A security lapse at AI aggregator 302.ai left 17.6 million files, totalling 22.72TB of user data, publicly accessible through an unsecured Azure storage bucket, according to research published by Cybernews on October 21.
The data was taken offline after the researchers contacted the company, and the outlet said it had seen nothing to suggest bad actors had viewed or copied it. It cautioned, however, that if its own team could find the data, others may have too. According to its disclosure timeline, the leak was discovered on August 2 and flagged to the company on August 11, but the bucket was not observed closed until September 8..
302.ai sits between chatbot makers and end users, giving customers access to major large language models including ChatGPT, Claude, Grok, DeepSeek and Gemini. It is developed by Univerads Technology Limited, a Hong Kong-based company founded in 2020. The outlet said it had approached the company for comment.
Images accounted for nearly 9TB of the dataset, video 7.7TB and audio files a further 5.6TB. More sensitive were more than 144,000 chat logs, stored as .json files, which held user prompts and replies, timestamps, which model was used and token costs, plus other metadata.
Researchers found that some of these logs contained personally identifiable information that users likely supplied themselves, ranging from birth dates and gender to contact details and home addresses. The bucket also held more than 26,000 .zip files of conversation data, including summaries, user inputs, model outputs and attached files. It also contained documents ranging from LLM development research to what appeared to be private files users wanted analysed.
The exposure was not limited to individual users. Researchers identified enterprise client data, including several conversations from a customer service bot run by a well-known sex doll maker, which was not named.
The research team argued that as individuals and businesses increasingly entrust AI agents with personal and operational information, the main AI developers are not the only ones responsible for securing those conversations. The businesses that handle the agents share that responsibility. The researchers also warned that leaked chats could help attackers understand victims and build personalised social engineering campaigns.
Exposures of this kind have hit AI products before. In 2023, researchers revealed that a URL shared on GitHub by a Microsoft AI research employee had left 38TB of internal data held in Azure storage open since 2020, including passwords, secret keys and conversations. Microsoft said no customer data was affected. Earlier this year, an independent researcher said an exposed database at chat app Chat & Ask AI had given them access to 300 million messages from more than 25 million users.
The 302.ai exposure comes amid growing concern over businesses’ exposure through their AI suppliers. A survey of more than 6,000 businesses across 15 countries, conducted for QBE in March and April, found 63% were concerned about risks arising from their suppliers’ use of AI. Brokers have also warned that many cyber losses stem from third parties, some of which may not carry robust cover of their own.
For businesses running customer-facing chatbots, the 302.ai case shows how conversation data can end up stored by intermediaries several steps removed from the model developer, bringing AI aggregators into the scope of vendor and data protection risk.
