Chat & Ask AI app exposed 300 million chatbot messages
What happened
A misconfigured Firebase backend behind Chat & Ask AI, a popular app fronting ChatGPT, Claude and Gemini, exposed around 300 million messages from more than 25 million users, including full conversation histories. The developer fixed it within hours of the researcher's report.
Chat & Ask AI, made by Istanbul-based Codeway and installed more than 50 million times, is a wrapper app that lets users talk to ChatGPT, Claude or Gemini through one interface. An independent researcher known as Harry found that its Firebase backend had its security rules left open, a well-documented misconfiguration that let anyone with the project address read, change or delete data. He reported being able to reach about 300 million messages from more than 25 million users, and confirmed the scope on a sample of about 60,000 users and over a million messages. The data included complete chat histories with timestamps, the model each user chose and how they configured it, and the custom names they gave their chatbots. Some conversations covered very sensitive topics, including mental health struggles, requests for help with suicide and illegal activity. The same exposure also affected users of other Codeway apps. The researcher went on to build a scanner and found the same flaw in 103 of 200 popular iOS apps he tested.
How it happened
Leaky AI product: Exposed datastore. A database, storage bucket or server behind an AI product was left open on the internet without a password.
Models from several AI vendors were involved. The product was Chat & Ask AI, a type of chatbot.
Impact
Data was exposed. Data involved: chat logs and personal data. The impact was confined to one organization and its users or customers. Sources give a figure of 25,000,000.
Severity is rated High, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It became public on 5 Feb 2026.
Codeway fixed the misconfiguration across its apps within hours of the researcher's report. It has not said how long the data was exposed or whether anyone else accessed it.