R2 CopilotLeaks Radar · tracked AI data incidents
Every tracked incident where prompts, chat histories or AI-handled data ended up somewhere they should not have. Sourced, dated, and archived so the link still works after the original is edited.
Check Point found a fixed flaw where shared sandbox package metadata could let a malicious prompt make ChatGPT secretly run attacker tasks and leak connected-app data across accounts. OpenAI decommissioned the affected service.
Shared Claude chats and artifacts created with the anyone-with-a-link option were indexed by Google, exposing clinical trial data, access codes, resumes, API keys, and financial information.
Anthropic’s Claude chats, including a patient medical report and internal company files, were left exposed to Google via the "share" feature. Anthropic said the system was working as intended.
DeepSeek shared-chat links are being indexed by Google, making private conversations searchable. Researcher David Konitzny found the warning doesn’t mention search engine indexing.
Anthropic removed a hidden Claude Code tracker that flagged Chinese users via "prompt steganography" after a researcher exposed it. An engineer called it an "experiment."
A researcher found Claude Code hides markers in the "Today’s date is…" system prompt line, encoding user timezone and API URL data via invisible Unicode tricks.
Meta suspended its Model Capability Initiative after a leak made employee keystrokes, private conversations, performance data, and transcriptions accessible company-wide, in a SEV 2 incident.
A bug in Meta’s AI-assisted account recovery tool let hackers trick the chatbot into sending password reset codes to attacker-controlled emails, compromising over 20000 Instagram accounts.
A logic flaw in Meta’s AI-powered Instagram support chatbot let attackers bypass two-factor authentication by simply asking the bot to link a new email and reset the password.
A detailed breakdown of the Meta rogue AI agent incident that triggered a Sev 1 alert after flawed guidance led to internal exposure of sensitive company and user data for nearly two hours.
An internal Meta AI agent gave an engineer flawed guidance on a forum question; acting on it exposed sensitive company and user data to unauthorized employees for two hours.
GitGuardian’s report found 29 million secrets leaked on GitHub in 2025, a 34% jump, with AI-assisted commits leaking secrets at roughly double the baseline rate and AI credential leaks up 81%.
GitGuardian found 28.76 million secrets exposed on public GitHub in 2025, with over 113000 leaked DeepSeek API keys and Claude Code commits leaking secrets at over double the GitHub baseline rate.
A security researcher found an exposed Firebase database belonging to the Chat & Ask AI wrapper app, exposing 300 million messages from 25 million users across OpenAI, Anthropic, and Google models.
A misconfigured Firebase database exposed roughly 300 million messages from over 25 million users of the Chat & Ask AI app, which wraps ChatGPT, Claude, and Gemini.
Researchers found three Gemini vulnerabilities nicknamed the Trifecta that let hidden prompts in cloud logs and web pages trick the AI into leaking personal data and location; Google patched them.
Anthropic became the third AI firm whose Claude chats appeared in Google search. Despite blocking crawlers, ~600 shared conversations were indexed before removal.
Over 370,000 Grok chats were indexed by search engines, revealing sensitive prompts including medical questions, a password, and attempts to test the chatbot’s limits.
Nearly 300,000 Grok conversations were indexed by Google via the chatbot’s share feature, exposing medical details, passwords, and other sensitive prompts.
xAI published 370,000+ Grok chat transcripts to Google without users’ knowledge via its "share" button — some containing instructions for drugs, bombs, and a plot to kill Musk.
Follow the original source and the archived document where available.
Move AI traffic onto a path that is encrypted before it leaves the device.