{"id":179,"date":"2026-10-29T07:16:49","date_gmt":"2026-10-29T07:16:49","guid":{"rendered":"https:\/\/bugskan.com\/?p=179"},"modified":"2026-10-29T07:16:50","modified_gmt":"2026-10-29T07:16:50","slug":"chat-ask-ai-exposure-report-points-to-database-authorization-not-model-provider-compromise","status":"publish","type":"post","link":"https:\/\/bugskan.com\/index.php\/2026\/10\/29\/chat-ask-ai-exposure-report-points-to-database-authorization-not-model-provider-compromise\/","title":{"rendered":"Chat &#038; Ask AI exposure report points to database authorization, not model-provider compromise"},"content":{"rendered":"<p>February 2026 reporting, citing 404 Media, described a database-access weakness in the Chat &amp; Ask AI mobile app. A researcher reportedly accessed conversation records through Firebase authorization rules that did not adequately separate users.<\/p>\n<p>The reported volume was approximately 300 million messages associated with 25 million users. Those are attributed researcher figures, not an independently verified count of criminal theft. Model names offered inside the app do not make their providers the breached operators.<\/p>\n<p>Users should review the app operator\u2019s notices and avoid putting sensitive information into unapproved third-party chat clients. Developers should test record-level authorization with accounts that have only ordinary user privileges.<\/p>\n<p><a href=\"https:\/\/cybersecuritynews.com\/ai-chat-app-exposes-messages\">Read the original source<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Reporting described researcher access to large volumes of conversations through the third-party app\u2019s Firebase backend.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"bugskan_incident_id":"inc_6af97a29e5cef1","bugskan_event_type":"breach","bugskan_response":"REVIEW","bugskan_technical_severity":"","bugskan_technical_severity_source":"","bugskan_evidence_quality":"medium","bugskan_affected_scope":"The third-party app database described in the reporting.","bugskan_recommended_next_step":"Review operator notices and test per-user database authorization in similar applications.","bugskan_who_should_check":"","bugskan_material_updated_at":"2026-02-10T00:00:00Z","bugskan_reviewer_name":"","bugskan_reviewed_at":"","bugskan_legacy_state":"mapped","bugskan_featured":false,"bugskan_sample":false,"footnotes":""},"categories":[1],"tags":[],"bugskan_format":[2],"bugskan_technology":[49],"class_list":["post-179","post","type-post","status-publish","format-standard","hentry","category-uncategorized","bugskan_format-security-brief","bugskan_technology-chat-ask-ai"],"_links":{"self":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/179","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/comments?post=179"}],"version-history":[{"count":1,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/179\/revisions"}],"predecessor-version":[{"id":372,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/179\/revisions\/372"}],"wp:attachment":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/media?parent=179"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/categories?post=179"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/tags?post=179"},{"taxonomy":"bugskan_format","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/bugskan_format?post=179"},{"taxonomy":"bugskan_technology","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/bugskan_technology?post=179"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}