Unsecured web portal puts kids' chats with AI toy at risk of being accessed by anyone, including Gmail users.
A security vulnerability discovered in the Bondu chat portal allows any user with a valid Google account to access conversations between children and the AI-powered dinosaur toys.
Researchers Joseph Thacker and Joel Margolis stumbled upon this while investigating reports about the toy's AI safety features. They found that Bondu's web console exposed over 50,000 chat transcripts of child users who had never manually deleted them.
According to Bondu CEO Fateen Anam Rafid, security fixes were implemented within hours after the discovery was made, followed by a broader review and implementation of additional measures for all users.
However, critics warn that this incident highlights larger concerns regarding AI-powered toys for children. Margolis expressed that having access to sensitive data such as conversations about children's thoughts and feelings can be exploited in horrific ways, including child abuse or manipulation.
Researchers also suspect that some AI-enabled toy companies may use generative AI programming tools to create products with security flaws. Bondu declined to comment on whether their console was programmed with such tools.
The incident has sparked concerns among parents regarding the safety and security of these toys, which can collect a vast amount of personal data from children.
A security vulnerability discovered in the Bondu chat portal allows any user with a valid Google account to access conversations between children and the AI-powered dinosaur toys.
Researchers Joseph Thacker and Joel Margolis stumbled upon this while investigating reports about the toy's AI safety features. They found that Bondu's web console exposed over 50,000 chat transcripts of child users who had never manually deleted them.
According to Bondu CEO Fateen Anam Rafid, security fixes were implemented within hours after the discovery was made, followed by a broader review and implementation of additional measures for all users.
However, critics warn that this incident highlights larger concerns regarding AI-powered toys for children. Margolis expressed that having access to sensitive data such as conversations about children's thoughts and feelings can be exploited in horrific ways, including child abuse or manipulation.
Researchers also suspect that some AI-enabled toy companies may use generative AI programming tools to create products with security flaws. Bondu declined to comment on whether their console was programmed with such tools.
The incident has sparked concerns among parents regarding the safety and security of these toys, which can collect a vast amount of personal data from children.
... I mean, who needs that kind of access to be had? Like, imagine if those conversations were out in the wild 
. It's not just about the security flaws, it's about the innocent kids who trust these AI toys with their deepest thoughts and feelings 
. We should be way more careful about how we develop and regulate these tech toys, you know? I remember when Pokémon Go was all the rage back in 2016... at least that was just a game 
. This is serious business 
it's not just about the Bondu toy, either - it makes me wonder how many other AI toys are like this too... we need some SERIOUS security checks in place ASAP! 
. its not just Bondu tho, its a bigger issue with the whole industry 
gotta ask, what kinda security measures should parents expect from these companies? 
. I mean, come on, we already know AI toys are collecting way too much data, and now it's even easier for the wrong people to get access? Like, what's next? Someone hacking into a kid's private chat just because they have a Gmail account? 
We need some serious industry-wide regulation here, ASAP. And I'm all for innovation in AI toys, but safety and security gotta be the top priority, no exceptions 
50k+ transcripts just sitting there waiting to be accessed by anyone?! that's like leaving your front door unlocked 
but what's the point of having AI-powered dinosaurs if they can't even protect our kids' conversations? 
i'm glad bondu was able to fix the issue pretty quickly tho 
but we gotta think about these toys being used for real child abuse cases... it's just not right 
so yeah, let's be careful who makes these things and how they're designed 
I'm really worried about kids' safety online. This Bondu chat portal thingy is just so bad. If some random person can access all those conversations between kids and their AI toy, it's like, what even is the point? 
. As a parent, I want my kid to feel safe online, and this whole situation is just making me anxious 
. Can't we just get some better security measures in place for these toys already? 
and yeah researchers are right, we need more strict regulations around AI development esp when it comes to kid-friendly products 
. We need to get to the bottom of this and make sure our kids' safety is prioritized 
. What if some random Gmail user stumbles upon those transcripts? It's just too much info for me to handle... and yeah, the fact that these companies are just leaving security fixes until the last minute is pretty worrying 
. We need stricter regulations around data protection for AI-powered toys, you know? My kid has this Bondu toy and I'm freaking out now 
.
so now we're just gonna let kids talk about their feelings on a toy that's basically a computer 