Open systems
Exposed AI databases and what they leak
An AI product stores more than its model: logs, chat history, keys and configuration. If the database behind it is reachable without a password, all of that is exposed.
Last reviewed against legislation.gov.uk, National Cyber Security Centre and OWASP GenAI Security Project. Sources
The case
What Wiz reported
Wiz published research on 29 January 2025 describing a publicly accessible ClickHouse database belonging to DeepSeek, with no authentication [6]. It held over a million log entries, including chat history, API keys, backend details and operational metadata, and allowed full control over database operations [6].
What was at risk
Why logs matter
Wiz said an attacker could have read sensitive logs and plaintext chat messages, and depending on configuration might have used file queries to extract other data from the server [6]. The research does not say that anyone else accessed the data, and this site does not claim they did.
Take this from it
Chat history and API keys in a log store are as sensitive as the database behind any other service. Treat them that way.
Check your own
Where AI data is stored
Prompt and response logs
Find where your AI tools or your own applications keep inputs and outputs, and who can read them.
Vector stores and document indexes
Retrieval systems copy your documents into a searchable index. The index needs the same access controls as the source.
Keys and tokens
Keys that appear in logs should be treated as exposed if the logs were. Rotate them.
Test and development systems
The Wiz ports were on a development subdomain as well as another [6]. Test systems often hold real data.
Controls
The short list
Then see how to contain a breach if you find something open.
The NCSC's guidelines include protecting infrastructure and models from compromise, threat or loss, and logging and monitoring in operation [2]. In practice:
- Require authentication on every database and admin interface.
- Scan your own external address space for unexpected open ports.
- Apply least privilege to AI data stores, as OWASP advises [4].
- Alert on unusual queries and large exports.
Keep reading
Read next
Prompt leaks
How an LLM can disclose personal or confidential data through its outputs, what OWASP and the NCSC advise, and the design choices that limit it.
Read the guide
Reporting
When an AI data breach must be reported under UK GDPR, how the 72 hour clock works, and what to record whether or not you report.
Read the guide
Examples
Three public AI data exposure cases, a library bug, staff uploads and an open database, with what each shows UK organisations about cause and response.
Read the guideHow CyPro can help
Need a hand working through this?
Finding out whether an incident reaches you is one job. Checking your own systems, tightening access and briefing the board are several more. CyPro's responders and consultants can take any of them on.
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Talk to a specialist
Worried this affects you?
If data has leaked through an AI tool or an exposed AI database, the first hours decide how much is lost and what you must report. An incident response team helps you contain it, work out what was exposed and meet your notification duties.