Chatbots Leak Data Through Unprotected Server

Researchers at Cybernews recently uncovered a major exposure involving chatbots and Vyro AI, a Pakistan-based developer of popular generative AI tools.

Cybernews reporter Paulina Okunytė writes that an unsecured Elasticsearch instance linked to the company was leaking 116GB of real-time user logs from three widely used applications: ImagineArt, Chatly, and Chatbotx.

The size of the exposure and the popularity of these apps make this a significant incident, as the data streams involved sensitive material, including authentication tokens and user interactions.

Vyro AI’s applications have a large footprint, with claims of more than 150 million downloads and millions of images generated each week. The leak involved both production and development environments, storing several days’ worth of logs.

According to researchers, the database was indexed by search engines as early as February, leaving it potentially exposed for months.

Because ImagineArt alone has more than 10 million Android installs, leaked data such as access tokens could have enabled attackers to seize accounts at scale, access chat histories, or conduct fraudulent purchases of AI tokens.

The incident raises concerns about the privacy of user prompts. Conversations with chatbots often contain personal or sensitive information, which could be revealed if exposed logs were misused.

Similar issues have affected other providers. In August 2025, conversations with ChatGPT and Grok surfaced on Google search due to a flawed sharing feature.

Other research demonstrated how inadequately protected chatbots could produce dangerous outputs or expose companies to liability. Even advanced models like GPT-5 have been jailbroken shortly after release, demonstrating persistent gaps in safety.

Attorneys should note that data leaks of this scale pose a significant threat to privacy, exposing them to regulatory scrutiny, potential contract disputes, and class action litigation.