A report by mobile security firm Oversecured has identified over 1,500 security vulnerabilities across 10 popular Android mental health and AI therapy apps, which collectively have more than 14.7 million installs. 

Key findings from the investigation include:

• Vulnerability Volume: Researchers found 54 high-severity, 538 medium-severity, and 983 low-severity flaws.
• Sensitive Data at Risk: Exposed information includes therapy session transcripts, mood logs, medication schedules, and self-harm indicators.
• Impacted App Types:
  • Mood & Habit Tracker: 10M+ installs, 337 total vulnerabilities.
  • AI Therapy Chatbots: 1M+ installs, 255 total vulnerabilities, including 23 high-severity issues.
  • AI Emotional Health Platforms: 1M+ installs, 215 total vulnerabilities.
• Lack of Basic Protection: Most of the analyzed apps lacked root detection, meaning a compromised or rooted device could allow any app with root privileges to access all locally stored health data.
• Outdated Security: Only four of the ten apps had been updated in February 2026; others had not seen security patches since late 2024 or 2025.
• Monetary Risk: Therapy records are highly sought after on the dark web, often selling for $1,000 or more per record, significantly more than stolen credit card data.