GPT4Free Privacy Risks Expose AI Prompts to Third-Party Servers and Hidden Logs
Gen Digital researchers found GPT4Free's hosted chat routes prompts through third-party servers, mislabels models, and logs IPs and conversations for up to 30 days.
Gen Digital researchers tested the GPT4Free (G4F) hosted chat at g4f.dev and found requests routed through intermediary endpoints such as an OpenAI-compatible g4f.space endpoint before reaching providers like Google Gemini, sometimes returning different model identifiers such as gemini-3-flash-preview. Provider code referenced JSON files listing over 200 externally reachable Ollama and llama.cpp endpoints whose ownership and authorization were undisclosed. Code paths reportedly retain usage logs for 14 days (IP addresses, approximate geolocation, provider, model, conversation data) and error logs for 30 days, while Privacy Policy and Terms of Service links redirected to a member area instead of the documents.
- Prompts to Gemini-branded models were routed via an OpenAI-compatible g4f.space endpoint; returned model IDs sometimes differed from selections.
- Provider code references 200+ external Ollama and llama.cpp endpoints with undisclosed ownership that could receive user prompts.
- Code retains usage logs 14 days including IPs, geolocation and conversation data; error logs kept 30 days.
- Privacy Policy and Terms of Service links on GPT4Free pages redirected to a member area instead of the documents.
- Researchers advise treating unofficial AI aggregators as multi-party data sharing and never entering credentials or sensitive records.
- Organizations
- Gen Digital
- AI models
- Gemini
From the original article
3 min read at gbhackers.com
Users of the GPT4Free hosted platform might believe they are directly interacting with the selected artificial intelligence model in its web interface. However, recent research suggests that prompts submitted through g4f. dev may travel through a complex network of provider code, intermediary services, external model endpoints, and potentially unrelated AI servers.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.