AI Risk Wire

Cases › leaked private data › LR-2026-0415

Chat & Ask AI Firebase misconfiguration exposes chat histories of about 25 million users

Preliminary Why: 1 report: Fox News · subject to change · 1 independent report

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: action reported, no fix

Severity major
Reported 5 Feb 2026
Developer and model Codeway

No source states: loss or records, agent tool, could do, deployer, industry.

Severity major: Test: many third parties (a stated count of two or more affected parties). Fact: roughly 300 million messages tied to more than 25 million users were accessible.

Chat & Ask AI, a mobile app with more than 50 million users, lets users talk to large language models from OpenAI, Anthropic and Google, and it stores their chat histories. A misconfigured Google Firebase backend let outsiders reach the app's database. An independent researcher named Harry said he could access roughly 300 million messages tied to more than 25 million users, and he analyzed a smaller sample to confirm the scope. The exposed data included full chat histories, timestamps, custom chatbot names and model settings, and the same exposure reached data from other Codeway apps. The misconfiguration is a known, documented Firebase weakness. The researcher reported it, and Codeway reportedly fixed the issue across all its apps within hours of responsible disclosure. Codeway did not respond to a request for comment before publication.

What happened

1 · What it was doingThe app acts as a wrapper that lets users chat with large language models from other companies.
2 · What went wrongThe app's backend on Google Firebase was misconfigured.
3 · What it reached or didThe researcher says he could access roughly 300 million messages tied to over 25 million users.
4 · How it was caughtAn independent security researcher named Harry discovered the issue.

What was done

Codeway reportedly fixed the issue across its apps within hours of responsible disclosure.

Risks

Privacy harm to a person
Primary41 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Application

Data minimisation · Sensitive-data checks on outbound data · Human approval for high-impact actions · Output filtering and redaction · People told they are dealing with AI · Risk assessment per deployment

Infrastructure / target

Bot and scraping defences

Evidence

No source states: when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, what set it off.

Show the full account: 3 items from the primary sources

What happened, in order

Not dated in the sources:

  • Researcher accessed roughly 300 million messages from over 25 million users.
  • Researcher discovered the misconfiguration.
  • Codeway was asked for comment and did not respond before the article was published.
Show every field, with its source and grade

The AI system

Developer
Codeway
C one secondary source states it
What it was for
Chat app that lets users talk to third-party large language models
C one secondary source states it

What happened

Earliest source we hold
2026-02-05
D inferred by us from the described behaviour, reason shown
Who caught it
an independent researcher or journalist
C one secondary source states it
Cause
a shared system was the path
C one secondary source states it
Cause in detail
Misconfigured Google Firebase backend let outsiders access the app's database
C one secondary source states it
What went wrong
leaked private data
C one secondary source states it
primary risk
RK15
D inferred by us from the described behaviour, reason shown

Impact

Severity
major
D inferred by us from the described behaviour, reason shown
Kind of harm
privacy
C one secondary source states it
Who was affected
Users of Chat & Ask AI and of other Codeway apps
C one secondary source states it
Why this severity
Test: many third parties (a stated count of two or more affected parties). Fact: roughly 300 million messages tied to more than 25 million users were accessible.
D inferred by us from the described behaviour, reason shown

Notes on gaps

Codeway did not respond to comment requests, and the researcher's claims are not independently verified.

LR-2026-0415 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON