Your AI Chat Is Not a Closed Door
By Martin Bergmann | AI Project Lab | October 2026
Look at the sidebar of your AI chat history. Every conversation has a title the AI wrote for you, a one-line summary of what you asked, something like “options for the delayed vendor contract.” That line describes your problem better than most email subject lines do. A new paper asks where it goes.
What the researchers found.
Researchers at IMDEA Networks in Spain tested nine widely used AI chat services in May 2026 on both the web and Android: ChatGPT, Claude, Gemini, Grok, Microsoft Copilot, Meta AI, Mistral, Perplexity, and DeepSeek. Everyone is connected to at least one advertising or tracking service. Six of the nine web versions passed conversation details to outside companies, such as the chat’s title, its link, and in a few cases, the latest prompt, often alongside identifiers tied to a specific account.
The details vary by service; the paper includes the full table. For example, Meta’s tracking pixel received the conversation ID, title, and link, tied to a Meta identity. Rejecting cookies helped, but trackers still collected data from four of the nine services after the researchers rejected them.
The links get opened.
The tracker data shows what leaves a chat, not whether anyone reads what is inside it. So the researchers tested that directly, with canary links. A canary link is a unique web address that reports when, and from where, it is opened. They pasted them into their prompts and embedded them in uploaded Word and PDF files, then watched. If a link inside your document gets opened by someone else, someone or something read the text and followed it.
For DeepSeek, Copilot, Mistral, and Claude, the visits that did show up came once, at the moment of submission, from cloud servers. Perplexity's crawler fetched the links repeatedly, even when the prompt told it not to. Grok was different. Its canary links were opened 70 times, from 70 different addresses in 14 countries, hours to days after the chat. About two-thirds of those visits came from the United States, although the chats took place in the EU.
The paper does not say who or what opened them, only that the access was automated and kept happening long after the conversation ended. It does not settle how they reached the content either, though it notes that Grok's conversation links were public by default. And seeing no visits is not proof that none occur.
What the study cannot tell you.
The authors name the limits. Each setup was run once, in one country, with test chats about a medical condition. A tracker’s presence does not prove it is used for advertising, and the researchers could not see what happens to chats on the providers’ own servers. The paper is also not yet in final form: a co-author says it has been accepted for the 2027 Proceedings on Privacy Enhancing Technologies, and the manuscript I read still carries template placeholders. I have not seen independent replication.
Most importantly for readers of this blog, it covered only personal and consumer accounts. Enterprise and government versions, which providers sell with different data-handling promises, were left to future work.
What does it mean for the work?
That gap is the real question. The paper does not say your company’s AI tool leaks. It cannot say it is safe, either. “Confidential” is a property of a specific product and contract, not of a brand name or a chat window. A paid personal subscription did not change the picture either: free and premium accounts talked to nearly the same third parties.
I expect more findings like this, and that is my reading of the incentives, not something the study measured. The paper cites reporting that OpenAI began an advertising pilot for free ChatGPT users in early 2026, and the companies building these services need them to earn money. What the study documents is disclosure to advertising and tracking companies. Whether it grows into something more is a prediction, and the habits below hold either way.
Two habits follow. On any personal account, treat a chat like an email that might be forwarded: describe the situation with placeholders instead of real vendor names, people, and figures, and never use a share link for anything you would not post. For the version your company pays for, do not assume. Confirm with your AI governance and information security teams. They are the ones who can check the contract and the settings.
A chat feels like a closed door. The research suggests the label on it travels further than you think.
Martin Bergmann is the Director of an IT PMO and founder of the AI Project Lab. He writes about AI, project management, and the future of intelligent work.
Comments