Privacy paper flags agent data leakage

A privacy analysis of web and mobile conversational AI agents is drawing attention on Hacker News, where the post has 421 points. The concerns raised include conversation titles, prompts and screenshots being sent to third parties alongside persistent identifiers. The analysis also describes publicly accessible conversation links without access controls, which could allow trackers to read an entire chat. One example discussed involves Grok: exposed conversation URLs could let trackers read full chats, and separately, TikTok received screenshots of Grok conversations during sharing. Read the original report and discussion.

For a business owner, the practical issue is simple. Staff may put commercially sensitive information into AI chats, including customer details, pricing, salary discussions, internal plans or draft documents. If a vendor’s web or mobile implementation shares conversation-derived data, uses trackers, or makes links accessible without proper controls, that creates a due-diligence problem. Don’t assume a private-looking chat is private by default.

Ask AI vendors clear questions before rolling tools out widely: What conversation data is sent to third parties? Are prompts, titles or screenshots included? How are shared links protected? Can admins control sharing and tracking? And what persistent identifiers are connected to chat activity? This is the kind of thing we build into an AI command centre, giving teams a clearer view of where AI is being used and what controls need attention.