Chat & Ask AI app — 300 million messages from 25 million users exposed via misconfigured Firebase
Date: 2026-02
Affected: Chat & Ask AI — 25 million users; 300 million messages
Attack vector: auth-bypass
Category: real-world
Severity: Critical

AI chat wrapper app (50M+ users, interfaces to ChatGPT/Claude/Gemini) had misconfigured Firebase backend allowing self-designation as authenticated user. 300 million messages from 25 million users exposed including illegal activity discussions and suicide assistance requests.

Impact: Massive privacy breach; exposure of sensitive conversations; regulatory risk

Mitigations:
Authentication enforcement validation
Data encryption at rest
Firebase security rules audit

Architectural layers (MAESTRO):
label: Deployment & Infrastructure
notes: Firebase authentication misconfiguration allows self-authentication
role: origin
label: Data Operations
notes: 300M messages from 25M users exposed
role: impact