Last month, a security researcher found 300 million messages from 25 million users sitting in a publicly accessible database. No hack. Just a misconfigured backend on a wrapper chatbot built on top of Claude, ChatGPT, and Gemini.
Medical questions, legal discussions, personal confessions, all of it free for the taking. The worst part? It wasn't even an attack. Just negligence.
It’s enough to give those concerned about privacy a scare, and then there’s the more deliberate stuff some companies are doing: LinkedIn quietly opted users into AI training. Google flipped Gmail access on by default for its AI model Gemini. Meta cited "legitimate interest" to train on years of EU users' Facebook posts. A court ordered OpenAI to preserve all ChatGPT logs—including deleted ones—for legal discovery.
