AI chatbot data breaches, 2023 to 2026: what each leak exposed, and whose chats were in it

The Morse teamPublished November 7, 202611 min read

AI chatbot data breaches have exposed, or may have exposed, people's conversations at least nine times since 2023, counting only incidents the company confirmed or researchers documented with the data in hand. Seven of those nine needed no break-in: a bug showed one person's chats to another, or a database sat open to anyone who found it. The apps run from ChatGPT, Meta AI, and Character.AI to DeepSeek, companion apps like Muah.ai and Chattee Chat, and Chat & Ask AI, whose leak held about 300 million messages.

On November 7, 2026, we read each company's own incident post where one exists, and otherwise the report of whoever found the data: Wiz, Cybernews, AppSecure, Have I Been Pwned, and 404 Media's account of the researcher behind the Chat & Ask AI find. Thirteen incidents made the list. Five were confirmed by the company, six documented by researchers, and two rest only on a seller's claim. The table says which is which. OpenAI and Character.AI deserve credit for publishing what was visible, to roughly how many people, and an apology. Several smaller apps hadn't answered the researchers by the time the reports came out.

Which AI chatbots have had data breaches?

Thirteen incidents, in the order the data was exposed. "Chats in it" means text people typed or the replies they got, including chat titles and prompts.

Dates are when the data was exposed or found, where the source gives one, and otherwise when it was disclosed. Some chats leave an app without any breach. A browser extension can read the page you chat on, which we cover in are AI browser extensions safe, and a shared chat can turn up in search results, which how AI chat share links work explains.

What was in the DeepSeek database leak?

Chat history, along with secret keys and backend details. Wiz Research reported on January 29, 2025 that "within minutes" of looking, it found a ClickHouse database linked to DeepSeek at oauth2callback.deepseek.com and dev.deepseek.com, "accessible without any authentication at all." One table, log_stream, held more than a million log lines, the earliest from January 6, 2025.

The opening went further than reading. Wiz says it allowed "full control over database operations," so anyone who found it could run their own SQL queries against it. Wiz says it stopped at listing what was there, told DeepSeek at once, and that DeepSeek "promptly secured the exposure." Its report doesn't say whether anyone else got in first, and as of November 7, 2026 we found no public statement from DeepSeek about the database. What else to weigh before using DeepSeek is in is DeepSeek safe.

Has Character.AI been hacked?

We found no report of an attacker breaking into Character.AI, as of November 7, 2026. The incident Character.AI has disclosed was caused by its own change in December 2024. Its post of December 17, 2024 says that "during an attempt to refresh the list of featured Characters on our homepage, we mistakenly triggered a change" that showed parts of some users' accounts to other people.

Character.AI says what showed "could include a username, name, bio, Characters, homepage, personas, voices or chats," that the problem "persisted for approximately ten minutes," and that "less than 0.01% of our users had any information visible." The post doesn't give a number of people, and it ends: "We are truly sorry and will take every possible precaution to ensure this doesn't happen again." For what Character.AI keeps the rest of the time, read is Character.AI private.

Which AI companion apps have leaked users' chats?

Three on our list: Muah.ai, Chattee Chat with its sister app GiMe Chat, and MyLovely.AI. Two of the three leaks held email addresses alongside the prompts.

Muah.ai was breached in September 2024. Have I Been Pwned, the service that lets people check whether their email address turns up in breached data, lists 1.9 million addresses from it, with "AI prompts" among the data exposed. It added the breach on October 8, 2024.

Chattee Chat and GiMe Chat come from Imagime Interactive, a Hong Kong developer. Cybernews found their Kafka broker, a server that streams messages between systems, open with no authentication on August 28, 2025. It held more than 43 million messages and over 600,000 images and videos from more than 400,000 users. There were no names or email addresses in it, but there were IP addresses, device identifiers, and login tokens that Cybernews says could be used to take over accounts. The server was closed on September 19, 2025. The developer didn't reply to Cybernews, which says it can't tell whether attackers reached the data first.

MyLovely.AI's leak started as an auction. On April 8, 2026, Cybernews reported that a seller on a hacking forum was offering its data. The sample files held usernames, emails, plan details, and about 113,000 explicit prompts, nearly 70,000 of them "linked to unique user IDs." Have I Been Pwned added the breach the same day, with 106,300 addresses. We compared what companion apps say they keep in AI companion app privacy.

What was the biggest AI chat app data leak?

By message count, Chat & Ask AI, an app from the developer Codeway. 404 Media reported on January 29, 2026 that a researcher who goes by Harry "had access to 300 million messages from more than 25 million users." A user's file held "a complete history of their chats with the AI," their timestamps, the name the user gave the chatbot, and which model they used. The cause was a misconfigured Google Firebase backend. Harry alerted Codeway on January 20, 2026, and Codeway fixed the error "across all its apps within hours," Hackread reported, citing 404 Media. We found no statement from Codeway.

404 Media describes Chat & Ask AI as a "wrapper" that plugs into models from OpenAI, Anthropic, and Google. The report doesn't say any of those three was affected. The app in between kept the chats and left them readable.

302.AI's leak had the same shape. Cybernews describes 302.AI, built by a Hong Kong company, as an aggregator that sells access to major models. Its researchers found a public Azure storage bucket belonging to 302.AI on August 2, 2026, with 17.6 million files. More than 144,000 chat logs in it held user prompts, assistant replies, the models used, and sometimes personal details. The bucket was closed on September 8, 2026, and Cybernews says it has "no evidence that malicious actors accessed or downloaded the data."

Have ChatGPT and Meta AI leaked users' chats?

Both have, through bugs. OpenAI's post on the March 20, 2023 outage says its bug "allowed some users to see titles from another active user's chat history," and our ChatGPT data breach history covers it alongside OpenAI's later incidents.

Meta AI's bug let one user load another's prompts and answers. Sandeep Hodkasia, who founded the security firm AppSecure, reported it to Meta on December 26, 2024. AppSecure's release says Meta AI was "unintentionally exposing prompts and outputs generated by other users." Meta's servers gave each edited prompt a number and didn't check who was asking for it, so changing the number returned a stranger's prompt and reply. Meta shipped a fix on January 24, 2025, paid a $10,000 bounty, and told TechCrunch it "found no evidence of abuse." AppSecure says the issue was "permanently resolved on April 24, 2025."

Which AI breach claims are unproven?

Two on our list. In February 2025, a seller calling itself "Gloomer" posted what it said was OmniGPT's data: contact details of at least 30,000 users and 34 million interactions with AI models, CyberInsider reported. OmniGPT had made no public statement when CyberInsider published, and we found none since. The claim remains unverified.

The same month, a seller offered what it called logins for 20 million OpenAI accounts, which OpenAI told SecurityWeek it had no evidence came from its systems; our ChatGPT data breach history covers that claim.

What do AI chatbot data breaches have in common?

Every one of the 11 confirmed or documented incidents exposed data that a company's server, or its vendor's, was holding. Counting from the table:

• Chat text was in, or could have been in, 9 of the 11. The two without it are OpenAI's analytics vendor, which held names, emails, and browser details, and the 53 images OpenAI's agents posted.
• Most needed no attacker. Four were databases or storage left open with no login (DeepSeek, Chattee, Chat & Ask AI, and 302.AI), and three were bugs that showed one person's data to another (ChatGPT, Character.AI, and Meta AI). Three were break-ins: Muah.ai, MyLovely.AI, and OpenAI's vendor, Mixpanel. One was OpenAI's own research agents.
• The leaks pointed back to people. Chattee's held IP addresses and device IDs, MyLovely.AI's prompts were tied to user IDs and its accounts to emails, Muah.ai's prompts sat beside email addresses, and Chat & Ask AI kept each user's history in a file of its own.
• Two came from apps in the middle, including the biggest. Chat & Ask AI and 302.AI both sell access to other companies' models, and both stored the chats that passed through them.

How Morse keeps your chats out of the next leak

A breach can only leak what a server holds. In each incident above, a server held what leaked, most often people's chats, tied to an account, a device, or an email address. Morse's servers keep no messages and log no message content. Your chat history is stored in your browser, encrypted, so there's no store of chats on our side to leave open, misconfigure, or steal.

• An open database full of chats. There isn't one on our side. Your Morse account holds your sign-in details, plan, balance, and a usage ledger with no content.
• An app in the middle that keeps what passes through. Morse also sits between you and the models, but it passes your messages on without storing them, and a file you attach is sent with the message and never stored by Morse.
• An analytics vendor's breach. Morse runs no advertising trackers or third-party analytics.
• A training set that leaks. Morse doesn't train AI on your content, sell your data, or show ads.

The copy in your browser is locked too. Opening it needs two keys, one kept only on your device and one our server hands you at sign-in, so someone who copies the browser's data still can't read it. In our privacy policy's words, this storage encryption "is not end-to-end encryption against us: we hold the key, but we never receive the data it unlocks."

Each chat also gets a privacy mode, which decides who handles a message on its way to the model:

• Private, so the host running the model has no stored chats to spill. Every new chat begins in Private. DeepSeek, Kimi, GLM, and other open-weight models, along with Grok, answer from hosts bound by zero data retention: Morse has zero data retention agreements with its inference, search, and other providers, so they keep nothing. Where a provider confirms zero retention on each reply, Morse looks for that confirmation and turns away any reply without it. What zero data retention means spells out the promise.
• E2EE, when even Morse shouldn't be able to read the chat. Before a message leaves your device, your browser verifies the enclave's cryptographic proof and seals the message for that enclave alone. What crosses our servers is ciphertext they can't read, and the reply is decrypted only in your browser. Third-party providers operate the enclaves, not Morse, and the guarantee depends on the enclave hardware and attestation working as designed. It's part of Pro, at $19 a month.
• Anonymous, for GPT, Claude, or Gemini with your identity left off. Before the message reaches the provider, our proxy takes out your account, email, and IP address, and Morse's own account sends it instead. The provider sees the text without knowing it's you, and may keep it for a limited time to check for abuse, under its own policy, so leave out names, addresses, and account numbers.

Your browser holds the only copy of your history, so clearing it, losing the device, or deleting your account deletes your chats, and Morse can't recover them. Keep a copy of anything you need. The details are in our privacy policy.

Send a first message from the Morse home page without an account, or start free with no card needed.