Two AI companion apps streamed 43 million intimate messages from an open server
What happened
Cybernews found an unprotected streaming server used by the developer of Chattee Chat and GiMe Chat, exposing over 43 million messages and 600,000 images and videos from more than 400,000 users, along with login tokens and purchase records. The server was secured after disclosure.
Chattee Chat and GiMe Chat are AI companion apps from Hong Kong-based Imagime Interactive; Chattee had more than 300,000 downloads, mostly in the US, and ranked in the App Store's top entertainment apps. On 28 August 2025 Cybernews researchers found the developer's Kafka broker, the system streaming the apps' data in real time, open on the internet with no authentication. Anyone who knew its address could watch private conversations as they happened and follow links to users' photos and AI-generated media. The exposure covered more than 400,000 users, over 43 million messages, more than 600,000 images and videos, much of it sexually explicit, plus login tokens and in-app purchase records. The apps did not expose names or email addresses directly, but the intimate content and device details could still be used to identify and extort people, and the developer's privacy policy claimed it treated user data with great care.
How it happened
Leaky AI product: Exposed datastore. A database, storage bucket or server behind an AI product was left open on the internet without a password.
Sources do not say whose AI model was involved. The product was Chattee Chat, GiMe Chat, a type of chatbot.
Impact
Data was exposed. Data involved: chat logs, personal data and credentials. The impact was confined to one organization and its users or customers. Sources give a figure of 400,000.
Severity is rated High, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It became public on 9 Oct 2025.
The server was secured after Cybernews reported it. During the investigation Chattee Chat disappeared from Google Play and the developer began pointing Android users to download it directly instead.