Where AI agents meet real data

Across 181 applications I enumerated 2,305 entities and measured 35,249,248 rows. 23,363,449 of those rows carried identity, contact, health, financial, minor, biometric or credential data. 775 entities and 11.8 million rows were classified as analytics or logs and excluded from the value count. One assessment, end to end, is written up in full.

Every figure came from counts, aggregates and field names. No bulk record was read. The classification of a table comes from its field names and its size from a count, which is enough to reach a conclusion without touching the contents.

Everything on this page was measured without authorization to change anything. Reads only: no writes, no account creation, no credential use, no attempts against anything that belongs to a person rather than to the application's public surface. Records are counted and aggregated, not extracted; where a sample was needed to characterize data, the sample was minimized and redacted. The free scan at deltaforsch.com works the same way and stops at the same line: it tests anonymous public access only, offers no option to create a test account on the target, and writes nothing to the target.

Findings go to the platform vendor and the application owner first, privately, with the smallest reproduction that proves the finding. Two credential classes involving live Google and Groq keys were reported to the vendor on 6 November 2026. No third-party data has been published, sold or used as leverage.

A prior platform finding was resolved with a $1,000 bounty under NDA. The details stay under NDA; the existence of the work does not.

Early in this work I counted HTTP 200 responses and called it code exposure. It was wrong. Hashing the payloads showed that most hosts serve a landing page and only a few serve the real application. A status code proves a page exists. It does not prove the page is the application, and the correction is published rather than quietly dropped.

Testing is authorized. Evidence is minimized: I collect only what is needed to confirm a finding, and do not retain or republish exposed data.

Findings are reported to platform vendors and app owners for remediation. Disclosures under NDA are summarized rather than detailed, and no client names appear in findings.

Every application that enters the work gets a permanent verdict record, and there are only three: exposed and verified, unknown, and clean and verified. Clean requires a full walk of the data or an authenticated view. An empty anonymous response is not evidence of clean, because an empty table and a filtered one are indistinguishable from outside, so an empty result is recorded as unknown rather than rounded up to a pass.