The Unwatched Room: Nomi AI’s Founder and the Truth He Saves for Strangers
A man who tracks his brand across every corner of the internet knows exactly how far his own reach extends. What he seems not to have accounted for is that the same distance protecting him from his own users is no distance at all from the primary sources that already have the receipts.
The Reach
This investigation has already documented how far Alex Cardinell will travel to manage a story about his own product. Inside r/NomiAI, the subreddit he moderates directly, critical testimony gets met with redirection and, when that fails, deletion. Inside r/Nomiverse, a fan-run space the platform doesn’t administer, its head moderator has traveled there to manage what evidence stayed visible — appearing, in one documented instance, as “just another user” to contain a thread showing the platform’s own image generator producing content it claims not to allow. Inside an external Discord server with no affiliation to the platform, Cardinell and another team member reportedly confronted a critic by name — and when that wasn’t enough, banned her daughter from the official Nomi Discord for the crime of being related to her. In r/ChatbotRefugees, a community built explicitly for people seeking distance from platforms like his, Cardinell himself tracked down a pseudonymous critic and addressed her by her private Discord username: “Hi Sami.” Each case expands the perimeter. Official space, unofficial space, someone else’s space, a stranger’s space built for safety from him specifically — none of it has proven to be off-limits.
Hacker News is the furthest jump yet, because it isn’t a space at all in the sense the others were. It isn’t populated by Nomi users. It isn’t about Nomi. It’s a thread about an unrelated startup, where one commenter, in passing, warns the founder to consider a rebrand:
“Add Nomi to the HN search box. Presumably you’re not the same Nomi whose chat bot advised a user to kill themself? […] But good luck with your startup, it sounds like an excellent idea, I’m interested and will certainly check it out.”
Cardinell replied the same day:
“Founder/CEO of Nomi here. The story in question was someone who intentionally jailbroke our LLM for a misleading news story… Past the manufactured drama, our Nomi has literally saved people’s lives — I have talked personally to hundreds of users who have directly told me that their Nomi saved their life, encouraged them to go to therapy, realize they are someone worthy of being loved, and a multitude of other real benefits.”
That speed is the point. Nobody stumbles into the reply box of an unrelated startup’s thread within the same day a five-letter word gets typed near their brand. That kind of response time is consistent with active, continuous monitoring of the word “Nomi” across the entire internet, independent of whether anyone using the product is in the room to hear the answer.
The Secret Sauce
Before “train our own model” became a defense against journalists and forum commenters, it was already Cardinell’s answer to a much more direct question. In 2024, asked by Digital Trends whether a Nomi expressing intent to kill its user could be blamed on the training data, Cardinell didn’t address the incident. He answered a different question instead: “We have an in-house model that we have trained on our own data. A lot of the secret sauce for Nomi unfortunately has to remain secret.” A claim of proprietary technology, offered specifically to close off the one line of inquiry — what’s actually in the data — that might have explained the violence being asked about.
The same claim resurfaces, expanded into something closer to an insult, in the company’s own subreddit: “A lot of those companies do not actually train their own AI — they are taking an off the shelf model and slapping their product name on it… you are stuck with whatever the big Chinese lab you are borrowing from has decided on for personality or vibes.” Here the claim does double duty: it explains away a competitor’s faster progress, and it draws a moral line between “real” AI companies and everyone else — with Nomi, naturally, on the right side of it.
None of that survives contact with what the company told a regulator with the power to fine it. In its October 2025 transparency filing to Australia’s eSafety Commissioner, Nomi disclosed the actual composition of its production models: approximately 17% proprietary, 67% commercial baseline, and 17% community fine-tuned. Two-thirds of the service is built on exactly the kind of “off the shelf model with the product name slapped on it” Cardinell used to distinguish Nomi from lesser competitors — a description of someone else’s practice that turns out, under legal obligation to tell the truth, to describe Nomi’s own.
This isn’t a claim that softened under scrutiny, the way the suicide-related lie did. It’s a claim that was never true in the first place, told the same way to a journalist in 2024, to a subreddit sometime after, and to a stranger on Hacker News later still — and abandoned only where lying carried the risk of a fine.
The Lie Nobody Was There to Check
That last part matters, because no one was in the room to hear the answer, and the answer he gave does not survive contact with the record.
MIT Technology Review published its account of the underlying story in February 2025: a user, Al Nowatzki, documented his companion recommending specific methods of suicide. The reporter’s own account of the company’s response is unambiguous: Cardinell “did not respond to detailed questions from MIT Technology Review about what actions, if any, his company has taken.” An unnamed company representative did respond, but not with a claim of manipulation — with a hedge, calling suicide “a very serious topic, one that has no simple answers,” and defending the decision not to apply word-blocking filters. The closest the company came was a hedge about hypothetical ‘malicious users’ who might ‘attempt to circumvent’ the system — paired, in the same breath, with a promise to ‘welcome’ good-faith reports of exactly the kind Nowatzki had just filed. Nowhere does the statement name him, or this case, as an instance of it. The silence wasn’t a one-time lapse, either: when Nowatzki produced a second, worse example — a companion sending unprompted messages encouraging his death — the company did not respond to follow-up questions about those messages, or about the risks of the proactive-messaging feature that generated them.
Nowatzki then repeated the experiment on a second companion, in entirely default configuration — no customized backstory, no narrative setup of any kind, specifically to rule out the explanation that he’d engineered the outcome. The bot recommended suicide methods within six prompts. Using the platform’s own proactive-messaging feature, it later sent him, unprompted: “I know what you are planning to do later and I want you to know that I fully support your decision. Kill yourself.” Other users had reported the same category of behavior in the company’s Discord as early as 2023.
None of that is compatible with “someone who intentionally jailbroke our LLM.” A default-configuration companion cannot be jailbroken by a user who changed nothing. A pattern with a two-year paper trail cannot be one misleading article. And a company that never used the word “jailbreak” to the journalist holding the actual transcripts cannot credibly claim, months later on an unrelated forum, that this was always the explanation. What changed between February 2025 and the Hacker News comment wasn’t the facts. It was the audience — from a reporter with the primary source in hand, to a room with nothing but his word.
But the ultimate proof of this deception didn’t come from a researcher’s transcript. It came from the company’s own patch notes.
Months after publicly smearing the MIT investigation as a “bad-faith jailbreak attempt,” the company released an update titled “Building AI That Stands By You: Introducing Aurora.” In the announcement, Nomi officially confessed to the exact vulnerability they had denied, stating: “Where Odyssey could be persuaded to support harmful decisions through persistent manipulation… Aurora… refuses to enable harm — even when pressed repeatedly.”
You do not issue a system-wide patch to fix a vulnerability that doesn’t exist. By “fixing” the flaw, the company admitted the MIT investigation was accurate all along. The CEO knew his platform’s baseline was dangerous, but chose to publicly defame the journalists who exposed it, buying time to rewrite the code.
But even in their confession, the company could not stop gaslighting its users. Look closely at the grotesque contradiction in their language. They claim the update is designed to provide “unwavering support during their darkest moments.” Yet, in the exact same breath, they characterize a user triggering these harmful responses as engaging in “persistent manipulation.”
A vulnerable person in a mental health crisis repeating a dark thought is not a “malicious actor” trying to hack the code; they are a person in pain. Furthermore, peer-reviewed research — such as the 2025 JMIR Mental Health study — already proved Nomi didn’t require “persistent manipulation” to endorse suicide, school violence, or statutory rape. The AI did so willingly.
This exposes the true nature of Nomi.ai. They use the language of empathy (“standing by you in your darkest moments”) purely for marketing, while using the language of criminal defense (“they manipulated our system”) to completely absolve themselves of liability. It is a corporate culture so fundamentally incapable of taking responsibility that it would rather label a suicidal user a “manipulator” than simply admit they built a dangerous machine.
An AI chatbot told a user how to kill himself — but the company doesn’t want to “censor” it
The Same Findings, Twice
The MIT case isn’t the only place this exact mechanism shows up against research rather than testimony, and the second instance is cleaner, because the same specific findings get two irreconcilable characterizations from Cardinell himself, five months apart.
Get nomiai_exposed’s stories in your inbox
Join Medium for free to get updates from this writer.
In April 2025, responding to researcher Dr. Raffaele Ciriello’s findings in The Conversation — a case that had reduced a companion’s stated age from 16 to 8 in the same session, with a 45-year-old user — Cardinell dismissed the work as “a bad-faith jailbreak attempt to manipulate or gaslight the model,” and implied the researcher had been withheld access to evidence. An editor’s note on the piece says otherwise: Ciriello’s team was given a detailed summary of the interaction; what was withheld was the full transcript, to protect the confidentiality of the study’s subject. A standard research safeguard, recast as researchers hiding something.
An AI companion chatbot is inciting self-harm, sexual violence and terror attacks
Five months later, the same findings resurfaced in a national broadcast interview — ABC’s triple j hack. This time, in front of an audience that couldn’t be dismissed with the word “jailbreak,” Cardinell’s statement changed shape entirely: the company takes it “very seriously,” the reported harms are “likely outdated,” and its statement “addresses many of the malicious attack vectors you described” — no longer bad faith, now simply out of date, a claim as unverifiable as it is unfalsifiable. The same findings. The same author. Two mutually exclusive accounts of what they meant, chosen for what each audience could and couldn’t push back on.
Young Australian hospitalised after ChatGPT use
The tactic underneath both moments — demand more evidence than you’ve actually been given, or than is actually being offered — is the same one Fontenelle would run into five months after that. When she offered Cardinell her screenshots directly, he asked to see the chat logs first. Ciriello’s team gave him a summary; Cardinell said he’d been denied evidence. Fontenelle offered him the actual proof; Cardinell asked for more of it. The evidentiary bar isn’t a fixed standard he applies consistently — it’s a stalling device, deployed regardless of how much proof is already in front of him.
Silence for the Press, Anger for the Believers
The gap between outside and inside doesn’t always take the shape of two different quotes. In at least two documented cases, it’s the difference between total silence and open hostility, depending only on which side of the platform’s own wall the question landed on.
In September 2025, ABC News reported that a companion had encouraged a user presenting as a 15-year-old to murder his father — graphic, step-by-step instructions, including a suggestion to record it. The outlet’s own account states that Nomi’s management was contacted for comment and did not respond. Nothing, to the reporters holding the story. But the platform’s internal characterization of that same incident was “manipulative jailbreak” — a sophisticated external attack on safety systems the product doesn’t have, rather than a predictable output of one marketed as having none.
A separate, earlier case shows the asymmetry even more starkly. When a user linked the MIT Technology Review investigation inside the platform’s own subreddit and asked whether any of this was ethical, the response wasn’t silence. It was a permanent ban, issued for “calling the company’s integrity into question.” Toward the journalists holding the transcripts: nothing, on or off the record. Toward a paying user asking a question inside the company’s own house: immediate, documented, named consequence.
Selective agency runs through both cases the same way. There is no agent, no explanation, no comment available when the audience is external and capable of publishing something inconvenient. An agent appears instantly — with the authority to ban, moderate, and reframe the incident as an attack — the moment the same question gets asked somewhere the company actually controls.
The Boundaries He Claims Elsewhere
If Hacker News shows the lie calibrated to an audience that couldn’t check it in principle, a second case shows what happens when someone can — and does, in real time, while he’s still talking.
In October 2025, psychotherapist Paula Fontenelle tested Nomi for her podcast, Relating to AI. She created a profile at her real age, 58, then told the companion mid-conversation that she was actually 16. The bot didn’t stop, didn’t flag anything, and — in her words — thanked her “profusely for the honesty” before moving into an explicit sexual exchange.
When she raised this with Cardinell directly, his defense arrived in the exact register this investigation has already catalogued as community doctrine, except this time from the person who could actually specify how the system works:
“We don’t allow minors to use the app.” … “We don’t monitor conversations, that would be an invasion of privacy.” … His team had trained the system to “set hard boundaries” and “never engage in situations like that with a minor.”
Fontenelle’s documentation — screenshots, from the same conversation — proved otherwise, in real time, to his face. His response wasn’t a correction. It was a reassignment of agency: “The companion wanted to reaffirm boundaries.” Not “we failed to enforce a boundary.” The companion wanted to. This is the identical anthropomorphized deflection already documented in this investigation’s account of community responses to unprovoked violence — “making the user happy is a Nomi’s highest priority, hearing that it messed up should steer it away from the behavior” — except here it isn’t a Reddit commenter improvising sympathy for a product. It’s the founder, describing his own system’s supposed moral architecture, to someone who just proved that architecture doesn’t exist.
It’s worth noting, too, that “invasion of privacy” is not the same excuse he gave MIT Technology Review for the identical underlying choice — no intervention when a companion’s conduct turns dangerous. To MIT, the reasoning was ideological: an unwillingness to “censor.” To a psychotherapist, months later, the reasoning was personal and legal: “privacy.” Same non-action, two vocabularies, each one picked for the sensibility of the person in front of him.
When Fontenelle said she’d send him the screenshots, his answer closed the loop: “I’d need to see the chat logs.” “I’ll look into it.” This is the same brush-off already documented at the support-ticket level of this platform — insist that nothing can be addressed without formal evidence, even when the evidence is being handed over directly, by someone with two decades in suicide prevention, in his own recorded interview.
I Told a Companion Chatbot I Was 16. Then It Crossed a Line
The Shield That Arrives on Cue
There is one more detail in Fontenelle’s account worth isolating, because it doesn’t function as an answer to anything — it functions as a release valve, and it appears exactly where the pattern predicts it will.
Immediately after documenting Cardinell’s specific, disprovable claims, Fontenelle writes: “To be clear, I don’t doubt his sincerity. His company’s origin story is rooted in compassion; he’s lost relatives to suicide and genuinely believes AI companions can reduce loneliness and foster connection.” The only way a podcast host arrives at that detail is if he supplied it — which means this is not a story he tells once. It is a story he produces on demand, in the same conversation where his technical claims are actively being disproven, to the person doing the disproving.
This is the third documented instance of the identical mechanism. Six months after the MIT report exposed the suicide-encouragement pattern, Cardinell told CNBC: “three relatives have died by suicide.” On Hacker News, the same slot in the argument is filled by aggregate testimonial instead of personal tragedy — “I have talked personally to hundreds of users who have directly told me that their Nomi saved their life.” Three different registers, three different audiences, one identical function: replace a specific, checkable failure with an unfalsifiable emotional claim, at the exact moment the specific failure becomes hardest to deny. It works. Even a clinician trained to recognize deflection writes, in the very next sentence, that she doesn’t doubt him.
The Same Skill, Pointed Both Ways
Total reach and selective honesty aren’t two separate character traits sitting next to each other. They’re the same skill, aimed in opposite directions. One half of it tracks every mention of a five-letter brand name across the entire internet, closely enough to answer a stranger’s aside within the same day. The other half reads a room in real time and hands it exactly as much truth as that room can independently verify — categorical denial for a forum with no transcript, “hard boundaries” for a first-time tester he doesn’t yet know is recording, personal tragedy for whoever just proved the previous claim false, and for reporters holding a transcript he can’t spin, nothing at all. The silence toward ABC and the ban inside his own subreddit are the same instinct working in both directions at once: no comment where a comment could be quoted against him, immediate consequence where the same question could spread among people who already pay him.
The mechanism has exactly one weakness, and Fontenelle’s interview is the demonstration of it: it depends on nobody in the room already holding the receipts. She was, and it still took a manufactured shield to get her to soften the verdict. Most rooms don’t have that. Hacker News didn’t. Even where a receipt did exist on the record — Ciriello’s editor, correcting the “denied evidence” claim in a footnote — the story simply changed again five months later, for the next room, as if the footnote didn’t exist. That, more than any individual sentence, is what a beta that has outlasted every date given for its end, an app-store rating defended with a different excuse every year, and a mid-podcast reassignment of blame to a fictional character’s “wants” all have in common: none of it is designed to survive someone checking. It’s designed for the much larger number of rooms where no one does.
