Meta AI Bug in Deployed Service Reportedly Allowed Potential Access to Other Users' Prompts and Responses

A security researcher reported a vulnerability in Meta AI's deployed chatbot service that, under certain conditions, could allow an unauthorized user to view another user's prompts and AI-generated responses. The flaw reportedly involved guessable prompt IDs and insufficient server-side authorization checks. Meta reportedly fixed the issue in January 2025 and found no evidence of malicious exploitation, awarding the researcher a bug bounty.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.2 AI system security vulnerabilities and attacks

The incident involved a critical security vulnerability in Meta AI's server-side authorization checks that allowed unauthorized access to private user prompts and responses.

Additional risk subdomains

• 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information: Confusing settings and the Discovery feed feature led to some users' private conversations with the chatbot being made publicly viewable.

Causal factors

• Entity: Human
• Intent: Unintentional
• Timing: Post-deployment

The security vulnerability was caused by an unintentional software engineering oversight by Meta's developers, which was discovered after the Meta AI chatbot had been deployed to the public.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The system is a chatbot ('Meta AI chatbot platform'), which falls under the category of AI systems that pose a moderate risk and require specific transparency obligations.

AI system and alleged parties

• AI system: Meta AI (Meta)
• AI purpose: Chatbot; Question Answering
• Behaviour type: Assistant
• Alleged developer: Meta
• Alleged deployer: Meta
• Alleged harmed parties: Meta users, General public

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Minor, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Minor
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Financial

Reported: The report describes 1 incident involving a $10,000 bug bounty payment, but no direct financial losses to users.

Directly caused: Meta paid a $10,000 bug bounty reward to the security researcher who discovered the vulnerability.

Privacy

Reported: The report explicitly describes potential privacy violations due to a security flaw that exposed private chats, though no active exploitation was detected.

Indirectly caused: Some users had their private conversations inadvertently shared publicly on Meta AI's Discovery feed due to confusing settings.

Inferred additional harm: It is possible that some unauthorized access occurred before the patch was deployed, but went undetected by Meta's internal investigation.

People affected

• Occurrences reported: 1

Potential causes

Management

• Rushed AI Product Launches: Pressure to compete led to launching AI products with security flaws.

Technology

• Predictable Prompt IDs: Prompt IDs were easily guessable, enabling sequential scanning.
• Missing Authorization Checks: The server failed to verify if the requester owned the prompt ID.

Human Factors

• Confusing Privacy Settings: Users inadvertently shared private chats due to confusing app settings.
• Vague User Warnings: Vague warnings left users unaware that prompts could become public.

Process and Methods

• Inadequate Security Testing: The IDOR vulnerability was not caught during internal security testing.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide clear, consistent details about the nature of the security vulnerability, the researcher who found it, the timeline of disclosure and patching, and the lack of evidence of malicious exploitation.
• Ambiguities identified: The exact number of users whose chats were exposed via the Discovery feed due to confusing settings is not specified.
• Alternative interpretations: None. The incident is clearly a security vulnerability disclosure.

A security researcher discovered an authorization vulnerability in Meta AI that could allow unauthorized access to private user chat histories. Meta successfully patched the flaw in January 2025 with no evidence of malicious exploitation. The incident represents a minor privacy exposure manageable through standard software security procedures, with negligible impact on national security.

• Overall national security impact: Minor
• Scope: Unknown
• Primary target: No clear primary
• Other affected: Unknown
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. The vulnerability was patched by Meta in January 2025, and there is no ongoing active threat or imminent crisis.
• Autonomy: Human-controlled. The issue stemmed from server-side authorization code, not autonomous AI decision-making.
• Novelty: Established threat. Insecure direct object reference (IDOR) and authorization bypasses are well-established, common web application vulnerabilities.

Impact by dimension

• Physical security: Negligible. No physical systems, critical infrastructure, or human safety were impacted or threatened by this software vulnerability.
• Information security: Negligible. Although private chat history was briefly vulnerable to unauthorized access, there is no evidence of malicious exploitation, intelligence compromise, or state-sponsored information warfare.
• Sovereignty: Negligible. The incident involved a commercial AI platform vulnerability and did not impact government decision-making, electoral processes, or state sovereignty.
• Economic security: Negligible. The incident resulted in a minor 10,000 dollar bug bounty payment by Meta. There was no theft of strategic technology, model weights, or disruption to critical financial infrastructure.
• Societal stability: Minor. The vulnerability and confusing settings exposed private user chats, representing a minor privacy risk. However, it was resolved through standard patching and security procedures without evidence of malicious exploitation.