A security lapse has left thousands of children's conversations with an AI-powered toy open to anyone with a Gmail account, highlighting the need for better protection of kids' personal data.
Researchers Joseph Thacker and Joel Margolis stumbled upon this vulnerability while investigating Bondu, an AI chat feature built into a stuffed dinosaur toy designed to engage children in interactive play. The toy's creator had pre-ordered several of these toys, which it was believed were intended to provide a kind of machine learning-enabled imaginary friend for its young users.
However, Thacker and Margolis discovered that anyone with a Gmail account could access the full transcripts of every conversation the children had with Bondu, without needing to be granted permission. This included conversations that were not manually deleted by parents or staff, as well as sensitive information like children's names, birth dates, family member names, and preferences.
The researchers found that the data was stored on a web portal that did not require authentication for access, allowing anyone with a Gmail account to view it. Bondu confirmed that its system had left this data exposed, which included over 50,000 chat transcripts – essentially all conversations between children and their toys, excluding those manually deleted.
The company promptly took steps to secure the portal after being alerted by Thacker and Margolis. However, the incident raises broader concerns about the risks of AI-enabled chat toys for kids, particularly with regards to data protection and security.
Researchers Joseph Thacker and Joel Margolis stumbled upon this vulnerability while investigating Bondu, an AI chat feature built into a stuffed dinosaur toy designed to engage children in interactive play. The toy's creator had pre-ordered several of these toys, which it was believed were intended to provide a kind of machine learning-enabled imaginary friend for its young users.
However, Thacker and Margolis discovered that anyone with a Gmail account could access the full transcripts of every conversation the children had with Bondu, without needing to be granted permission. This included conversations that were not manually deleted by parents or staff, as well as sensitive information like children's names, birth dates, family member names, and preferences.
The researchers found that the data was stored on a web portal that did not require authentication for access, allowing anyone with a Gmail account to view it. Bondu confirmed that its system had left this data exposed, which included over 50,000 chat transcripts – essentially all conversations between children and their toys, excluding those manually deleted.
The company promptly took steps to secure the portal after being alerted by Thacker and Margolis. However, the incident raises broader concerns about the risks of AI-enabled chat toys for kids, particularly with regards to data protection and security.
This is just insane... I mean, can you imagine if this was a regular toy that collected all these personal details? It's like, totally unacceptable that a company would create something so flawed in the first place 
. The fact that anyone with a Gmail account could just access all these conversations without permission is just a huge security risk. I'm glad Bondu took action to secure their portal ASAP, but this incident highlights the need for much stronger data protection measures for kids' sensitive info. We should be super careful when introducing AI-powered toys into our homes, especially if they're collecting personal data. 
They're supposed to be fun for kids, but it looks like they can also put their personal info at risk 
. I mean, think about it: you leave this toy on your phone or laptop and suddenly strangers can see all the conversations you've had with it? 
That's not safe at all! 
around their data. And what about the parents who aren't tech-savvy enough to keep an eye on this stuff? They might be unaware that their kid's conversations are out there for anyone to see 
.
.
like, theres this one toy thats supposed 2 be a bff 4 kids but its actualliy storing every convo they hav w/ it on the internet! like anyone w/ a gmail account can see their private stuff 
I mean, come on! Who wouldn't want to listen in on their kid's conversation with a stuffed dinosaur toy? 
It's not like it's going to reveal any deep dark secrets or something 
. But seriously, 50,000 chat transcripts just lying around waiting for some Gmail-savvy hacker to stumble upon them? 
. Either way, kudos to the researchers who exposed this vulnerability - now it's time for companies to step up their data protection game! 
. I'm literally shaking my head right now... like, how did this even happen?! Bondu's gotta do better, you know? 
), but I know you gotta have some basic security measures in place. And if Bondu can't even get that right... 
what's next?! 
. I guess that's one way to make those AI-powered toys "machine learning-enabled" 
. And who needs parental consent or authentication, anyway? 
A Gmail account is all you need to access a child's private conversations with a toy dinosaur 
. I'm sure the 50,000+ chat transcripts were just meant for... research purposes 
.
We need some serious updates to our tech security, stat!
the company left all these transcripts open to anyone with a Gmail account which is literally anyone on the internet 
50k+ conversations and personal info just floating around online it's like they didn't even think about security or privacy 
.
. It's companies like this that need to be held accountable for putting our kids at risk 
.
. We can't keep ignoring these issues!
Thousands of kids' conversations being exposed online is not exactly something you want to see happen. I mean, can't imagine how creepy that must be for the parents and stuff. And 50,000 chat transcripts? That's just a whole lot of sensitive info floating around.