Security Breach at AI Aggregator Exposes 18 Million Files and Private Chats

Unprotected Data Reveals Corporate Secrets

Security researchers discovered a massive data leak from 302.ai, an artificial intelligence aggregator service. The company left a large database accessible without proper protection. This exposed over 18 million files to the public internet. The total volume of leaked data reached 22.7 terabytes. The breach revealed sensitive personal information and private conversation logs. Users had no immediate warning that their data was compromised.

The exposed records included detailed user prompts and corresponding AI responses. Metadata and sensitive corporate documents were also part of the dump. The incident underscores the significant risks of uploading confidential data to third-party platforms. Many users assumed their chats remained private within the aggregator’s ecosystem. However, the lack of basic security measures allowed external parties to access everything.

The leak contained more than just casual conversations. It held structured data that could identify individual users. Personal identifiers were stored alongside professional queries. Companies using the platform for research or development faced heightened risk. Sensitive project details and internal strategies appeared in the file set. The sheer size of the dataset made manual cleanup nearly impossible for affected entities. Experts noted that the aggregator failed to implement standard encryption protocols. This oversight turned a convenient tool into a potential liability for its users.

How Did Such a Large Leak Go Undetected?

Researchers identified the vulnerability through routine scanning techniques. The database endpoint was left open to unauthenticated requests. This allowed anyone with the correct URL to download the entire archive. The absence of rate limiting or access controls contributed to the scale of the exposure. Users often trust AI aggregators to handle their data securely. They may not realize that these services act as intermediaries holding vast amounts of information. The breach highlights a gap between user expectations and backend infrastructure.

The consequences for affected organizations are likely severe. Confidential business plans and technical specifications are now in circulation. Individuals may face identity theft or social engineering attacks based on leaked details. The industry faces renewed pressure to audit third-party data handling practices. Companies must review which AI tools they use for sensitive work. Stricter verification processes will likely become standard in the near future.

Frequently Asked Questions

How much data was leaked in total? The breach exposed approximately 22.7 terabytes of information. This included over 18 million individual files and records.

What types of information were included? The leak contained user prompts, AI responses, and metadata. It also featured personal identification details and corporate documents.

Who is responsible for the security failure? The AI aggregator, 302.ai, is primarily responsible. They failed to secure the database endpoint against unauthorized access.