This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
A security researcher identified a vulnerability in Meta AI that allowed unauthorized users to access private chat history and AI-generated content by manipulating guessable prompt IDs. The flaw stemmed from insufficient server-side authorization checks. Meta patched the vulnerability in January 2025 and reported no evidence of malicious exploitation.
A security researcher reported a vulnerability in Meta AI's deployed chatbot service that, under certain conditions, could allow an unauthorized user to view another user's prompts and AI-generated responses. The flaw reportedly involved guessable prompt IDs and insufficient server-side authorization checks. Meta reportedly fixed the issue in January 2025 and found no evidence of malicious exploitation, awarding the researcher a bug bounty.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Vulnerabilities that can be exploited in AI systems, software development toolchains, and hardware, resulting in unauthorized access, data and privacy breaches, or system manipulation causing unsafe outputs or behavior.
Also classified as
Confusing settings and the Discovery feed feature led to some users' private conversations with the chatbot being made publicly viewable.
The incident involved a critical security vulnerability in Meta AI's server-side authorization checks that allowed unauthorized access to private user prompts and responses.
Human
Due to a decision or action made by humans
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The security vulnerability was caused by an unintentional software engineering oversight by Meta's developers, which was discovered after the Meta AI chatbot had been deployed to the public.
A security researcher discovered an authorization vulnerability in Meta AI that could allow unauthorized access to private user chat histories. Meta successfully patched the flaw in January 2025 with no evidence of malicious exploitation. The incident represents a minor privacy exposure manageable through standard software security procedures, with negligible impact on national security.
The system is described as an 'AI chatbot platform' and 'AI assistant' designed to interact with users by responding to prompts and generating text or images, which fits the Assistant profile of augmenting human capabilities with human oversight.
Limited Risk: The system is a chatbot ('Meta AI chatbot platform'), which falls under the category of AI systems that pose a moderate risk and require specific transparency obligations.
The system is explicitly described as an AI chatbot platform and AI assistant designed to interact with users, answer prompts, and generate text and images.
The reports provide clear, consistent details about the nature of the security vulnerability, the researcher who found it, the timeline of disclosure and patching, and the lack of evidence of malicious exploitation.
None. The incident is clearly a security vulnerability disclosure.
Technology
Predictable Prompt IDs
Prompt IDs were easily guessable, enabling sequential scanning.
Missing Authorization Checks
The server failed to verify if the requester owned the prompt ID.
Human Factors
Confusing Privacy Settings
Users inadvertently shared private chats due to confusing app settings.
Vague User Warnings
Vague warnings left users unaware that prompts could become public.
Process and Methods
Inadequate Security Testing
The IDOR vulnerability was not caught during internal security testing.
Management
Rushed AI Product Launches
Pressure to compete led to launching AI products with security flaws.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
