PrivacyMedium
Meta AI Bug in Deployed Service Reportedly Allowed Potential Access to Other Users' Prompts and Responses
- Occurred
- Dec 26, 2024
- Published
- Jul 15, 2025
- Source
- AI Incident Database
Summary
A security researcher reported a vulnerability in Meta AI's deployed chatbot service that, under certain conditions, could allow an unauthorized user to view another user's prompts and AI-generated responses. The flaw reportedly involved guessable prompt IDs and insufficient server-side authorization checks. Meta reportedly fixed the issue in January 2025 and found no evidence of malicious exploitation, awarding the researcher a bug bounty.
Developers
- Meta
- Large language model developers
- Chatbot developers
Deployers
- Meta
Harmed parties
- Meta users
- Meta AI users
- General public
- Privacy
- Biometric data subjects
Classification
Category confidence: 95%
Severity confidence: 90%
Rationale: Unauthorized access to user prompts and responses constitutes a privacy breach, though no malicious exploitation was confirmed.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8