Researchers rebuilt wiped conversations from on-device AI assistants and even got them talking again. Here's who should worry and how to clear your tracks properly.
Deleting a chat with an AI assistant on your Android phone may not wipe it. Georgia Tech researchers built a forensic tool called ORISA that pulls leftover pieces of conversations out of a phone's working memory and rebuilds them into a working chatbot session.
In one test, a restored assistant recalled 26 facts from a deleted chat, while the original session could only reach 14 before it was deleted. The tool worked across 60 test setups covering 10 apps and three AI models.
To reduce the risk, close the app after deleting, restart your phone, and keep sensitive details out of your prompts.
You told an AI assistant on your phone something private, then deleted the chat. Researchers at Georgia Tech have shown that the conversation can still be pulled back out of the phone’s memory, and even rebuilt into a working chatbot that answers questions about what you said.
The tool is called ORISA, and it targets AI assistants that run directly on Android phones instead of in the cloud. That matters because on-device AI is usually sold as the private option. This research shows that deleted AI chats aren’t necessarily gone just because the app says so, which is useful for investigators and uncomfortable for everyone else.
The trick lies in the difference between storage and working memory. When a local AI app is running, pieces of your conversation sit in the phone’s working memory (RAM, the short-term space apps use while they’re open). Tapping delete in the app removes the chat from what you see, but it doesn’t necessarily scrub those leftovers.
ORISA scans a copy of the phone’s memory for those fragments, stitches them together, and loads them into a fresh AI session. In other words, it doesn’t just show you old text. It brings the conversation back to life so you can keep questioning it.
The most striking result came from a made-up assistant the team called Project Note Keeper, built with the ChatterUI Android app. The researchers fed it 100 invented facts about a project, then deleted the whole conversation.
By the time of deletion, the live session could only reach 14 of those facts. Every AI model has a limited memory window, so older parts of a long chat drop out of view. Yet when the team asked ORISA’s restored assistant to list the project notes, it came back with 26.
So the recovered version knew more than the original chatbot could still see before it was deleted. Information the AI had effectively forgotten was still sitting in memory, waiting to be found.
The results weren’t a one-off. Across 60 test configurations, spanning 10 Android apps and three AI models, ORISA found and recovered leftover conversation data. The work was presented at the 2026 IEEE Symposium on Security and Privacy, one of the field’s top academic conferences.
The project came out of Georgia Tech’s Cyber Forensics Innovation Laboratory, which is run jointly by the university’s cybersecurity and electrical engineering schools. Associate professor Brendan Saltaformaggio and research scientist Muhammad Ibrahim worked on it alongside four PhD students. Their focus is the growing group of apps that let people run a chatbot entirely offline, often precisely because users think it keeps their words off company servers.
Ken Xu, a PhD student and the study’s lead author, said the tool can help show what someone shared with an AI assistant and what help they got back. That has obvious uses in criminal cases, where a suspect’s conversations with a chatbot could become evidence.
The researchers also point to medical situations. If someone followed harmful advice from a chatbot and never told their doctor, a recovered conversation could explain what happened. As more people ask AI about symptoms, money and relationships, these chats are turning into a new kind of personal record.
Before you panic, some important limits:
The bigger lesson is about expectations. Most people assume delete means gone. With local AI, it may mean hidden for a while.
If you use an on-device assistant for sensitive topics, a few habits reduce what’s left behind. These won’t guarantee a perfect wipe, but they work with how the leftovers behave:
For AI assistants that run locally on Android phones, yes in some cases. Georgia Tech’s ORISA tool recovered deleted chats in tests across 10 apps, as long as the data hadn’t been overwritten.
It’s a research and forensic tool, not a public app. It needs a copy of your phone’s memory, which normally requires physical access.
Restarting clears working memory, where these fragments live, so it makes this kind of recovery much harder. Chats the app saved to storage are a separate matter.
You're reading the quick version.
Read next
OpenCode breach: why you should revoke your AI API keys today
A hacked OpenCode system may have leaked OpenAI, Anthropic and Google keys, and some users already report surprise bills. Here's who's affected and how to lock things down.
When two critical PHP flaws put most websites at risk, the fix reached millions of servers through one Czech engineer's spare-time project. Here's why that matters.
A researcher who rooted a 2025 Samsung TV says its software logs sounds, screens and ad habits. Here is what is proven, what isn't, and what to change tonight.
Meta's Muse, OpenAI's Dots and Anthropic's Claude Duet can ask 1Password to sign them in. You approve each request on your phone and the bot never sees the password.
The Daily Brief
Every morning, the news that matters from AI, phones, apps and the people shaping tech. Explained in plain English. Free.
One email a day. No spam, unsubscribe anytime. Privacy policy
