An AI tool meant to put multiple chatbots at users’ fingertips instead left millions of files open to anyone who knew where to look.
The AI aggregator 302.ai exposed 17.6 million files containing 22.72 terabytes of data, including personal information, AI conversations, and corporate documents, according to cybersecurity researchers at Cybernews.
Cybernews researchers discovered the publicly accessible Microsoft Azure storage on Aug. 2, 2026, notified the company on Aug. 11, and observed that public access had been closed on Sept. 8. They reported no evidence that malicious actors accessed or downloaded the data, although that does not rule out earlier access.
302.ai, operated by Hong Kong-based Univerads Technology Limited, gives users access to multiple AI models, including ChatGPT, Claude, Grok, DeepSeek and Gemini, through a single platform.
The exposed archive contained nearly 9 terabytes of images, 7.7TB of video and 5.6TB of audio. More concerning were more than 144,000 chat logs stored in JSON files, which recorded conversations and associated information.
Personal details and corporate conversations exposed
The chat records contained user prompts, AI responses, model selections, token costs, timestamps and other metadata. Some conversations also included personally identifiable information that users had supplied, such as birth dates, genders, home addresses and contact details.
Corporate users were affected, too. Cybernews researchers found conversations linked to an enterprise customer support chatbot operated by a prominent sex doll manufacturer. The archive also contained business documents, including material related to AI research and files users had submitted for analysis.
Cybernews reported that the exposed storage bucket also contained more than 26,000 ZIP archives with conversation data, model outputs, summaries, and uploaded files. The researchers said the data was no longer publicly accessible after they contacted the company.
Why the exposure creates a security risk
The incident illustrates how AI platforms can become repositories of sensitive information that extends beyond individual chatbot messages. Users may submit customer complaints, internal documents, personal details, and business questions to AI services without expecting those records to remain accessible outside the platform.
That creates an opportunity for targeted attacks. Criminals who obtain chat histories could use real names, business relationships, project details, or customer issues to craft convincing phishing messages. Exposed corporate conversations could also help attackers impersonate employees or tailor messages to managers and other business leaders.
The risk extends beyond the primary AI providers. Aggregators such as 302.ai introduce another layer of infrastructure where prompts, uploaded files, and conversation histories may be stored. Even when the underlying models come from established companies, the security of the intermediary remains important.
What this means for AI users
For consumers, the incident is a reminder that conversations with AI platforms should not automatically be treated as private. Sharing home addresses, financial details, personal correspondence, or other identifying information can create exposure if a service mishandles its stored data.
Businesses face potentially greater consequences because employees may use AI tools to analyze internal documents, troubleshoot systems, or handle customer inquiries. A leaked conversation could reveal information that is not publicly available and give attackers material for impersonation or social engineering.
Organizations should review which AI aggregators employees can use, what information they are permitted to upload, and whether vendors provide clear data-retention and security policies. Where possible, businesses should use approved services with appropriate access controls, encryption, and contractual protections.
Users should also check the privacy settings and data-handling policies of their AI providers, avoid submitting unnecessary sensitive information, and follow organizational rules for approved AI tools.
What security teams should check next
For organizations that used 302.ai, the first step is to establish what employees submitted. Security teams should identify the departments and accounts using the service, then review available upload and conversation histories for customer records, confidential documents, or other sensitive material. The response should reflect the information potentially exposed rather than the overall size of the dataset.
Ask the vendor whether it can identify affected accounts and files, establish the exposure period, and provide access logs. Closing public access addresses the immediate exposure, but organizations still need enough information to assess whether their own data was involved and whether further investigation is warranted.
If that review identifies passwords, API keys, or other credentials among submitted material, rotate them and review the associated accounts for suspicious activity. This is a precaution based on what an organization finds in its own submissions, rather than a finding that credentials were exposed in this incident. Customer information or confidential business records should be escalated through the organization’s incident-response process.
The incident should also inform future AI vendor reviews. Ask how an aggregator separates customers’ information, restricts access to uploaded files, monitors storage permissions, and enforces deletion policies. Confirm whether those protections cover conversation archives and generated media as well as the visible chat interface.
For security leaders, the practical lesson is to include AI intermediaries in the same vendor-risk process used for other services handling sensitive information. Approval should depend on how the platform protects and retains business data, alongside the capabilities of the models it offers.
Read more: Storage exposure is one part of AI security risk; this practical prompt injection demonstration shows how attackers can also manipulate a chatbot’s responses.