Google AI Studio's Delete Button Is a Lie, and Reporting It Got Me Banned in 60 Seconds
Google AI Studio fakes data deletion. VRP auto-banned me in 60s for reporting it
A reproducible architectural flaw (CWE-459) in Google AI Studio: clicking 'Delete permanently' only moves a local .json pointer to Google Drive Trash. The backend never purges the data, so restoring the file instantly reloads the entire chat history. After submitting a forensic dossier to Google's VRP, the ticket was closed as 'Won't Fix (Intended Behavior)' and the reporter was permanently banned within 60 seconds, with no human review or appeal.
The moment the .json file is restored, AI Studio instantly re-binds to the backend and loads the entire chat history in milliseconds. If the backend had actually purged the data, the server would return a 404. It doesn't. The data never left their 'hot storage'. The delete button is just a visual placebo.
- oefrha
I want to take this seriously, but eight (slop?) rehash of the story on the blog isn’t helping with credibility. Pro tip: don’t do that, however triggered you are, it definitely doesn’t help.
I don’t use Google AI Studio so can’t verify, good luck.
- Bitu79
- Bitu79
Since they keep flagging my comments, you can find them here: https://ibb.co/933qjqVr
- jasonkester
Anybody who has ever run a website with customer data can instantly understand why they do it this way. I don't see any malice.
It's simple, really. You have a website where people can upload their cat photos. There's a delete button. People click the delete button, read the "This will really Delete your Thing. It's Permanent. You CAN'T GET IT BACK!" warning, and click the confirm button.
Then you get an angry email (and twitter post, and blog entry, and Reddit mob) saying "I can't believe you deleted my photo without asking. That was my favorite cat photo it was my only copy I'LL SUE YOU!@!!"
So you go into your console and flip the .isActive bit back to 1 on that photo, send off your stock apology, and get on with your day.
To run your business any other way is madness. You're not training or selling or otherwise misusing that cat photo. You just don't want to deal with that hassle every day. So you "delete" things by moving them someplace where they're not public anymore.
It's just what you do...
- pixel_popping
I doubt much people using Google think that their data would just magically disappear the moment they click a button, to the contrary, I believe most qualified users would know that their data is forever stored, maybe "anonymized" sure (but can still be correlated back).
If some users think this, have they question the Why would they do it? Why would Google lose money that way? ToS is irrelevant when it comes to what's running on their own private infra.