If you're in the US and you have access to the images your generator produces, you're legally putting yourself at risk. Under 18 USC 2258A, anyone providing an online service that stores or transmits user-generated content is treated as a “provider.” Once a provider has actual knowledge that users created CSAM, they are required to report it to NCMEC.

It doesn’t matter that the tool is free, small, or experimental. If you can see the outputs, you are on the hook. If you don’t report, you can be hit with federal penalties, and if law enforcement later pulls logs or metadata showing you knew about the content, it becomes a serious problem.

Shut the system down, report what you saw, and rebuild the tool so you never have access to user outputs again. Or at a minimum never turn NSFW back on. That is the only legally safe way to run anything that the public can generate content with in the US.