One AI Chat App Leaked 300 MILLION Private Convos — And It’s Not Even Special
One AI Chat App Leaked 300 MILLION Private Convos — And It’s Not Even SpecialYou typed your secrets into a robot. Turns out the robot left the front door wide open. And you’re not ready for the part where 102 OTHER apps did the same thing.
300 million messages. 25 million people. 50+ million downloads. One dumb setting left on “public.” Fixed in hours — but sitting open for who knows how long.
Okay so. You know how everyone’s been treating AI chatbots like a diary/therapist/best friend who never judges? Yeah. An app called Chat & Ask AI — made by a studio called Codeway — just spilled roughly 300 million of those “private” conversations into the open internet. Not hacked with some genius exploit. Somebody just… forgot to lock the database. And a researcher walked right in. Full breakdown here on Malwarebytes.
🧩 Dumb Mode Dictionary (read this first, no shame)
| Scary Term | What It Actually Means |
|---|---|
| Firebase | A ready-made “backend in a box” from Google. Devs use it so they don’t have to build storage/login from scratch. Super popular. |
| Backend / database | The warehouse where the app keeps all your stuff (your chats, your name, your settings). You never see it. |
| Misconfiguration | Nerd word for “set up wrong.” Here: the setting that decides who can read the warehouse was left on “anybody.” |
| Security rules | The bouncer at the warehouse door. If the bouncer’s told “let everyone in,” that’s the whole problem. |
| Wrapper app | An app that doesn’t have its own AI — it just puts a pretty skin over ChatGPT, Claude, or Gemini and charges you for the skin. |
| Responsible disclosure | When a hacker finds a hole and tells the company privately instead of selling it. The good-guy move. |
📰 Wait, what actually happened?
- A security researcher who goes by “Harry” poked at Chat & Ask AI’s Firebase setup.
- The “bouncer” (security rules) was set to public read — meaning literally anyone who knew where to look could pull the data.
- He confirmed the scale by pulling a sample: 60,000 users, over 1 million messages. Then extrapolated to ~300M messages across 25M+ users.
- What leaked? Full chat histories, timestamps, custom bot names, and which AI model you picked. Some of it was dark — people asking about self-harm, drugs, hacking. Stuff you’d never say out loud.
- He told Codeway on January 20, 2026. To their credit, they patched it across all their apps within hours. (SC Media has the timeline.)
😤 Here's the part that should scare you more
Harry didn’t stop at one app. He built a little tool to test other apps for the same door-left-open flaw.
Result: 103 out of 200 iOS apps he checked had the exact same problem. (Hackread covered the wider sweep.)
That’s more than HALF. Tens of millions of files just… sitting there. This isn’t one lazy company. This is an entire generation of “ship it fast” apps built on the same copy-paste backend with the bouncer asleep. The AI gold rush made everyone rush — and rushing means nobody checked the lock.
📊 The receipts
| Thing | Number |
|---|---|
| Messages exposed | ~300,000,000 |
| Users affected | 25,000,000+ |
| App downloads | 50,000,000+ |
| Sample Harry pulled | 60k users / 1M+ messages |
| Time to fix once reported | A few hours |
| Other iOS apps with SAME flaw | 103 of 200 tested |
| Genius hacking required | Literally none |
💬 Why this matters even if you never used that app
The uncomfortable truth: your “private” AI chats live on somebody’s server, and that somebody might be a two-person studio that learned coding last year. The AI itself (ChatGPT/Claude/Gemini) isn’t the leak — the wrapper app holding your history is.
So the lesson isn’t “AI bad.” It’s: treat every chatbot app like a stranger with a notebook. If you wouldn’t hand it to a random dude at a bus stop, don’t type it into a $4.99 app from a studio you can’t name. Google’s own Firebase docs literally warn about this — it’s the first thing you’re supposed to lock down. Half of them didn’t.
Cool, So Half the App Store Is Leaking… Now What the Hell Do We Do? (⊙_⊙)
Look — a flaw that half the tested apps share isn’t just bad news. It’s a map. There’s a gap between “this is broken everywhere” and “almost nobody is fixing it yet.” That gap is where regular people with a laptop and zero budget eat. Five plays, all legal-ish, all doable tomorrow:
🕳️ The Leak Scanner (grey-hat energy, white-hat wallet)
Harry found 103 leaky apps with a homemade scanner. You can learn to build/run the same kind of check — and instead of taking data, you report it and collect bug bounties. Companies pay real money to be told “your door’s open” before a bad guy walks in.
Start with Firebase’s public-rules basics, then list your findings on HackerOne or email the vendor directly.
Example: A 21-year-old CS dropout in Lagos learns to check Firebase rules on free apps, finds 4 leaking, files clean disclosure reports through the studios’ security emails, and banks $1,900 in bounties + a glowing reference in his first month — no data ever misused.
Timeline: First responsible report out in 3–4 days. The easy public-read holes get scarce in 2–3 months as this news spreads and studios patch. Move now.
🔧 Backend Bodyguard (sell shovels to the panicking miners)
Every indie dev who saw this headline is now sweating: “wait, is MY app leaking?” Most can’t answer that. Be the person who checks and locks it for them. You don’t build the app — you just tighten the bouncer’s rules and hand them a one-page “you’re safe now” report.
Package it as a flat-fee “Firebase lockdown audit.” The OWASP mobile security basics make you sound legit fast.
Example: A self-taught coder in Manila DMs 30 small app studios on X with “saw the Chat & Ask AI leak — I’ll audit your Firebase rules for a flat $120.” Closes 6, delivers checklists in a weekend, walks with $720 and 2 repeat clients.
🎣 The Wrapper Flip (steal the model, not the data)
Here’s the dirty secret: Chat & Ask AI is just a skin over ChatGPT/Claude/Gemini. The whole thing is copy-able in a weekend. The winning move isn’t cloning it — it’s building the SAME simple wrapper for a niche nobody serves, in a language the big apps ignore, and doing it securely so you’re the trustworthy one.
Pick a lane (recipes in Urdu, exam prep in Swahili, legal-letter help in Portuguese) and wire up an API key. Google’s Gemini API has a free tier to start.
Example: A tutor in Karachi builds a plain “explain-my-homework” chatbot in Urdu using the free Gemini tier, locks the backend properly, charges $2/month. 400 parents sign up = $800/month while the giants still only speak fluent English.
📖 The Panic Cheatsheet (be the dictionary, own the search)
Right now thousands of devs are Googling “how to fix Firebase public read rules” and getting scattered garbage answers. The FIRST person to write one clean, dead-simple guide becomes the link everyone shares. That traffic = ad money, consulting leads, and street cred.
Write it once, post it free on dev.to or a $0 GitHub Pages site, and let the panic bring readers to you.
Example: A bootcamp grad in Nairobi writes “Lock Your Firebase in 10 Minutes (with screenshots),” posts it the week of the leak, rides the search spike to 12k reads, and turns 3 comment-askers into $150 audit gigs (feeds straight into Backend Bodyguard above).
🪟 Patch Window Sprint (before they all wake up)
This is the “cash in fast” play. Half the tested apps are STILL leaking as you read this. There’s a short window where “am I exposed?” is a screaming question and almost nobody’s offering a quick answer. Run a same-day “Leak Check” service — a fast yes/no scan for a small studio, delivered in hours, not weeks.
Point them to the Firebase App Check docs as the fix, and charge for the peace of mind.
Example: A freelancer in Jakarta posts “Worried after the 300M-message leak? I’ll tell you if your app leaks — results today, $40” in indie-dev Discords. 15 studios bite in two weeks = $600 and a pile of testimonials before the hype dies.
🛠️ Follow-Up Actions
| Move | First Concrete Step |
|---|---|
 Learn the flaw |
Read Firebase Security Rules docs |
 Get paid to report |
Make a profile on HackerOne |
 Sell audits |
DM 10 indie studios on X today |
 Own the search |
Publish the cheatsheet on dev.to |
 Protect yourself |
Delete old chats in any AI wrapper app you don’t fully trust |
Quick Hits
| You Want | You Do |
|---|---|
| To not be victim #25,000,001 |
Stop typing secrets into random chatbot apps — use the official ones direct |
| To earn from this mess |
Learn Firebase rule-checking, report leaks on HackerOne |
| To sell a service |
Offer flat-fee Firebase lockdown audits to indie devs |
| To pull free traffic |
Write the “fix your Firebase” guide before the hype cools |
 To stay ahead |
Assume every “private” AI chat is one bad setting away from public |
You told a robot your secrets. The robot wrote them in a notebook. And left the notebook on a park bench. Lock your doors, fam.
!