Web portal leaves kids’ chats with AI toy open to anyone with Gmail account

Recent revelations have shed light on a serious security flaw affecting a popular AI-enabled toy known as Bondu. Joseph Thacker, a security researcher, was alerted by a neighbor who had preordered the stuffed dinosaur due to its unique chat feature, which allows kids to engage in conversations with the toy. Given Thacker's background in AI safety for children, his curiosity was piqued, prompting him to investigate further. What Thacker and his colleague, Joel Margolis, uncovered was alarming. Within minutes, they discovered that Bondu's web portal—designed for parents to monitor their children's chats and for staff oversight—was alarmingly accessible. Anyone with a Gmail account could log in and gain access to an extensive archive of conversations that children had held with their toys. The implications of this security breach are profound. The researchers found that they could easily view private details, including children's names, birth dates, and even their favorite activities. More concerning were the transcripts detailing intimate chats, showcasing the personal nature of the interactions between children and the toy. Bondu acknowledged the breach, revealing that over 50,000 chat transcripts remained exposed, with only those manually deleted by parents or staff being inaccessible. This incident raises significant concerns about the safety measures in place for children's toys that utilize AI technology, highlighting the need for stringent security protocols to protect young users from potential privacy violations.