Email address collection by AI tools is the use of an address as an account identifier, a marketing record, and a join key across account data, prompt history, API keys, and payment rows. An address handed to a tool at signup stops being contact information and becomes infrastructure, and a later incident at the company exposes the address together with every record keyed to it. In January 2025, Wiz Research found a publicly accessible ClickHouse database at DeepSeek with no authentication at all, holding over a million log lines, user chat history in plaintext, backend API keys, and operational metadata, all queryable from a browser. In March 2023, a bug in the redis-py client library let ChatGPT users see other users' chat history titles, while OpenAI disclosed that 1.2% of ChatGPT Plus subscribers active during a nine-hour window may have had payment details visible to strangers, including name, email, payment address, last four card digits, and expiry. In both cases the address was the field tying the exposed records to an identifiable person.
Account identifiers
When an account is created, the address becomes the identifier for every row held about that account, including the API key, usage logs, prompt history, and billing record. A leak described as a leak of email addresses alone is therefore never only that, because in a breach dump the address is the column that lets an attacker join every table together and attach each record to an identifiable person. The address also becomes the primary key of every downstream system that receives it, so the scope of an incident is set by the number of systems holding the address rather than by the size of the initial leak.
Marketing pipelines
Most AI tools place new signups into an email sequence immediately, which copies the address into a marketing stack, often a third-party service with its own breach history. The attack surface of the address is then no longer one company's security posture but that company plus every service it shares the address with, and each additional holder adds its own incident history to the address's exposure. The growth pipeline is a normal part of operating a tool rather than an exception, so the copying of the address into third-party systems happens at signup rather than at the time of an incident.
OAuth scopes
Sign in with Google grants OAuth scopes, and the consent screen states what the application receives, usually the email address and basic profile. Some applications request more, including read access to an inbox or Drive, and consent screens are routinely accepted without close reading. The granted scopes persist after signup, so the exposure created by a consent grant lasts as long as the grant remains active rather than ending when the signup flow closes.
Prompt content
Prompts are stored alongside identity, and a configuration file containing a credential that is pasted into a logged-in chatbot sits in the provider's logs attached to the account's address. The address attached to a leaked prompt log turns an anonymous prompt into an identified one, because the address connects the prompt to the account, the payment record, and every other row keyed to it. The risk sits in the combination of content and identifier rather than in either alone, and the combination is created at the moment of pasting rather than at the moment of a later leak.
Alias separation
Alias separation gives every tool its own managed alias, one address per service, killable when the tool is no longer used, in the pattern toolname@yourhandle.aliasfleet.me for each signup. The address identifies which service a message genuinely comes from, and when a tool's database leaks, the alias identifies the leak while remaining valid for that one service only. Half the AI tools signed up for in a given year are gone the next year, and when a dead tool's domain is acquired, the old address begins receiving mail from a company the owner never chose; with a one-per-service alias, deactivation ends that mail without an unsubscribe, a login, or a support ticket. AliasFleet provides managed email aliases: one per site, with any alias pauseable, rotatable, or deactivatable when the service on the other end proves careless with data. AI tools increasingly add features that connect to a mailbox and summarise its mail, which is a scope grant against an entire mailbox, and where a tool genuinely needs an inbox connection, the connection points at an alias destination rather than at a primary address. Secrets pasted into a logged-in chatbot are not fixed by aliases, because the pasting itself places the secret in the provider's logs, but a killable alias shrinks the identity travelling with the prompt. The practice parallels credential management for API keys: short-lived, scoped to one service, rotated on suspicion, and revoked when unused, because an email address functions as a credential in every password reset flow the owner holds.
Exceptions
Financial accounts are the exception to alias use. A bank account is tied to a permanent real address used only for financial accounts, and some banks reject alias domains outright, so the banking address is never a masked or relay alias. Employer accounts follow the employer's policy rather than the account holder's preference. The tool signed up for to test a feature, by contrast, is the scenario aliases were built for: a recently established company with extensive data collection and a limited track record. Have I Been Pwned reports whether an address has already appeared in known breaches, and alias separation applies to the next signup rather than retroactively to the last one.
Top comments (0)