302.ai Review: Security Risks After Azure Storage Leak

302.ai, an AI aggregator operated by Hong Kong-based Univerads Technology Limited, suffered a significant data exposure in 2026 when researchers found a publicly accessible Microsoft Azure storage bucket. The incident left 17.6 million files totaling 22.72 TB open without encryption or passwords. Users searching for a 302.ai review or asking "Is 302.ai safe?" need clear details on what happened and current risks.

302.ai Security Review: Details of the August 2026 Exposure

Cybernews researchers discovered the bucket on August 2, 2026. They notified the company on August 11. The storage remained open until at least September 8, 2026, when it was secured. The exposed content included roughly 9 TB of images, 7.7 TB of video, and 5.6 TB of audio, most of it AI-generated. More than 144,000 chat logs in JSON format contained user prompts, model selections, token costs, and timestamps. Over 26,000 ZIP archives held conversation histories and attached files.

Some logs included personal information such as names, birth dates, addresses, and contact details supplied by users. Enterprise logs from a sex-doll manufacturer also appeared. No evidence of external downloads has been confirmed, though researchers could not rule out prior access by others. The root cause was a common cloud misconfiguration rather than an external attack.

The company's privacy policy, last updated around 2022, does not address chat storage or encryption practices. Anyone who used 302.ai before September 2026 should assume prompts, replies, and uploaded files may have been visible.

Practical Steps After the 302.ai Data Exposure

Users should review any accounts created with 302.ai and change passwords on linked services. Those who shared sensitive information should monitor for identity theft or phishing attempts. Enterprise customers can request data deletion if logs contained proprietary content.

AI aggregators often store intermediate data between users and underlying models. This incident highlights the need to check storage practices before sending private material. No official statement or remediation timeline has been published by Univerads Technology Limited as of October 25, 2026.

Current reports indicate the bucket is now closed. Continued monitoring of security disclosures remains advisable for anyone evaluating similar platforms.

• Check account activity for any unusual access dates.
• Revoke API keys or tokens issued through 302.ai if still active.
• Review privacy policies of alternative aggregators before migration.