An AI app left 144,000 chat logs open online. What you type into AI isn't always private
What happened: In October 2026, researchers at Cybernews reported that 302.ai, a service that lets people use ChatGPT, Claude, Gemini, Grok and DeepSeek from one place, had left about 17.6 million files (22.7 TB) in an unprotected cloud storage bucket. Among them were more than 144,000 chat logs, with prompts and replies. Some included details users had typed in, such as birth dates, contact details and home addresses. Business customers’ chatbot conversations were exposed too.
The researchers found it in early August and told the company. The data was taken offline about a month later.
It’s not the first time: In February 2026, a researcher reported that Chat & Ask AI, a popular “wrapper” app with over 50 million users, had a database setting left open that exposed full chat histories. The developer fixed it within hours of being told. The same researcher found the same mistake in about half the apps he scanned.
Why it matters for you: Many AI apps are small companies sitting between you and the big AI models. Your chats are stored on their servers, and a single wrong setting can make them public. You can’t check their security yourself.
What to do:
- Don’t type Aadhaar or PAN numbers, bank details, passwords, your home address or medical records into any AI chat.
- Prefer the official app of the AI company over look-alike “all-in-one” apps you don’t know.
- Delete old chats you no longer need, and check the app’s settings for chat history and training options.
- Treat anything you type into an AI app as something that could one day be seen by others.