302.ai Exposed AI Chat Logs. Who Keeps Your Conversations?
Researchers report exposed 302.ai chats and files. Learn which copies an AI app may keep, what remains unclear, and what to check before sharing sensitive data.
Cybernews researchers report that AI aggregator 302.ai exposed 17.6 million files, including more than 144,000 chat logs, in publicly accessible cloud storage. They say the exposure is now closed and they have no evidence of malicious downloads. The practical lesson: choosing a model does not tell you what the app between you and that model stores.
By OpenVeil Editorial. Research cutoff and last source review: October 28, 2026. This analysis distinguishes the researchers' findings from independently verified customer impact. The reporting concerns an exposure discovered in August and observed closed in September, not a newly discovered live leak today.
Who This Is For
This guide is for people comparing AI chat services, creators uploading reference material, and teams considering a shared interface for several models. It is not a claim that every AI aggregator has the same practices, or that paying for a service makes it private.
The decision question is simple: what additional copies does this particular application create, and who controls each one?
What Is Confirmed
What the researchers reported
In their primary investigation, Cybernews describes a 22.72 TB Azure storage exposure involving prompts, replies, media, documents, and conversation archives. Its disclosure timeline lists discovery on August 2, notification on August 11, and closure observed on September 8, 2026. The report says the company had not responded to its request for comment.
Those are the investigation's findings, not a count of affected people. TechRadar's October 22 coverage establishes broader attention, but is reporting the same investigation rather than independently measuring the storage.
Cybernews states: “We have no evidence that malicious actors accessed or downloaded the data.” That qualification belongs beside the scale of the reported exposure, not hidden behind it. We reviewed the public reporting and storage documentation; we did not access exposed files, test 302.ai's infrastructure, or independently audit its customer records.
What Azure's documentation establishes
Microsoft's anonymous-access guidance explains that Azure Blob Storage can permit reads without authentication when account and container settings allow them. Microsoft recommends disabling that access when it is unnecessary. Account-level denial overrides individual container access settings.
This describes a documented configuration boundary, not evidence that Azure itself was breached. It also does not independently establish which exact settings were present in the reported incident.
What Is Still Unclear
The reviewed primary report does not establish a complete list of affected users, whether outsiders copied the material, or the scope of any resulting misuse. Exposure is not proof of theft; lack of evidence of theft is not proof that nobody accessed it.
Readers should also avoid treating the investigation as a live security audit. A statement that an exposure was closed is not an assessment of every current application, storage path, or deletion process.
The Original Decision Tool: A Four-Copy Privacy Map
Here is a practical framework for comparing any hosted AI workspace. It is an analytical checklist, not a reconstruction of 302.ai's internal architecture.
| Possible copy | Question to ask | Evidence worth requesting |
|---|---|---|
| Browser history | Does the interface keep conversations on this device, in an account, or both? | A clear history description and what happens on another device |
| Application records | Does the app retain prompts, outputs, uploads, exports, or generated media? | A record-by-record retention explanation |
| Model or tool processing | Which provider receives the active request or attached content? | Processor disclosures and the terms covering that feature |
| Secondary copies | Can logs, support tickets, shared links, archives, or backups contain the content? | Separate policies and deletion procedures for each destination |
These questions matter because controls can apply to different copies. A conversation-history switch might govern only the visible chat list. A model's training exclusion might govern one provider's use of inputs without answering what an intermediary keeps for its own features.
Treat every unanswered cell as an unanswered question, rather than silently translating it into “not stored.”
A synthetic example you can use without real client data
Imagine a designer submits a fictional brief containing the invented project name Copper Lantern Demo. Before sending real work, the designer asks the service to explain whether that phrase could appear in account history, upload records, processing logs, or a downloadable archive.
The phrase is a discussion aid, not a security test. Failing to find it in a visible export would not prove it never reached another system. The useful result is a specific answer about destinations and retention, not a reassuring screenshot of an empty history panel.
What To Check Before Choosing An AI Aggregator
Use the same checklist whether an app offers one model or many:
- Identify the contracting service. Know which company operates the interface, rather than relying on the names of models displayed inside it.
- Separate history from processing. Ask where saved conversations live and where an active request goes. These are different questions.
- Ask about uploads and outputs separately. A policy for chat text is not automatically a policy for reference photos, audio, video, or generated files.
- Read training terms in context. Check whose promise it is, which plan and feature it covers, and whether the intermediary makes its own promise.
- Request a deletion map. Distinguish deleting a conversation, removing an uploaded file, revoking a share link, and requesting deletion of secondary records.
- Check who can access retained material. Look for an explanation of authenticated access, support access, and public sharing rather than assuming that a hard-to-guess link is private.
- Use approved workflows for restricted information. A convenient interface is not authorization to submit someone else's confidential records.
If a service cannot explain the difference between these controls, reduce the sensitivity of what you submit until you have an adequate answer. Do not infer a hidden technical guarantee from a marketing label.
What Existing Users Can Do
Start by making a private inventory of the categories of material you submitted. You do not need to paste that inventory into another AI service. Identify whether it included ordinary creative prompts, confidential work, personal information, or actual credentials.
Ask the service for incident-specific information and the deletion process applicable to your account and files. Keep its response and any notices for your own records. Do not search for or download exposed datasets to check your account: that could reveal other people's private information and is not necessary to ask for help.
If organizational material was involved, follow your organization's incident-reporting process rather than improvising public disclosure. If you submitted a real secret, ask the system's owner to assess revocation or rotation; deleting a chat is not a substitute for controlling the credential itself.
These are precautionary workflow suggestions. They are not evidence that any particular reader's information was included in this incident.
What This Does Not Mean
A storage exposure does not show that foundation models trained on the exposed material. It does not establish that all services using the same cloud provider are vulnerable. Nor does it prove that a different app with fewer model choices is inherently safer.
The relevant comparison is the complete application's data handling. Model brand, hosting brand, encryption terminology, retention, authentication, and public-sharing controls answer different questions.
For more background, read our guides to browser-local AI chat history, private hosted AI versus local AI, and comparing private ChatGPT alternatives.
Where OpenVeil Fits—and Where It Does Not
OpenVeil is a hosted, privacy-focused AI workspace for adults. Normal private-chat history is browser-local rather than a normal server-side chat-history account record. Its documented features include chat, search, uploads, voice, image tools, and video on paid plans.
That history boundary is not a claim that generated media, account and billing records, or operational processing cease to exist. Active requests may still be processed by OpenVeil and necessary providers. OpenVeil is not fully offline, anonymous, a zero-logging service, or protection against information already submitted to another application.
If your goal is a hosted workspace without a normal server-side chat-history account archive, compare OpenVeil and its privacy policy against the four-copy checklist. For regulated or contract-restricted work, establish approval and required agreements before submitting the material to any hosted AI tool.
Frequently Asked Questions
Does a private model make the surrounding app private?
Not by itself. Ask what the model provider processes and what the surrounding application stores, shares, and deletes. A statement about one component does not describe every copy.
Does deleting browser history delete a provider's records?
Do not assume so. Browser-side deletion and provider-side deletion operate on different systems. Ask which action addresses each record category.
Does “not used for training” mean “not retained”?
No. Training use and retention are different controls. Request an explicit answer to both questions for the exact feature and plan you use.
Should I stop using every AI aggregator?
The better response is to evaluate the operator and the complete data path. Multiple model choices are a feature, not a privacy guarantee or proof of a security failure.
Bottom Line
Before choosing an AI workspace, trace the copies—not just the model names. The strongest useful answer identifies the destination, purpose, retention, access controls, and deletion procedure for each type of record. An unanswered privacy question should stay visible until it is answered.
Sources: Cybernews investigation, TechRadar coverage, and Microsoft's Azure anonymous-access guidance. Incident claims remain attributed to their source; the four-copy checklist and synthetic example are OpenVeil editorial analysis.