Choosing a provider
“Chat & Ask AI”: 300 million messages could be read
In January 2026 it emerged that, because of a misconfiguration in a popular app that relays ChatGPT, Claude and Gemini, a researcher could access 300 million messages from more than 25 million users.
Chat & Ask AI is an app made by the company Codeway, which says it has more than 50 million users across Google's and Apple's app stores. It does not offer its own artificial intelligence: users choose between OpenAI's ChatGPT, Anthropic's Claude and Google's Gemini, and the app passes their questions on. Along the way, it also stores the conversations in its own backend.
In January 2026 an independent security researcher told the publication 404 Media that the app had misconfigured its backend service, Google Firebase. Its security rules were set to public, so anyone who knew the project's address could read, modify or delete the data without logging in. The researcher said they had access to 300 million messages from more than 25 million users. They examined a sample of 60,000 users and one million messages, seeing complete chat histories with timestamps, the model chosen and its settings. Among them were questions about suicide and about making drugs.
According to Malwarebytes, Codeway fixed the problem across all its apps within hours of being told. The problem is not unique: with a tool of their own, the researcher checked 200 iOS apps and found the same flaw in 103 of them. The researcher lists the affected apps publicly and removes them once they are fixed.
What can we learn from it?
Many AI chat apps are only intermediaries: they pass the question to a large model, but keep the conversation in their own systems. Then not only the model maker's data handling matters, but the intermediary's too. The large models are also available directly, through their makers' own apps and subscriptions. In Confiella's copy mode, the confirmed, pseudonymised request goes into your own ChatGPT, Claude or Gemini subscription, and the program explains the limits of this beforehand. Otherwise too, it is worth using a model directly from its maker, and typing client data in pseudonymised form.
Sources
- 404 Media: Massive AI Chat App Leaked Millions of Users Private Conversations
- Malwarebytes: AI chat app leak exposes 300 million messages tied to 25 million users
This article is based on the public sources listed. If you find a mistake, write to us: [email protected]