Skip to main content
Incident intelligence/SS-IR-073CASE FILE OPEN
Symbolic editorial illustration for SS-IR-073SERVANTSTACK // INCIDENT INTELLIGENCEFORENSIC IMAGE // VERIFIED FRAME
SS-IR-073 // INCIDENT REPORTDocumented

Codeway / Chat & Ask AI

Public Firebase Rules Spilled 300M Private Chats From 25M Users

EXECUTIVE BRIEF

Chat & Ask AI, a generative-AI chatbot app with more than 50 million downloads built by Turkish firm Codeway, exposed roughly 300 million private user messages tied to about 25 million users.

CHATBOTS & LLMsDATA & CYBER SECURITY
FAILURE CHAINTRACE COMPLETE
  1. 01TRIGGERChat & Ask AI, a generative-AI chatbot app with more than 50 million downloads built by Turkish firm Codeway, exposed…
  2. 02MACHINE ACTIONAdvisory output
  3. 03MISSING GATEApproval gate, change freeze, and rollback validation
  4. 04IMPACTData security
01 // INCIDENT SUMMARY

The short version

Chat & Ask AI, a generative-AI chatbot app with more than 50 million downloads built by Turkish firm Codeway, exposed roughly 300 million private user messages tied to about 25 million users.

02 // KEY FACTS

Case telemetry

INCIDENT
SS-IR-073
DATE
February 2026
SYSTEM
Codeway / Chat & Ask AI
LOCATION / SCOPE
Global (app maker Codeway, Istanbul, Turkey)
EVIDENCE
Documented
AI ROLE
Advisory output
HARM
Data security
SOURCES
3 cited records
03ENTRY POINT // WHAT HAPPENED

The event

Chat & Ask AI, a generative-AI chatbot app with more than 50 million downloads built by Turkish firm Codeway, exposed roughly 300 million private user messages tied to about 25 million users. The data sat in a Google Firebase backend whose Security Rules were left set to public, meaning anyone who knew the project URL could read, modify, or delete the data with no authentication and no password. The spilled records included full chat histories, the AI models used, user settings, and the custom names people had assigned to their bots. Some conversations were deeply sensitive, reportedly including discussions of illegal activity and requests for suicide assistance. Independent researcher "Harry" found the flaw and disclosed it to Codeway on January 20, 2026; the company closed the hole across its apps within hours. Harry then scanned 200 iOS apps and found 103 had the identical misconfiguration, exposing tens of millions more files.

04CAUSAL TRACE // AI'S ACTUAL ROLE

What the machine did

The AI product itself functioned as designed; the failure was in the unreviewed cloud configuration that stored everything it produced. The most intimate output of the chatbot -- complete conversation transcripts including crisis-level disclosures -- was written to a datastore whose access-control rules were never validated against the sensitivity of what they protected. No human security SME signed off on the Firebase Security Rules before they shipped to 25 million users, and no change-validation gate flagged that "allow public read" was wired to the production database. The default-permissive posture went live and stayed live, undetected internally, until an outside researcher noticed. The duration of exposure before discovery remains unknown.

Advisory outputAutomation was a causal participant—not a decorative label for the system around it.
05BLAST RADIUS // CONSEQUENCES

Where the failure landed

Approximately 300 million messages from about 25 million users were left openly readable and deletable by anyone on the internet. The exposed content included identifiable details (custom bot names tied to user files) and uniquely harmful material such as suicide-assistance requests and admissions of illegal activity, creating extortion, doxxing, and safety risks far beyond a typical credential leak. Because the same Firebase flaw spanned 103 of 200 tested iOS apps, the incident exposed a systemic pattern across the mobile-AI ecosystem rather than a single vendor's mistake. Codeway remediated within hours of disclosure, but the window of prior exposure could not be determined, so the full extent of unauthorized access is unmeasurable.

06 // EVIDENCE STATUS

Documented

Supported by a first-party disclosure, technical research, or corroborated reporting cited below.

SOURCE RECORD UPDATED 2026-07-09

07 // SOURCE LEDGER

3 cited records

  1. 01
  2. 02
  3. 03
08CONTROL FAILURE // MISSING GOVERNANCE

Approval gate, change freeze, and rollback validation

The failure pattern in this case: Automation executed an irreversible production change.

09INTERVENTION POINT // HUMAN IN THE MIDDLE

The moment the path could change

An accountable operator reviews scope and rollback evidence before destructive or production-wide execution.

AI PROPOSES→HUMAN OWNS THE DECISION→SYSTEM EXECUTES
10CONTROL DEPLOYMENT // AUTHORITYGATE

Approval gate · change freeze · rollback

The AuthorityGate Operational Resilience framework requires a human security SME change-validation gate on any infrastructure-as-code or backend access-rule change before it reaches production. Firebase Security Rules, IAM policies, and storage-bucket ACLs are designated high-sensitivity artifacts: a proposed rule set that grants public or unauthenticated read/write to a datastore holding user conversation content cannot deploy until a named human reviewer explicitly approves it against a data-classification checklist that maps the store's contents (here, full chat transcripts including crisis disclosures) to a required minimum access posture. A rule reading "allow read: if true" on a production user-data collection is a hard-stop condition the gate is designed to catch and block, with the deploy held pending SME sign-off rather than shipped on a developer default. The same gate runs at release time across every app in a shared backend, so a templated misconfiguration cannot silently propagate to 100-plus products.

RELEVANT KEYSTONE CONTROLChange ValidationThe validation layer between a proposed production change and permission to execute it.
12 // THE ALTERNATIVE

Autonomy is a design choice.

See the operating model that keeps AI useful while preserving human authority at consequential moments.

Compare AgenticAI and AugmentedAI →