A security study published on March 20, 2026 found that AI companion apps — the kind that let users build romantic, often sexually explicit relationships with chatbots — are riddled with serious security flaws despite racking up more than 150 million combined installs. The research revealed that more than half of the apps examined expose intimate chat histories through hardcoded credentials, cross-site scripting (XSS) injection vulnerabilities, and other basic security failures that would make a first-year pen tester wince.

Why It Matters

AI companion apps sit at a uniquely dangerous intersection: they collect the most intimate data imaginable, target emotionally vulnerable users, and operate largely outside the regulatory frameworks designed for health or financial data. The repeated breaches demonstrate that this is not a one-off problem but a structural failure across the category. For the broader sextech and AI industries, each leak erodes the consumer trust that legitimate companies need to build sustainable businesses. If the sector does not self-regulate on security, external regulation — potentially heavy-handed — is all but inevitable.

The findings are far from theoretical. In October 2025, two AI companion apps leaked 43 million messages and 600,000 photos belonging to more than 400,000 users. Then in February 2026, another app exposed 300 million messages from 25 million users through a simple database misconfiguration — the digital equivalent of leaving the diary on the front porch. These are not edge cases; they are symptoms of a category that has prioritized engagement loops over elementary data hygiene.

Regulators have been slow to catch up. The FTC has focused its AI companion scrutiny on child safety — a legitimate concern — but has largely ignored the application-level security posture that leaves adults' most private conversations sitting in poorly guarded databases. The gap between the sensitivity of the data these apps collect and the security infrastructure protecting it remains vast.

The intimacy economy is booming, but its plumbing is leaking. Users pour their loneliness, fantasies, and personal disclosures into these apps with an expectation of privacy that the underlying technology simply does not support. Until the industry faces real accountability — whether through regulation, litigation, or market pressure — every whispered confession to an AI companion carries the risk of becoming public record.

Sources

Update — 2026-03-22

Initial entry — story first created.