What was exposed and where
Cybernews researchers found an unprotected Azure storage bucket belonging to 302.ai, a six-year-old platform operated by Hong Kong-based Univerads Technology Limited that lets users switch between multiple underlying AI models from one interface. The bucket held approximately 17.6 million files totaling 22.72TB, broken down as roughly 9TB of images, 7.7TB of video, 5.6TB of audio, and about 500GB of user chat logs stored across more than 144,000 individual JSON files.
The chat logs are the part of this exposure that matters most for an enterprise audience. They recorded the actual prompts users submitted, the model's responses, which specific model handled each request, the token cost incurred, and a timestamp for each exchange. That combination turns a storage misconfiguration into a direct window onto what employees and customers were actually asking an AI system to do, and what sensitive material they were willing to paste into a prompt box to get an answer.
An aggregator most IT departments never approved
302.ai's pitch, letting users pick whichever underlying model fits a given task without juggling separate accounts and separate bills, is exactly the kind of convenience tool that spreads through an organization without ever going through a formal security review. Nobody has to request budget or file a procurement ticket to try an aggregator that offers a quick way to compare model outputs, which means these tools often enter a company through individual employees rather than through IT.
That entry path is precisely why this exposure matters beyond its own user base. Any enterprise with employees who found 302.ai convenient now has to assume that whatever those employees typed into it, customer names, contract terms, source code, internal strategy, sat in an unprotected storage bucket for an unknown period before Cybernews found it. The convenience that drove adoption is the same convenience that made the exposure invisible to anyone responsible for approving where company data goes.
The prompts prove shadow AI is already enterprise AI
Among the exposed logs, researchers identified chat history from a customer support chatbot operated by a sex doll manufacturer, built on top of 302.ai's aggregation layer. Whatever one makes of the specific company involved, the underlying fact is the significant finding: a real business had wired a customer-facing support function directly into this aggregator, trusting it with live customer conversations as a production dependency rather than a casual experiment that stayed confined to a sandbox or an internal pilot team.
That single example is unlikely to be unique. Shadow AI usage, employees and even whole business functions adopting AI tools outside any sanctioned procurement process, has moved well past isolated individual experimentation. This exposure offers rare, concrete evidence of exactly how far that usage has progressed inside real companies, and it should prompt any CTO who assumes shadow AI is limited to occasional ad hoc queries to reconsider how embedded these tools may already be in actual business workflows.
The token-cost metadata is a tell
It is worth noting precisely what the exposed logs recorded alongside each prompt: which model handled the request and what it cost in tokens. That level of operational metadata indicates a platform built for users who care about cost and model selection at a granular level, the profile of a technically sophisticated user or a business integration, not a casual consumer trying a chatbot out of curiosity once or twice.
Combined with the personal details users supplied directly, names, birth dates, genders, addresses, and contact information, found in the same logs, this points to real business and personal use at meaningful scale rather than isolated testing. An aggregator attracting users who track model costs that closely is an aggregator being used for ongoing, repeated work, which raises the stakes of the exposure well beyond what a handful of one-off test queries would represent.
Why aggregator risk differs from a cloud misconfiguration
A misconfigured storage bucket at a bank or a retailer typically exposes that one company's own data. A misconfigured storage bucket at an AI aggregator exposes every customer's prompts and outputs at once, across every company that routed traffic through it, concentrated in one place. The aggregator model creates exactly the kind of single point of concentrated risk that security teams normally work hard to avoid building for their own infrastructure.
Univerads Technology's reported failure to respond to Cybernews' outreach, with the bucket staying open for roughly a month after discovery before being secured, adds a second layer of concern on top of the technical exposure itself. A vendor's technical security posture is only half of the risk calculation. Its incident response discipline, measured by how quickly it acts once a problem is reported, is the other half, and this vendor's performance on that measure fell well short of what any enterprise customer should accept.
The decision CTOs need to make now
If your organization has not explicitly decided which AI aggregators and multi-model gateways employees are permitted to use, this incident is the concrete evidence needed to force that decision now rather than later. Blocking every unsanctioned AI tool outright rarely works in practice, but leaving the question unaddressed guarantees that sensitive prompts keep flowing through platforms with unknown security practices and unverified incident response records, for as long as employees keep finding those platforms useful enough to reach for on their own.
A workable middle path is to publish a short, specific list of approved AI tools with enterprise-grade data handling terms, communicate it clearly, and treat any tool outside that list the way this incident suggests it deserves to be treated: as a vendor whose security posture is unverified until proven otherwise. The 500GB of chat logs sitting exposed here is what happens when that decision gets deferred long enough for employees to make it on their own, one convenient login at a time.
