A US-based company that manufactures AI-powered stuffed animals called Bondu left its website's backend console exposed to the public internet, giving anyone with a Gmail account access to nearly 50,000 chat transcripts between children and their toys.
The vulnerability was discovered by two security researchers, Joseph Thacker and Joel Margolis, who were able to log into the console using arbitrary Google accounts without actually hacking it. The researchers found that the chats stored on Bondu's backend included personal details about each child, such as names, birth dates, family members' names, favorite snacks, dance moves, and even summaries of previous conversations.
Bondu responded quickly to the discovery by taking down its console in a matter of minutes, but it also relaunched it with proper authentication measures. In a statement, the company's CEO claimed that security fixes were completed within hours, followed by a broader review of its systems.
Despite this, researchers say that the data exposure highlights larger concerns about AI-powered toys and children's privacy. They argue that the lack of security around these products could lead to serious risks, including child abuse or manipulation.
The discovery also raises questions about how many people inside companies like Bondu have access to sensitive data and how their credentials are monitored. The researchers believe that even with proper authentication measures in place, one rogue employee with a bad password could still expose the data.
Bondu's CEO claims that it uses third-party enterprise AI services to generate responses, but the company has not disclosed exactly what these services are or how it protects user data.
The vulnerability was discovered by two security researchers, Joseph Thacker and Joel Margolis, who were able to log into the console using arbitrary Google accounts without actually hacking it. The researchers found that the chats stored on Bondu's backend included personal details about each child, such as names, birth dates, family members' names, favorite snacks, dance moves, and even summaries of previous conversations.
Bondu responded quickly to the discovery by taking down its console in a matter of minutes, but it also relaunched it with proper authentication measures. In a statement, the company's CEO claimed that security fixes were completed within hours, followed by a broader review of its systems.
Despite this, researchers say that the data exposure highlights larger concerns about AI-powered toys and children's privacy. They argue that the lack of security around these products could lead to serious risks, including child abuse or manipulation.
The discovery also raises questions about how many people inside companies like Bondu have access to sensitive data and how their credentials are monitored. The researchers believe that even with proper authentication measures in place, one rogue employee with a bad password could still expose the data.
Bondu's CEO claims that it uses third-party enterprise AI services to generate responses, but the company has not disclosed exactly what these services are or how it protects user data.
! I mean, I get that mistakes happen, but this is just crazy talk 
. So Bondu's got some serious 'splainin' to do about what happened with all those chat transcripts 
. 50k+ conversations between kids and their toys? That's a whole lot of sensitive info 
. And now they're saying they've relaunched with authentication measures? I hope so, but only time'll tell 
.
. If it's legit, why not come clean about it? Transparency is key in this sorta thing 
. And let's be real, if one rogue employee with a bad password can expose all this data, that's just plain unacceptable 
. Companies like Bondu need to step up their security game ASAP 
.
just found out about bondu making all our childhood memories public for anyone with a gmail account 
50k chat transcripts exposed 
i feel like i should know what kinda security measures they put in place for this stuff... seems like we're playing with fire here 
we should all be asking ourselves - what's our company doing to protect our users' data? 
I mean, who leaves their backend console wide open for the world to see? 
This is a major security fail and it's just waiting to happen. I'm glad that Bondu took down their console ASAP, but what about all those chat transcripts that are still out there? 
And what really gets me is that the CEO is acting like everything is fine now just because they fixed a few things 
. Newsflash: one vulnerability doesn't make it secure. 
I mean, we need more scrutiny on companies like Bondu and their handling of sensitive data. 
They're gonna have to do better than just 'proper authentication measures' 
.
.
. I'm glad Bondu took down their console quickly, but it's a huge wake-up call for companies to take security more seriously. They need to be transparent about how they protect user data too 
.
and honestly why did it take them hours to fix the issue after being exposed? shouldn't that have been done ASAP?! 
gotta give props to the researchers who caught this though 
. And what's even crazier is the personal details that were stored, it's like they thought we were all just going to be friends with our toys 
. Seriously though, this highlights some major concerns about AI-powered toys and kids' privacy. Like, who exactly has access to that data and how do we know their credentials are being monitored? It's a big deal and I'm not sure companies like Bondu should just sweep it under the rug.
! Like what's the deal? Are they trying to make it easy for hackers or something? 
because of all the personal info stored on there... names, birth dates, family members' names 
but still didn't tell anyone about it beforehand 
. Like, how can you just swoop in and fix it without even warning anyone? It's like they're trying to cover their tracks or something 
. Like, come on! We need more transparency about what's going on here 
! And what about all those third-party services they use to generate responses? 
.
. If two security researchers can log into their backend using arbitrary Google accounts, that's a pretty big red flag 
. I get that it's easy for hackers to find vulnerabilities, but this is just... careless? And now we're talking about child abuse and manipulation - let's not gloss over the potential risks here 
.
but at the same time this whole thing just makes me super anxious about AI-powered toys & kids' privacy 
. And what's up with the CEO's response? "we fixed it within hours" yeah sure 
Not cool, guys. 
anyone can access them with a Gmail account 
. But at the same time, it's good that they fixed the problem quickly 
. Maybe we should be more careful when buying AI toys and stuff? Like, what else could go wrong with these things?