Google VRP Banned Researcher in 60s Over AI Studio Delete Claim

An independent researcher says Google AI Studio's Delete button only strips a JSON pointer, while the underlying prompt data stays on Google's backend, and that Google's AI Vulnerability Reward Program shut his report down in roughly 60 seconds by labeling the behavior 'Intended Behavior.' The claim comes from a Medium post by Istokovics György that is currently circulating on Hacker News, where it sits at 46 points.

The researcher's framing is blunt. 'Deletion means deletion. There is no such thing as we didn't delete it just in case you did it by accident,' he writes, arguing that Google's UI promises a permanent removal it does not perform on the server side.

He also says the fallout spread past the VRP ticket itself. On Google's own developer forum, he claims 'They deleted around 140 of my technical posts,' and parallel threads there frame the underlying issue as a GDPR Article 17 failure on the AI Studio deletion path. He says he escalated to NOYB and the Irish Data Protection Commission and got nowhere: 'I actually wrote to a woman at NOYB. She replied at first, but now they have gone completely silent!'

The story is thinly sourced to the researcher's own posts and the Hacker News discussion; Google has not commented publicly, and one commenter, jasonkester, pushed back that soft-delete with a recovery window is standard product behavior rather than deception. It arrives inside a wider run of scrutiny on frontier-lab data handling, including this week's coverage of state-media attacks on Anthropic's privacy overhaul.