AI aggregator 302.ai exposed 17.6 million files totaling 22.72 terabytes through a publicly accessible Microsoft Azure storage container with no encryption and no authentication, according to researchers at Cybernews. The cache included user chat logs, AI-generated images and videos, enterprise documents, and customer-support transcripts — all downloadable by anyone who knew the URL.
The bucket was secured after Cybernews contacted the company. Researchers said they found no evidence that malicious actors had already downloaded the data, but "no evidence" is not the same as "didn't happen" — public cloud buckets are routinely indexed by search engines like GrayhatWarfare, and the window of exposure is still unknown.
What was inside
The exposed storage was not a backup dump or a log directory. It was live user data:
| Data Type | Details |
|---|---|
| Conversation records | 144,000+ chat sessions with user prompts, assistant replies, timestamps, and token costs |
| Generated media | AI-created images, videos, and audio files produced through the platform |
| Documents | Uploaded files, archived conversations, and workspace materials |
| Personal data | Some personally identifiable information (PII) tied to user accounts |
| Enterprise logs | Customer-support chatbot transcripts from business clients, including a prominent sex doll manufacturer |
Source: Cybernews researchers, reported October 22, 2026 (UTC)
The sex doll manufacturer detail is more than a curiosity. It means 302.ai's clients — businesses that embedded AI chatbots into their own customer support flows — had their customer conversations exposed alongside 302.ai's direct users. A single misconfigured bucket at an aggregator becomes a breach for every company piping data through it.
Token cost metadata is another underappreciated exposure. Each conversation record included how much the interaction cost in API tokens, which reveals usage patterns, spending levels, and which models a business relies on. Competitors or attackers could mine that data to understand a target company's AI infrastructure without ever touching their internal systems.
How it happened
The vulnerability was not sophisticated. Azure Blob storage supports three access levels: private (no anonymous access), blob (anonymous read for individual blobs), and container (anonymous read for the entire container). 302.ai's storage was configured to allow public access — a setting that is literally one dropdown in the Azure portal, and one of the most common cloud misconfigurations in the wild.
Microsoft's own security guidance recommends keeping blob public access disabled at the storage account level and using shared access signatures (SAS) for time-limited, scoped access instead. 302.ai either never applied that recommendation or overrode it for convenience.
This is the same class of error that exposed 38 terabytes of Microsoft internal data in 2023 (a misconfigured SAS token) and 4 terabytes of Ernst & Young SQL backups in 2025 (a publicly accessible .BAK file on Azure). The pattern is consistent: a company stores something sensitive in the cloud, sets the access level wrong, and forgets about it.
Why it matters
The 302.ai leak is a warning about the AI aggregator business model specifically. Platforms like 302.ai, OpenRouter, and similar services sit between users and dozens of model providers, routing prompts and caching responses. That centralization makes them high-value targets — and high-consequence failures. When an aggregator leaks, it's not just one company's data. It's every user's prompts, every enterprise's documents, and every client's customer conversations, all in one place.
The scale is worth sitting with. 22.72 terabytes is roughly 5,600 hours of HD video, or 11 million printed books. The 17.6 million files include conversations where users likely pasted source code, internal strategy documents, medical questions, legal drafts, and other sensitive material — the kind of content people share with AI assistants precisely because they assume it's private.
302.ai is a Chinese company, which adds a data sovereignty dimension. International users who routed their AI workloads through a Chinese platform now have their chat logs potentially sitting in an Azure region under a company subject to Chinese data laws. Even if the bucket is closed, the question of where that data was replicated, backed up, or cached remains unanswered.
The "no evidence of malicious access" problem
Cybernews said it found no evidence that attackers had already accessed the data. That's the standard phrasing in these reports, and it should be read carefully. It means the researchers didn't find access logs showing bulk downloads — not that the data was never touched. Public Azure containers are continuously scanned by bots, researchers, and threat actors. GrayhatWarfare indexes millions of publicly exposed buckets and makes them searchable. A bucket that was open for days or weeks could have been downloaded by anyone, and the only trace might be in Azure's storage analytics logs — which 302.ai may or may not have enabled.
The responsible move for 302.ai would be to disclose how long the bucket was public, notify all affected users, and offer credit monitoring or identity protection for those whose PII was exposed. Whether that happens is an open question.
What to watch
- Exposure duration: If 302.ai discloses how long the bucket was public, that determines the real risk. If it was hours, the impact is limited. If it was months, assume the data is already circulating.
- User notification: Watch for whether 302.ai emails affected users or stays silent. Aggregators that don't notify set a precedent that user data exposure doesn't require accountability.
- Enterprise fallout: The sex doll manufacturer and other business clients may terminate their 302.ai contracts. Customer support chat logs are regulated under privacy laws like GDPR and CCPA, and exposing them could trigger regulatory fines beyond 302.ai itself.
- Industry response: Expect OpenRouter, Poe, and other AI aggregators to audit their own storage configurations. This breach is a wake-up call for the entire middle layer of the AI stack.
- Azure security defaults: Microsoft may face renewed pressure to make private access the unchangeable default for new storage accounts, rather than a configurable option that companies get wrong.
The AI industry has spent the past year arguing about model safety, alignment, and existential risk. Meanwhile, the boring stuff — a misconfigured storage bucket — just exposed 22.72 terabytes of real people's conversations. The biggest AI security story of 2026 might not be a model escape or a jailbreak. It might be that nobody remembered to click "private."
No comments yet