DeepSeek / Wiz Research
Researchers found a publicly accessible, unauthenticated database with over a million log lines, including chat history, API keys and backend details. Wiz says the exposure was secured after disclosure.
Sensitive values placed in chats or service logs can be exposed through a separate service-side failure.
ChatGPT / OpenAI
OpenAI disclosed that a Redis client bug let some users see others’ chat titles and may have exposed partial payment information for some active subscribers in a nine-hour window. Full card numbers were not exposed.
Once sensitive content reaches an external chat service, its visibility also depends on that service’s controls.
EchoLeak / CVE-2025-32711
Researchers documented a zero-click prompt-injection flaw in Microsoft 365 Copilot: a crafted email could induce retrieval and exfiltration of internal information. This is a published vulnerability study, not proof of widespread customer data loss.
Tool calls, retrieval scope and untrusted content are also trust boundaries; SecretBridge controls only operations routed through it.
Sources are an affected provider’s disclosure, the discoverer’s research and a research paper. Event dates, disclosure dates and actual impact are distinct.