An AI "middleman" site left 17.6 million files open, including chat logs
On October 22, 2026, Cybernews reported that 302.ai, a service that lets people use many AI models such as ChatGPT, Claude and Gemini in one place, left an Azure storage bucket open to the public. It held 17.6 million files (22.72 TB), including more than 144,000 chat logs with users' prompts and the AI's replies. Some logs had personal details like birth dates, contact information and home addresses. Business data was in there too, such as logs from one company's customer support chatbot.
What went wrong
The storage was publicly reachable and, according to TechRadar, not password protected. Cybernews says it was most likely left open by accident. Its researchers found it on August 2, reported it on August 11, and saw it closed by September 8, 2026. Cybernews says it has no evidence that criminals downloaded the data.
What to do
- A go-between AI site can keep its own copy of everything you type and upload, as this one did. Use AI tools straight from a provider you have checked, on an account your office controls.
- Before anyone on your team signs up for a new AI site, check where it stores your data and whether you can delete it.
- Keep client names, birth dates, addresses and account numbers out of any AI tool your written rules don't approve.
Sources
- cybernews.com: https://cybernews.com/security/302-ai-data-leak-exposed-millions-files/
- techradar.com: https://www.techradar.com/pro/security/security-breach-at-ai-aggregator-exposes-over-18-million-files-including-some-very-embarrassing-chat-records
Does your security plan cover AI?
See the SafeAI KitGet New this Week by email, free
One short email a week with a real AI data case or a practical guide, and what to do about it. Unsubscribe anytime.