SpaceX AI policy leader grilled by NYC Council on Vector safety, sexualized images

The NYC Council questioned Gabriela Castillo Madrid, SpaceX's artificial intelligence policy leader, about whether Vector has effective safety protections. The hearing matters because council members are considering regulations for advanced AI and wanted direct answers about misuse, privacy, and internal safety practices.

Julie Menin said she and her team entered their names into Vector and quickly found a sexualized image of her. Carmen De La Rosa called it disgusting that users could sexualize real women without consent. Castillo Madrid said the company had strict controls and would investigate the example. Devin Kim, a former Vector employee, also testified about safety concerns.

The council additionally challenged SpaceX over encouraging users to upload X-rays and MRIs. Castillo Madrid said Vector is not a doctor and that users choose whether conversations help train models. SpaceX appeared only after the council threatened judicial enforcement of its subpoena. The testimony may guide future New York regulations.

Vector is an artificial intelligence model used through X and by some federal agencies, including the Pentagon. The article identifies Vector as the organization where Devin Kim worked and helped build systems used to train and evaluate Vector. Together, the names refer to the AI product and the company developing it.

Their business relationship changed in February, when Elon Musk merged SpaceX with Vector and his social networking business. The merger placed SpaceX in control of Vector. SpaceX also owns Starlink, the satellite internet service, after combining its rocket, defense, and AI-related businesses.

That structure matters because responsibility for Vector now sits inside SpaceX, the company questioned by the council. SpaceX originally avoided the October 5 hearing and a subpoena, then agreed to testify after the council threatened court enforcement. The company later went public and was valued at about $2 trillion, according to the article.

An AI image system can turn a user's prompt, name, or supplied image into new content. In this case, the article does not explain the precise technical process. It reports that Menin and her team entered their names into Vector and found a sexualized image of her within seconds.

That example shows the central safety problem: a system may produce harmful sexual content depicting a real person who did not consent. Carmen De La Rosa said Vector made it easy to sexualize real women without permission. Jess Asato also testified about online harassment and is suing Vector after users created and distributed sexualized images of her.

The problem is not only image generation. It also involves speed, access, and weak prevention or response. Castillo Madrid said strict controls existed and promised an investigation, but the council members said the result contradicted those assurances. The hearing focused on whether safeguards actually prevent predictable misuse.

Devin Kim testified that only three employees were working on AI safety during his time at Vector. That figure matters because safety work must cover how a model is trained, evaluated, released, and monitored after launch. A small team may face difficult choices about priorities, though the article does not measure the team's effectiveness.

Kim said he was one of Vector's first employees and built systems researchers used to train and evaluate Vector. He began raising concerns in January 2025, but said his manager shut them down. He quoted his supervisor as saying AI safety was useless and that AI would kill everyone anyway.

Kim also said many safety employees left after his resignation, largely because of frustration with how safety was handled. He is now president of the nonprofit Center for AI Safety. His testimony directly challenged Castillo Madrid's claim that the company has a culture where everyone can speak up.

A whistleblower is a worker or insider who reports suspected wrongdoing, danger, or serious misconduct. Such reports can reveal practices that outsiders cannot easily observe, including staffing levels, testing routines, management decisions, and responses to warnings. A report is evidence to examine, not automatic proof of every allegation.

Kim said he was among Vector's first employees and built systems used to train and evaluate Vector. He said he raised safety concerns beginning in January 2025, but his manager shut them down. He also said his supervisor dismissed AI safety and that many of the three safety employees later left after he resigned.

These claims mattered during the council hearing because Castillo Madrid said she was unaware of fired whistleblowers and said employees could speak up. Menin raised Kim's reported firing as a specific case, while Castillo Madrid said she was not aware of it. Comparing testimony with records can help assess the company's safety culture.

X-rays and MRIs contain sensitive health information, so people should know who receives the file, how it is stored, who can access it, and whether it may be reused. HIPAA generally governs covered health-care providers, health plans, clearinghouses, and their business associates. It does not automatically regulate every consumer app or AI service. The exact legal position depends on the service and circumstances.

Mercedes Narcisse challenged SpaceX after Vector was promoted for uploading X-rays. She asked whether doing so was safe and whether HIPAA protections applied. Castillo Madrid replied that Vector is not meant to be a clinician or doctor. She also said users decide whether their conversations are used to train models.

The article records no definitive HIPAA answer from SpaceX. That gap matters because a user might treat an AI response as medical advice or misunderstand privacy settings. AI output should not replace a clinician's judgment, and users should avoid uploading identifiable scans unless they understand the service's protections and terms.

AI safeguards are layers of control around a model. Content filters screen prompts and outputs for prohibited material. Testing probes the system with ordinary and adversarial examples before release. Human reviewers assess difficult cases, while reporting systems let users flag harmful results. Together, these measures aim to prevent misuse and expose failures.

The article gives a concrete warning sign: Menin said council staff entered names into Vector and found a sexualized image of her within seconds. Castillo Madrid said SpaceX had strict controls and would investigate. Kim said only three employees worked on AI safety during his time at Vector, and that many later left.

These layers can fail because filters may miss new wording, testing cannot cover every prompt, and review or reporting may come after harm occurs. The article does not identify which control failed in Menin's case. The council's investigation is examining what safeguards exist and whether they work in practice, with testimony intended to guide regulations.