AI Companion Apps Keep Leaking Private Chats

In the last year, millions of private messages from AI chat and companion apps have ended up exposed on the open internet. None of it took clever hacking. Here is what happened, why it keeps happening, what I checked on RolePlaya, and how to protect yourself on any platform.

What has leaked so far

These are the incidents publicly reported since October 2025. Figures are as stated by the researchers and the outlets that covered them.

When	What happened	Scale
October 2025	Two companion apps, Chattee Chat and GiMe Chat, left a streaming server open to the internet with no password. Found by researchers at Cybernews	43 million messages and over 600,000 photos and videos from more than 400,000 users, plus IP addresses, device identifiers and purchase records
February 2026	A general AI chat app, Chat & Ask AI, left its cloud database readable by anyone who found its address. Found by an independent researcher and fixed within hours of disclosure	Reportedly 300 million messages from over 25 million users
March 2026	Security firm Oversecured audited 17 AI companion apps on Android	14 critical and 311 high severity flaws. 10 of the 17 had a route to stored conversations and 6 had critical flaws in how chat data was handled

Chat & Ask AI is not a companion app, but people tell general chatbots just as much as they tell companions. Days after the audit, Oversecured published a second write-up describing a chatbot app with cloud login credentials hardcoded inside it, and a companion app whose chat screen could be made to run an attacker's code. They did not name the apps, and said the flaws were still unpatched when they published.

Why it keeps happening

What stands out is how ordinary the mistakes are. Nobody broke through a clever defence. The doors were left open.

• A server or database switched on for convenience and never locked. That was behind the first two incidents in the table.
• Secret keys baked into the app itself, where anyone who downloads it can pull them out.
• No check that the chat being requested belongs to the person asking. Change a number in a request and someone else's conversation comes back.
• A chat screen that trusts whatever text arrives, so a crafted message can run code on the reader's device.

Companion apps are built fast by small teams chasing growth, and they hold the most sensitive writing a person produces. The developer behind Chattee Chat and GiMe Chat reportedly earned over a million dollars from its apps. A password on that server would have cost almost nothing.

Why this data is different

A leaked password can be changed. A leaked conversation cannot. What people write to a companion or a roleplay character is often the most private thing they put into any app: fantasies, loneliness, relationship detail, things they have never said to another person.

Pair that with an IP address and a purchase record, as in the October leak, and it stops being anonymous. Much of the exposed material was adult in nature, which is exactly what makes exposure so personal and so easy to use against someone.

What I checked on RolePlaya

I run RolePlaya, so read this part as a disclosure rather than a verdict. After this wave of reports I went through the site looking for each of the failure types above, one at a time.

• No server or database open to the public, and no secret keys sitting anywhere a browser can download them.
• No exported chats sitting in a folder anyone could reach.
• On missing ownership checks I found two gaps. One could show a preview image of another member's private character to a logged in member. The other was a chat request that did not confirm the conversation belonged to the person sending it. Both are fixed.

I cannot promise nothing will ever go wrong, and nobody honestly can. What I can say is that I look, I fix what I find, and I tell you. If you spot a problem on RolePlaya, write to [email protected] and it gets read. The plain answer on who can read your chats is in Is AI Roleplay Private.

How to protect yourself on any platform

• Sign up with an email address that is not your main one, and a name that is not yours.
• Keep identifying detail out of chats: your surname, workplace, address, face photos.
• Check that the platform lets you delete chats and take your characters with you, and says what deletion removes. Here is how to export your characters from most platforms.
• Do not read store ratings or download counts as a sign of security. Some of the audited apps had more than 10 million installs.
• Never reuse a password between chat sites.
• Notice how a platform behaves after a problem. Plain and fast is a good sign. Silence is not.
• Assume anything you type could be read one day, and decide what you write on that basis.

Platforms also close without warning, and your chats can end up in strange hands when they do. We keep a record of who has gone dark.

Sources: Malwarebytes on the October 2025 leak, Malwarebytes on the February 2026 leak, SecurityBrief on the Oversecured audit and Oversecured's own write-up.

Common questions

Incident details come from public reporting by the researchers and outlets linked above and may change as investigations continue. Platform names are trademarks of their respective owners. RolePlaya is not affiliated with any of them. This page is general information and not security advice.