Report: Google's bug bounty dismissed an AI Studio delete flaw in 60s
A researcher says the delete button only drops a UI pointer while prompts stay on Google's servers — logged as intended; plus a CVSS 10 Azure fix.
Copy markdown
The delete button reportedly only hides your data
A security researcher says clicking Delete in Google AI Studio removes a UI pointer while the underlying prompt and chat data reportedly stays on Google's servers, so a “deleted” conversation may never actually be erased. He says he's filed GDPR right-to-erasure complaints with NOYB and Ireland's Data Protection Commission; Google has not commented publicly.
Closed in ~60 seconds as 'Intended Behavior'
The fresh twist that pushed this onto Hacker News: Google's Vulnerability Reward Program reportedly closed the report in about a minute, tagging the retention as working-as-intended rather than a bug. If accurate, the data sticking around isn't an accident in Google's eyes — which is the part that should shape how much you trust the free tier.
What to do if you route regulated data through it
Until Google clarifies, treat the AI Studio Delete button as cosmetic and assume prompts persist. For anything regulated or sensitive, use the paid Gemini API under a data-processing agreement with defined retention terms instead of the free AI Studio surface, and keep secrets and PII out of pasted prompts.
Elsewhere: a CVSS 10 hole in Azure AI Foundry
Microsoft patched CVE-2026-85889, a maximum-severity (CVSS 10.0) authentication bypass in Azure AI Foundry that let an unauthenticated attacker escalate privileges over the network. It was fixed server-side with no customer action needed, but if you build on Foundry it's worth reviewing access logs for anything unusual.