GPT4Free Privacy Risks Expose AI Prompts to Third-Party Servers and Hidden Logs

Users of the GPT4Free hosted platform might believe they are directly interacting with the selected artificial intelligence model in its web interface.

However, recent research suggests that prompts submitted through g4f.dev may travel through a complex network of provider code, intermediary services, external model endpoints, and potentially unrelated AI servers.

These findings raise significant privacy concerns for users who may enter confidential business data, credentials, personal information, or proprietary documents into this free AI chatbot.

GPT4Free Privacy Risks Expose AI Prompts

GPT4Free, also known as G4F, is an open-source project that provides access to numerous AI models through a single interface. While the software can be deployed locally, researchers focused on the publicly hosted service, where users can select model names associated with OpenAI, Google, Anthropic, and other developers without maintaining separate accounts.

However, behind the interface, GPT4Free uses provider integrations that route requests to different services, including official APIs, third-party websites, and custom endpoints.

Researchers found that the model GPT4Free selected was not always the same as the one identified in the response metadata.

In tests involving Gemini-branded options, requests were routed through an OpenAI-compatible endpoint at g4f.space before being directed to the Google Gemini infrastructure.

Some responses indicated different models than those chosen in the interface, including instances where Gemini Pro or Gemini Omni requests reportedly returned a models/gemini-3-flash-preview identifier.

Although model aliases can change over time, researchers noted that available evidence did not clarify where the substitution occurred or which party altered the request.

The investigation also revealed provider lists containing publicly accessible Ollama and llama.cpp endpoints. Ollama is commonly used to run large language models locally, but an improperly configured instance can become exposed to the internet.

GPT4Free’s provider code references JSON files containing more than 200 external Ollama sources, including domains that appear personal and infrastructure linked to various organizations or unrelated services. Users were not informed about the ownership, authorization status, or purpose of these endpoints, through which their prompts could be routed.

Researchers cautioned that the available evidence does not prove that every listed server is compromised or used without the owner’s consent. Some operators may intentionally provide capacity, while others may have exposed their services for different reasons.

Nevertheless, users do not receive a clear explanation of who operates these systems, whether their prompts are retained, or how long data remains accessible after it is sent to a third-party endpoint.

Logging behavior presents an additional privacy risk. The analysis identified code paths that retain usage logs for 14 days and error logs for 30 days.

Usage log fields reportedly include IP addresses, approximate geolocation, selected provider, model information, and conversation data. Researchers did not access live logs, meaning the findings reflect logging functions present in the code rather than confirmed stored records.

The platform’s “Disable Conversation History” setting may also create unexpected exposure scenarios. With conversation history enabled, the browser resends prior conversation context with subsequent messages, while the logger processes the first message.

With history disabled, each new prompt becomes a standalone first message, potentially making every individual prompt eligible for logging.

Additionally, the research found that links to the Privacy Policy and Terms of Service on related GPT4Free pages redirected users to a member area rather than providing the actual documents.

The central security lesson for users is clear: prompts submitted to unofficial AI aggregators should be treated as data shared with multiple unknown parties. Never enter sensitive credentials, internal documents, financial data, health information, or customer records into such services.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC