An AI chat app leaked 300 million messages. Here is what sovereign AI would, and would not, have changed

On 20 January 2026, independent security researcher Harry reported that Chat & Ask AI, a chatbot app published by Turkish developer Codeway with more than 50 million installs across the Google Play Store and Apple's App Store, had left its backend database openly readable and writable by anyone who found its address, a finding also reported by Fox News. Codeway fixed it the same day, within hours of being told. Before that, the exposure covered roughly 300 million messages from around 25 million user accounts: full chat histories, timestamps, the AI model each user had selected, and custom chatbot names. Some of what was exposed was as sensitive as it gets. People had used the app to ask how to end their own lives, how to write a suicide note, how to manufacture drugs, and how to break into other apps.

This is a useful incident to sit with, not because it is unusual, but because it is ordinary. Nothing about the attack required skill. The fault behind it was a single configuration flag, and that is exactly why it is worth taking seriously.

What actually failed

Chat & Ask AI stored conversations in a Google Firebase database. Firebase, like most cloud database platforms, enforces access through a set of rules the developer writes: who may read, who may write, who may delete. Codeway had left those rules set to public, meaning no login, token or credential of any kind was required, only the project's address. That is not a sophisticated breach of an otherwise well-defended system. It is closer to a filing cabinet left on the pavement, unlocked, with a sign giving its exact location.

Harry did not stop at one app. Using an automated scanner, they checked 200 popular iOS apps for the same mistake and found it in 103 of them, collectively exposing tens of millions of further files. The Chat & Ask AI case was not an outlier. It was a sample from a population of apps making the same mistake, and this one happened to be a chatbot, which meant the payload was unusually personal.

The failure was not that an AI model behaved badly. It was that hundreds of millions of private conversations sat in one internet-reachable database, protected by a single setting that nobody had checked.

What an on-premises or air-gapped architecture would have changed

Set aside the specific company and ask the structural question: why did one public setting on one database expose 300 million people's conversations at once? The answer is concentration. Every user's conversation, across roughly 25 million accounts, was processed and stored by a single third-party vendor on shared, internet-facing cloud infrastructure, reachable from anywhere the moment a researcher, or an attacker, thought to check.

An architecture that keeps conversations on infrastructure the organisation itself controls, sovereign AI, running on your own hardware, or at the strict end fully air-gapped, removes the specific thing that made this leak possible at this scale: a single, internet-reachable, multi-tenant store holding everyone's conversations behind one configuration flag. There is no equivalent public endpoint to misconfigure if there is no public endpoint at all. British company Mickai builds a Sovereign Intelligence Operating System on exactly this premise: conversations and documents are processed on the customer's own hardware, with the inference boundary built so it cannot reach off the machine, rather than relying on a vendor's cloud configuration being correct on the day it matters.

What it would not have changed

Honesty matters more here than optimism. Moving processing on-premises does not make misconfiguration impossible. It relocates where the risk of misconfiguration sits. An internal database with the wrong access rules, an internal file share open to the wrong group, an admin account with a reused password, can expose data just as thoroughly as the Codeway database did, only to a smaller number of people inside the building rather than the whole internet. The difference is blast radius and who is accountable for it, not immunity from the mistake itself.

Nor does an on-premises system automatically mean better security engineering. The Chat & Ask AI leak was not caused by the app being cloud-hosted in some abstract sense. It was caused by nobody checking a setting before shipping. An organisation that moves AI on-premises and still skips that discipline will eventually produce its own version of this story, with a smaller audience but the same root cause.

The compliance angle

For a UK organisation handling personal or regulated data, the relevant question under data protection law is not whether an incident like this is embarrassing. It is whether the organisation can show it assessed the risk of the tools its staff actually use, before an incident, not after. Consumer chatbot apps of exactly this kind are often adopted informally by employees, sometimes called shadow AI, without any security review at all, because nobody formally approved them in the first place. An organisation cannot assess what it does not know is in use. A data processing record, an approved tool list and a basic vendor security review are unglamorous, but they are the practical difference between being able to answer a regulator's question and not.

Putting it together

The Chat & Ask AI leak is a case study in concentration risk, not in AI being uniquely dangerous. Hundreds of millions of sensitive conversations sat in one place, protected by one setting, inside infrastructure the people who typed those conversations had no visibility into and no ability to check. A sovereign or on-premises architecture removes that specific shape of exposure. It does not remove the need to get the basics right, on-premises or not, and it does not excuse an organisation from the plainer task of knowing which AI tools its own people are actually using.

---SOURCES--- - https://www.malwarebytes.com/blog/news/2026/02/ai-chat-app-leak-exposes-300-million-messages - https://www.foxnews.com/tech/millions-ai-chat-messages-exposed-app-data-leak - https://www.idstrong.com/sentinel/chat--ask-ai-data-breach - https://elephas.app/resources/codeway-chat-ask-ai-firebase-exposure