In the last two weeks of October 2026, three separate stories pointed at the same uncomfortable fact: the conversations people have with AI assistants are some of the most sensitive data an organization produces, and they are leaking in ways most security programs don't watch.
A shared link that read private chats. Parameter showed a malicious ChatGPT share link could run code in a signed-in session and read private chats. OpenAI rated it P1 and fixed it by October 26; no real-world use reported. (The Hacker News)
Trackers inside AI chat apps. IMDEA Networks found all nine AI chat services it tested contacted ad or tracking services; six sent prompts, titles, or screenshots to third parties. (via Thinkr)
Chat logs in an open bucket. AI aggregator 302.ai left 17.6 million files, including 144,000+ chat logs, in a public Azure bucket, Cybernews reported. It has since been closed. (via Thinkr)
Add a US court allowing subpoenas to four AI providers for one defendant's chats, deleted ones included (October 21), and the picture is clear.
What it means
An AI chat is not a search box. People paste in contracts, customer records, source code, incident details, draft board papers, and personal worries. The chat history becomes a dense, searchable summary of what someone is working on and thinking about.
That history now lives in several places at once: the provider's servers, the browser session, shared links, third-party analytics scripts, sometimes an aggregator in the middle. Each one is a path out. None of the incidents above needed a sophisticated nation-state attacker. One needed a click on a link. One needed a cookie banner. One needed a misconfigured storage bucket.
And "deleted" does not mean gone. If a court can reach deleted chats, so can a retention policy you didn't read.
Why it matters
Most organizations governed AI with one question: is staff allowed to use it? The better question is where does what they type end up, and who else can reach it?
The risks are concrete:
Confidentiality. Regulated data (health, financial, personal information) pasted into a consumer tool may now sit outside your controls, with third parties you have no contract with.
Legal exposure. Chats can be discoverable. If your people are working through sensitive matters with an AI assistant, those records may surface in litigation or investigations.
Attack surface. Shared links and browser sessions are a new phishing target. A link that looks like "here's the analysis I did in ChatGPT" is a very believable lure.
Trust. Employees and customers assume a chat is private. When that assumption fails, the damage is to trust as much as to data.
In my work across security, privacy, and AI governance in regulated environments, the hardest conversations were rarely about the AI model itself. They were about the data trail around it: who could see the prompts, how long they were kept, and whether anyone had actually checked. The tools changed quickly; the data-handling basics did not. Most of the gaps we found were ordinary ones, a default setting nobody turned off, a sharing feature nobody knew existed.
How organizations should respond
You don't need a new framework. You need to apply the ones you have to a data type you've been ignoring.
Policy and records
Classify AI chats as records. Put prompts and outputs in your classification and retention policies. If a document is confidential, so is the chat that drafted it.
Review retention and deletion. Learn how long each tool keeps chats and whether "delete" means deleted. Align it with your records schedule and legal hold.
Tell people the truth. Short, specific guidance beats a long policy: "Don't paste customer data into free AI tools. Use [approved tool]."
Tools and access
Steer work to enterprise tiers. Business plans offer contracts, admin controls, and retention settings free tiers don't. Make the approved option the easy one.
Restrict share links. Disable public sharing of chats or limit it to your organization. Treat an unexpected shared chat like any unexpected link.
Patch and log. Keep browsers and AI clients current. Make sure monitoring shows which AI services are in use, and by whom.
Vendors and people
- Ask vendors about third parties. Ask which trackers run in the client, what chat data they get, and whether rejecting cookies stops collection.
- Watch the middle layer. Aggregators, wrappers, and extensions that route prompts are another party holding your data. Inventory them like any processor.
The human part
None of this is a reason to stop using AI. It's a reason to treat the people using it as adults who deserve accurate information about where their words go. The fix for most of October's headlines was not clever technology. It was knowing your defaults, closing your buckets, and assuming a conversation is a record until proven otherwise.
Sources
- The Hacker News: A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats (Oct 31, 2026)
- Thinkr: AI privacy news in October 2026 (summarizing IMDEA Networks research, Cybernews reporting, and court records)