Clearview AI Repository Misconfiguration Data Leak

Clearview AI facial recognition

A misconfigured source code repository allowed unauthorized access to Clearview AI production credentials and cloud storage buckets. The breach exposed training video samples and application copies.

first report: 23 Oct 2020
last update: 23 Oct 2020

Timeline · 4

23 Oct 2020ClearviewAI Misconfiguration
23 Oct 2020TechCrunch Article, "Security lapse exposed Clearview AI source code"
23 Oct 2020Gizmodo Article, "We Found Clearview AI's Shady Face Recognition App"
23 Oct 2020New York Times Article, "The Secretive Company That Might End Privacy as We Know It"

Sources · 4

News and write-ups

2020-10-23
TechCrunch Article, "Security lapse exposed Clearview AI source code"
TechCrunch · techcrunch.com/2020/04/16/clearview-source-code-lapse
2020-10-23
Gizmodo Article, "We Found Clearview AI's Shady Face Recognition App"
gizmodo.com · gizmodo.com/we-found-clearview-ais-shady-face-recognition-app-1841961772
2020-10-23
New York Times Article, "The Secretive Company That Might End Privacy as We Know It"
The New York Times · nytimes.com/2020/01/18/technology/clearview-privacy-facial-recognition.html

Research and catalogues

2020-10-23
ClearviewAI Misconfiguration
MITRE ATLAS · atlas.mitre.org/studies/AML.CS0006

Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.

Classification

lane: Breaches & attacks
AI role: Attack on AI
categories: Data leak
severity: 4 · Confirmed real-world loss
targets: Enterprise deployment
owasp llm top 10: LLM02:2025 Sensitive Information Disclosure
mitre atlas: no technique for these categories
tags: misconfiguration credentials-leak facial-recognition
dates: happened Apr 2020 (approx.) · first reported 23 Oct 2020
record: confidence 0.95 · created 2026-10-18 06:55Z · updated 2026-10-18 06:55Z

Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned

Copy a brief

This record as a short Markdown brief, for a ticket, a chat or a coding agent.

the brief as text

# Clearview AI Repository Misconfiguration Data Leak

https://gcdradar.vercel.app/incidents/clearview-ai-repository-misconfiguration-data-leak · AIR-2020-0023 · closed 2020-11-06

- Lane: Breaches & attacks
- Severity: 4 (Confirmed real-world loss)
- Fix status: No fix needed
- First reported: 2020-10-23 (happened 2020-04)
- AI role: Attack on AI
- Products: Clearview AI facial recognition

## Summary

A misconfigured source code repository allowed unauthorized access to Clearview AI production credentials and cloud storage buckets. The breach exposed training video samples and application copies.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2020-10-23: New York Times Article, "The Secretive Company That Might End Privacy as We Know It" (https://nytimes.com/2020/01/18/technology/clearview-privacy-facial-recognition.html)
- 2020-10-23: Gizmodo Article, "We Found Clearview AI's Shady Face Recognition App" (https://gizmodo.com/we-found-clearview-ais-shady-face-recognition-app-1841961772)
- 2020-10-23: TechCrunch Article, "Security lapse exposed Clearview AI source code" (https://techcrunch.com/2020/04/16/clearview-source-code-lapse)
- 2020-10-23: ClearviewAI Misconfiguration (https://atlas.mitre.org/studies/AML.CS0006)

## Sources

- 2020-10-23 MITRE ATLAS: ClearviewAI Misconfiguration https://atlas.mitre.org/studies/AML.CS0006
- 2020-10-23 TechCrunch: TechCrunch Article, "Security lapse exposed Clearview AI source code" https://techcrunch.com/2020/04/16/clearview-source-code-lapse
- 2020-10-23 gizmodo.com: Gizmodo Article, "We Found Clearview AI's Shady Face Recognition App" https://gizmodo.com/we-found-clearview-ais-shady-face-recognition-app-1841961772
- 2020-10-23 The New York Times: New York Times Article, "The Secretive Company That Might End Privacy as We Know It" https://nytimes.com/2020/01/18/technology/clearview-privacy-facial-recognition.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.

closed
Edge AI Product Microsoft Edge AI Product Evasion Red Team Exercise
Research · since Feb 2020 (approx.)
AI
closed
Azure Microsoft Internal Azure AI Service Red Team Exercise
Research · since Jan 2020 (approx.)
AI
closed
Commercial Face Identification Service Face Identification System Evasion via Physical Countermeasures
Research · since 1 Jan 2020
AI
closed3.7
ProofPoint Email Protection ProofPoint Email Protection Evasion via Surrogate Model
Research · since 9 Sep 2019 · updated 31 Mar 2023 · CVE-2019-20634
AI
closed
DGA detector Botnet DGA Detection Evasion Using Domain Mutation
Research · since 1 Jan 2020
AI
closed
Palo Alto Networks malware detection system Evasion of Deep Learning Detector for Malware C&C Traffic
Research · since 1 Jan 2020
AI