AI aggregator 302.ai exposes 22.7TB of unencrypted data in breach

What was exposed

Cybernews researchers discovered an unprotected Azure storage bucket linked to AI aggregator 302.ai, containing 22.7TB of unencrypted data. The exposed dataset included over 17.6 million files, such as user prompts, AI responses, metadata, and sensitive corporate documents.

The breach also revealed personal information, including names, birth dates, genders, and postal addresses. Among the exposed chat logs were records from a sex doll manufacturer, demonstrating the breadth of sensitive data compromised.

The database was publicly accessible, non-password-protected, and remained exposed for at least a month after Cybernews reported the issue in early August 2026.

Who is behind 302.ai

302.ai was launched six years ago by Univerads Technology Limited, a Hong Kong-based company. The platform aggregates AI models like Chat-GPT and Claude, allowing users to interact with multiple AI services through a single interface.

Cybernews reached out to Univerads Technology after discovering the breach but received no response. It remains unclear whether the company directly maintains the exposed database or if it was managed by a third-party vendor.

Why this breach matters for operators

The incident underscores the risks of entrusting sensitive data to third-party AI platforms, particularly those with inadequate security measures. The exposed data could be exploited for phishing attacks, identity theft, or corporate espionage, as cybercriminals often use such information to craft targeted schemes.

The breach also highlights a recurring issue in cloud storage security: misconfigured or unprotected storage buckets. Organizations relying on cloud infrastructure must prioritize encryption, access controls, and regular audits to prevent similar exposures.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This breach is a stark reminder that convenience and integration—hallmarks of AI aggregators—come with compromises. Founders and operators using third-party AI tools must weigh the benefits of seamless access to multiple models against the potential cost of a security lapse. The fact that the database remained exposed for a month after discovery suggests a alarming gap in incident response, which could erode user trust just as quickly as a financial breach.

For startups building on or partnering with AI platforms, this incident is a case study in due diligence. Security practices, data handling policies, and crisis response plans should be non-negotiable criteria when selecting vendors. The lack of response from Univerads Technology also signals a reputational risk: in a market where trust is currency, silence is not a viable strategy.

Related on Lazyfounder

• AI cost optimization isn’t just about cheaper models—Uber’s budget crisis shows why
• More technology news