Case meta-ai-prompt-idorModel & data leakUnited States
Meta AI bug let any logged-in user read other people's private prompts and replies
AppSecure's Sandeep Hodkasia found that changing the guessable ID of an edited prompt returned another user's prompt and reply because Meta skipped authorisation checks. Meta fixed it in January 2025 and paid $10,000.
MediumAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Jul 15, 2025
- Location
- United States
- Target
- Meta AI chatbot
- Severity
- Medium
- Triggered by
- Sandeep Hodkasia (AppSecure)
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
AppSecure's Sandeep Hodkasia found that changing the guessable ID of an edited prompt returned another user's prompt and reply because Meta skipped authorisation checks. Meta fixed it in January 2025 and paid $10,000.
Impact: Private prompts and generated content could be scraped at scale; no abuse found
Who triggered it
Actor: Sandeep Hodkasia (AppSecure)
Attribution: Responsible disclosure via Meta bug bounty; Meta found no evidence of abuse
Motive: Security research
How it happened
Attack vector: Insecure direct object reference on prompt IDs in browser traffic
Root cause: Missing authorisation check on prompt retrieval endpoint
Timeline
- Bug reported to Meta
- Meta deploys a fix
- Public disclosure
Response
Meta patched the endpoint and rewarded the researcher
Current status: Patched
Sources (open in a new tab)
- TechCrunch techcrunch.com
- Malwarebytes malwarebytes.com
Cite this case
Meta AI bug let any logged-in user read other people's private prompts and replies. AI Threat Watch, case meta-ai-prompt-idor, Jul 15, 2025. https://aithreat.io/cases/meta-ai-prompt-idor/
Permanent link: https://aithreat.io/cases/meta-ai-prompt-idor/