Case gaggle-vancouver-student-records-exposureModel & data leakUnited States
AP/Seattle Times obtain ~3,500 unredacted student files flagged by Gaggle AI monitoring in Vancouver, WA
A records request by The Seattle Times and AP returned links to nearly 3,500 unredacted screenshots of student writing flagged by Gaggle's AI surveillance, covering suicide, depression, abuse and sexuality, viewable by anyone with the link and without a password. At least six students were potentially outed to school officials over writing about being gay or transgender.
HighHarm caused by AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Mar 12, 2025
- Location
- United States
- Target
- Students of Vancouver Public Schools, Washington
- Severity
- High
- Verification
- Confirmed by victim, vendor or authority
- Triggered by
- Gaggle AI student-monitoring platform / Vancouver Public Schools
- Actor type
- AI product design / safeguards
- Sector
- Education & research
- Reported loss
- None reported
- CVE
- None
What happened
A records request by The Seattle Times and AP returned links to nearly 3,500 unredacted screenshots of student writing flagged by Gaggle's AI surveillance, covering suicide, depression, abuse and sexuality, viewable by anyone with the link and without a password. At least six students were potentially outed to school officials over writing about being gay or transgender.
Impact: Sensitive mental-health, abuse and sexuality content of identifiable students exposed to reporters; Gaggle monitors about 6 million students in ~1,500 districts
Who triggered it
Actor: Gaggle AI student-monitoring platform / Vancouver Public Schools
Attribution: AP and The Seattle Times; district apologised and Gaggle confirmed the link-access design
Motive: None (design flaw)
How it happened
Attack vector: Unauthenticated links to screenshots of AI-flagged student content
Root cause: Gaggle alert screenshots were accessible without login; district released links without realising they were unprotected
Timeline
- AP and The Seattle Times publish investigation into Gaggle in Vancouver Public Schools
- Gaggle says screenshot links now require login after 72 hours
Response
District apologised; Gaggle changed the system so screenshots require login after 72 hours
Current status: Contained
Research warnings this case matches
- Seen in real incidents Privacy and security · MIT AI Risk Repository
Compared with published AI risk research from several institutes on the Research vs reality page.
Sources (open in a new tab)
- AP / The Seattle Times via The Hechinger Report hechingerreport.org
- AP via News4Jax news4jax.com
Cite this case
AP/Seattle Times obtain ~3,500 unredacted student files flagged by Gaggle AI monitoring in Vancouver, WA. AI Threat Watch, case gaggle-vancouver-student-records-exposure, Mar 12, 2025. https://aithreat.io/cases/gaggle-vancouver-student-records-exposure/
Permanent link: https://aithreat.io/cases/gaggle-vancouver-student-records-exposure/
Related cases
The same type of incident, most recent first.