and synthetic material. This is where tools like Tuteliq's unsafe content detection and grooming detection APIs become critical, they analyse behavioural patterns and content context, not just pixel matching.
Deploy age verification
Meaningful age verification at sign-up, not just a checkbox. Document-based verification and biometric age estimation create real barriers to underage access and predator account creation.
Monitor distribution patterns
Bot-mediated distribution creates detectable patterns: high-volume content sharing, automated responses, cryptocurrency payment links. Platforms should be monitoring for these structural signals.
Enable cross-platform intelligence sharing
Abuse networks don't respect platform boundaries. The recruitment-to-distribution pipeline described in the report spans multiple platforms. Industry-wide intelligence sharing, through organisations like the Tech Coalition and WeProtect Global Alliance, is essential.
The regulatory response
The report comes at a critical moment for online safety regulation:
- The EU's CSA Regulation (the so-called "chat control" proposal) is still being debated, with fierce disagreement over mandatory scanning requirements
- The UK Online Safety Act is now in force, requiring platforms to use "accredited technology" to detect CSAM
- Australia's Online Safety Act amendments are expanding mandatory reporting requirements
- The US EARN IT Act continues to face constitutional challenges
Telegram's response to these regulatory frameworks has been minimal. The company has historically argued that end-to-end encryption prevents content scanning, though researchers note that much of the abuse material is shared in public or semi-public groups, not private encrypted chats.
What we're doing about it
At Tuteliq, we believe that child safety and privacy are not mutually exclusive. Our API is designed to detect grooming, abuse, and exploitation without bulk surveillance:
- Context-aware analysis: Our models analyse conversation patterns and content context, not just individual messages
- On-platform processing: Data is analysed in real time and never stored, we return risk scores, not content
- Age-appropriate calibration: Risk thresholds are calibrated to the user's verified age group
- Transparent scoring: Every risk assessment includes confidence scores, detected patterns, and recommended actions
For Telegram specifically, we've built a plug-and-play integration that brings these capabilities directly into Telegram groups. The Tuteliq Guardian Bot for Telegram provides real-time grooming, bullying, and self-harm detection with private admin alerts, no code required. If you run a community, youth group, or organisation on Telegram, you can add the bot today and start protecting your members immediately.
If you're building a platform where young people communicate, the question isn't whether to implement safety tools, it's how quickly you can deploy them.
→ Get started with the Tuteliq API → Protect your Telegram groups with Guardian Bot → Read our verification documentation → Book a call with our team
---
The full AI Forensics report is available at aiforensics.org. Tuteliq is not affiliated with AI Forensics.