TypeSafe AI discloses leak of all customer noul outputs

Diogo Almeida posted a disclosure saying TypeSafe AI became aware at approximately 6.49PM Friday evening of what he called a massive unauthorized leak of all customer noul outputs. He included a link to the contents in the same post, framing it as an effort to maximize transparency, and acknowledged the timing was unfortunate.

Diogo Almeida

@CompleteSkeptic

X

at approximately 6:49PM this Friday evening, we became aware of a massive unauthorized leak of ALL customer noul outputs

The disclosure did not take long to get confirmed by someone outside the company. Jarrod Watts replied "dude mine is in there wtf". Almeida answered him directly with "so sorry - we need to do better". That exchange is the only independent confirmation in the thread that the posted contents contain real customer data, and it comes from one user checking for himself rather than from any audit.

What the disclosure does not say

There is no scope figure. Almeida's post says all customer noul outputs without saying how many accounts, how many records, how far back the outputs go, or how the leak happened. There is no stated containment step, no timeline for a fuller write up, and no indication of whether affected customers are being notified individually or expected to read the thread. The only timestamp anyone has is the one in the disclosure, approximately 6.49PM Friday, and that is when TypeSafe says it became aware, not when the exposure began.

Milind S went at the branding rather than the mechanics, replying that the company literally has safe in its name and calling the situation unacceptable. That is the public temperature so far. It is a small number of replies on one thread, not a wave, and nothing in the sources indicates how the wider customer base has reacted.

For people building on it

If you route production decisions through Jev, the honest read is that right now the vendor has not published anything that would let you tell whether your outputs are in the leaked set. Watts had to look and find his own. The sensible move is to treat any noul output you have sent through the service as potentially public until TypeSafe says otherwise with specifics, and to check the posted contents yourself rather than wait for a notification that nobody has promised.

There is also a second order problem worth sitting with. Model outputs are not just model outputs. They carry the shape of the prompt, which carries the shape of whatever internal data you fed it. A leak of outputs is a partial leak of inputs, and nothing in the disclosure addresses that.

Milind S

@milindlabs

X

hey you literally have “safe” in your name. Unacceptable