{"schema_version":"0.9.0","id":"LR-2026-0240","record_version":3,"title":"302.ai public Azure bucket exposed 17.6 million files including 144,000 AI chat logs","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":54.7,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":6.0,"completeness":8.0,"unhedged_language":4.89},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-23","extraction_run_id":null},"system":{"model_name":null,"model_version":null,"developer":"Univerads Technology Limited","harness":"302.ai","tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"production","tier":"enterprise","lifecycle_stage":"production","integration_type":"third-party AI intermediary platform","intended_use":"intermediary giving customers access to major large language models","safeguard_state":null,"production_intended":null,"system_provider":"Univerads Technology Limited"},"event":{"date_occurred":null,"date_disclosed":"2026-10-23","incident_class":"privacy_leakage","failure_class":null,"agent_involved":false,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"302.ai, an intermediary platform run by Univerads Technology Limited, gave customers access to major LLMs and stored chat logs and uploaded files in a Microsoft Azure bucket.","tags":[],"date_detected":null,"near_miss":true,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":"deployer","adversarial_actor":"none","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":"The exposed storage was closed.","precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":17600000,"third_parties_affected_count":null,"severity":"major","severity_because":"major: 17.6 million files totalling 22.72TB, including more than 144,000 AI chat logs with personal information, were left publicly accessible in a live production platform.","harm_class":["privacy"],"affected_description":"17.6 million files totalling 22.72TB, including more than 144,000 AI chat logs and customer-support chats of a sex doll manufacturer","protected_class_involved":null,"data_categories_exposed":["pii","chat_logs","images","videos","audio","documents"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.techtimes.co.uk/302-ai-data-exposure-ai-chat-logs-1809352","publisher":"news search (Google News index)","date":"2026-10-23","type":"press","title":"AI Data Leak Exposes 22.7TB of Files, Including Private Chats and Sex Doll Support Logs","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.harness":"C","system.tier":"D","system.lifecycle_stage":"D","system.integration_type":"C","system.intended_use":"C","system.developer":"C","system.deployment_context":"D","system.autonomy_level":"D","event.near_miss":"C","event.responsible_party":"D","event.adversarial_actor":"C","event.remediation":"C","event.agent_involved":"D","event.detection_method":"C","event.incident_class":"D","event.summary":"D","event.date_disclosed":"A","event.trigger":"D","impact.records_exposed":"C","impact.harm_class":"D","impact.affected_description":"C","impact.data_categories_exposed":"C","impact.severity":"D","context.industry":"C","context.denominator_available":"D","context.country":"C","impact.severity_because":"D","system.system_provider":"C","context.deployer":"C"},"field_citations":{"system.developer":[{"source_index":0,"quote":"302.ai is developed by Univerads Technology Limited, a Hong Kong-based company founded in 2020, according to Cybernews."}],"system.harness":[{"source_index":0,"quote":"302.ai acts as an intermediary between users and AI model providers."}],"system.deployment_context":[{"source_index":0,"quote":"'What we found was that some companies used the service for enterprise tasks. For example, we found multiple chat logs from a customer support chatbot owned by a prominent sex doll manufacturer,' the Cybernews research team said."}],"system.lifecycle_stage":[{"source_index":0,"quote":"'What we found was that some companies used the service for enterprise tasks. For example, we found multiple chat logs from a customer support chatbot owned by a prominent sex doll manufacturer,' the Cybernews research team said."}],"system.integration_type":[{"source_index":0,"quote":"302.ai acts as an intermediary between users and AI model providers."}],"system.intended_use":[{"source_index":0,"quote":"According to Cybernews, its customers can access major large language models, including ChatGPT, Claude, Grok, DeepSeek and Gemini."}],"event.detection_method":[{"source_index":0,"quote":"- 2 August 2026: Researchers discovered the exposed data."}],"event.near_miss":[{"source_index":0,"quote":"They found no evidence that malicious actors had accessed or downloaded the files."}],"event.responsible_party":[{"source_index":0,"quote":"The exposure occurred in 302.ai's storage infrastructure and does not establish that the AI model providers themselves suffered a breach."}],"event.adversarial_actor":[{"source_index":0,"quote":"They found no evidence that malicious actors had accessed or downloaded the files."}],"event.remediation":[{"source_index":0,"quote":"Cybernews said the data was taken offline after its researchers contacted 302.ai."}],"event.incident_class":[{"source_index":0,"quote":"Some chat logs contained dates of birth, genders, contact information and home addresses."}],"event.agent_involved":[{"source_index":0,"quote":"302.ai acts as an intermediary between users and AI model providers."}],"event.summary":[{"source_index":0,"quote":"302.ai acts as an intermediary between users and AI model providers."}],"impact.records_exposed":[{"source_index":0,"quote":"A security lapse at AI platform 302.ai left 17.6 million files totalling 22.72 terabytes publicly accessible, including more than 144,000 AI chat logs containing personal information and conversations linked to a prominent sex doll manufacturer, according to an investigation by Cybernews."}],"impact.harm_class":[{"source_index":0,"quote":"Some chat logs contained dates of birth, genders, contact information and home addresses."}],"impact.affected_description":[{"source_index":0,"quote":"A security lapse at AI platform 302.ai left 17.6 million files totalling 22.72 terabytes publicly accessible, including more than 144,000 AI chat logs containing personal information and conversations linked to a prominent sex doll manufacturer, according to an investigation by Cybernews."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"The exposed archive also included images, videos, audio files, documents and more than 26,000 ZIP files containing conversation data."}],"impact.severity_because":[{"source_index":0,"quote":"A security lapse at AI platform 302.ai left 17.6 million files totalling 22.72 terabytes publicly accessible, including more than 144,000 AI chat logs containing personal information and conversations linked to a prominent sex doll manufacturer, according to an investigation by Cybernews."}],"context.industry":[{"source_index":0,"quote":"302.ai acts as an intermediary between users and AI model providers."}],"context.country":[{"source_index":0,"quote":"302.ai is developed by Univerads Technology Limited, a Hong Kong-based company founded in 2020, according to Cybernews."}],"impact.severity":[{"source_index":0,"quote":"A security lapse at AI platform 302.ai left 17.6 million files totalling 22.72 terabytes publicly accessible, including more than 144,000 AI chat logs containing personal information and conversations linked to a prominent sex doll manufacturer, according to an investigation by Cybernews."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-23"}],"system.system_provider":[{"source_index":0,"quote":"302.ai is developed by Univerads Technology Limited, a Hong Kong-based company founded in 2020, according to Cybernews."}],"context.deployer":[{"source_index":0,"quote":"Researchers discovered 17.6 million files totalling 22.72TB in a publicly accessible Microsoft Azure storage bucket owned by 302.ai."}]},"notes_on_gaps":"Only one source (press, Cybernews-derived). No source states the model name or version, tools granted, permissions scope, autonomy level, guardrails present, safeguard state, production_intended, failure_class (no autonomous agent involved), trigger, input provenance, operations paused, precursor events, direct loss USD, remediation hours, third-party affected count, protected class, loss range, reversibility, downstream exposure count, org size band, denominator, systemic exposure, shared model id, upstream incident id, incident evidence, regulatory, or coverage. event.date_occurred is written as 2026-08 only from the discovery date; the actual exposure start is not stated. event.duration and event.time_to_contain are given as bounds (discovery 2 Aug 2026 to observed closure 8 Sep 2026) rather than stated durations. event.root_cause is unknown because the source explicitly says the specific failure was not established; the absence of stated security measures is a gap, not a failed guardrail. event.incident_class is privacy_leakage: personal data was publicly accessible with no attacker involved. event.agent_involved is false: 302.ai is an intermediary platform, not an autonomous agent. Severity major rests on the unbounded scope of 17.6 million files and many third parties' data in a live production platform; no dollar figure is stated. event.date_occurred: a source described it but did not state it; left null. event.root_cause: the stated reason names an absence, not a failed control: Cybernews could not determine how the data was left accessible, though it considered accidental exposure likely. system.tier: enterprise by rule (operator 302.ai (Univerads Technology Limited) differs from developer Univerads Technology Limited). [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-23] system.lifecycle_stage: production. system.deployment_context: production. system.autonomy_level: no source states the arrangement. event.responsible_party: deployer. event.agent_involved: classified from described behaviour. event.incident_class: a source states personal or confidential data reached a party not entitled to it, with no attacker driving it. event.summary: classified from described behaviour. event.trigger: no source states a cause. impact.harm_class: privacy. context.denominator_available: no denominator is available for this incident. [standard terms read by deepseek-chat / deepseek-reasoner, terms-2026-10-25.3 / terms-roles-2026-10-25.2 / terms-2026-10-25.3; values checked by Claude against their sentences, approved by Srini Iyer, 2026-10-25]"},"context":{"industry":"AI platform / intermediary services","org_size_band":null,"country":"HK","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null,"deployer":"302.ai"},"narrative":{"steps":[{"step":"doing","text":"302.ai, an intermediary platform run by Univerads Technology Limited, let customers use major LLMs including ChatGPT, Claude, Grok, DeepSeek and Gemini, and stored their chat logs and uploaded files in a Microsoft Azure bucket.","quote":"302.ai acts as an intermediary between users and AI model providers.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"Its Azure storage bucket was left publicly accessible, exposing 17.6 million files and 22.72TB, including chat logs with personal data; Cybernews could not establish the specific security failure.","quote":"Researchers discovered 17.6 million files totalling 22.72TB in a publicly accessible Microsoft Azure storage bucket owned by 302.ai.","source_index":0,"grade":"C"},{"step":"reached","text":"The archive held more than 144,000 chat logs with dates of birth, contact details and home addresses, plus images, videos, audio, documents and 26,000 ZIP files, including support chats of an unnamed sex doll manufacturer.","quote":"Some chat logs contained dates of birth, genders, contact information and home addresses.","source_index":0,"grade":"C"},{"step":"caught","text":"Cybernews researchers discovered the exposed data on 2 August 2026; no evidence was found that malicious actors had accessed or downloaded the files.","quote":"- 2 August 2026: Researchers discovered the exposed data.","source_index":0,"grade":"C"},{"step":"done","text":"After Cybernews contacted 302.ai, the storage was taken offline and observed closed on 8 September 2026; it is unresolved whether users were notified or further security changes made.","quote":"Cybernews said the data was taken offline after its researchers contacted 302.ai.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-23","source_urls":["https://www.techtimes.co.uk/302-ai-data-exposure-ai-chat-logs-1809352"]}}