Archive — US — techcrunch
Meta fixes bug that could leak users’ AI prompts and generated content
Meta resolved a security flaw in its AI chatbot that could leak users' private prompts and AI-generated responses. Discovered by security researcher Sandeep Hodkasia, the bug allowed unauthorized access through guessable identifiers. Meta awarded him $10,000 for reporting it and confirmed no evidence of malicious exploitation. The fix was deployed on January 24, 2025, amid heightened scrutiny on AI privacy.
Key points
- Meta AI chatbot had a bug allowing users to access others' private prompts.
- Sandeep Hodkasia discovered the bug while editing prompts, allowing access through unique numeric identifiers.
- The identifiers were easily guessable, posing a risk of scraping prompts with automation.
- Meta acknowledged the issue, rewarded Hodkasia $10,000, and reported no abuse of the bug.
- The bug was fixed on January 24, 2025, as part of ongoing efforts to enhance AI product security.
Why it matters
- The incident underscores ongoing challenges in AI security and user privacy, especially as AI adoption grows in 2025.
- Tech giants like Meta are under increasing scrutiny to protect user data amidst rapid AI product developments.
- Similar incidents have raised concerns over privacy in AI products, reflecting a trend towards more stringent data protection measures.
Meta's swift action to fix the security bug illustrates the critical need for robust protections in AI applications, as user privacy remains a top priority amid the growing focus on AI technology advancements.