Meta AI privacy flaw allowed access to other users' prompts and responses
A security researcher discovered a bug in Meta AI's chatbot platform that potentially allowed access to other users' private prompts and AI-generated responses through easily guessable identification numbers. Meta fixed the vulnerability in January 2025 after being notified in December 2024 and reported finding no evidence of malicious exploitation.
What happened
Sandeep Hodkasia, founder of security firm AppSecure, discovered a bug in Meta AI's prompt editing feature. When users edit or regenerate prompts, Meta's servers assign each prompt and response a unique identification number (ID), which Hodkasia found were easily guessable and visible through browser tools.
By manually changing the ID in his browser's network activity panel, Hodkasia was able to access other users' private prompts and AI-generated responses. Meta's servers did not verify whether the person requesting to view the content was the one who had created it, meaning a malicious actor could have written a script to automatically cycle through IDs and collect sensitive content from multiple users.
Reported impact
The vulnerability potentially exposed users' private AI interactions and AI-generated content to unauthorized access. Any hacker with basic technical skills could have exploited the flaw to scrape large amounts of sensitive content from other users without authorization.
Index analysis
The bug bypassed user-specific access checks by failing to verify authorization of users requesting access to prompts and responses. The easily guessable ID structure made it simple for malicious actors to identify and retrieve other users' content through automated tools.
Governance controls
Hodkasia reported the vulnerability to Meta on 26 December 2024. Meta deployed a fix on 24 January 2025 and confirmed to TechCrunch that their internal investigation found no evidence that the bug had been misused or exploited. Hodkasia was awarded a bug bounty of $10,000 for privately disclosing the vulnerability.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.