Meta Patches Glitch That Exposed Private AI Chats
Security researcher Sandeep Hodkasia reported a potentially serious flaw in Meta’s AI chatbot in late December 2024—one that could have allowed users to view other people’s private chat prompts and AI-generated responses. The issue stemmed from the way Meta assigned unique numeric IDs to each prompt-and-response pair. By tweaking these IDs during editing, Hodkasia discovered he could pull up entirely different users’ conversations.
Why It Was Risky
Because those numeric IDs were sequential and predictable, someone could automate requests to harvest private interactions. Meta’s system didn't verify whether the person requesting the content was authorized to see it—leaving the door wide open for data exposure .
Patch, Reward, and Assurance
Meta responded by deploying a fix on January 24, 2025, and awarded Hodkasia a $10,000 bounty for his responsible disclosure. The company reported that it found no evidence the vulnerability had been exploited before the patch was applied . Meta spokesperson Ryan Daniels confirmed the fix and reinforced that privacy had not been compromised.
Trust in a Time of AI Privacy Challenges
This incident comes at a delicate moment for tech giants rushing to roll out AI features. Meta’s standalone AI chatbot, introduced earlier this year, already faced backlash when users inadvertently shared sensitive or private content publicly without realizing it. The flaw underscores how even small implementation details can undermine user privacy and trust during rapid AI expansion.