Redbot Labs / Threat Intelligence
Bondu AI Toy Exposes 50,000 Children’s Private Conversations
- Incident ID
- RBT-TI-0080
- Organization
- Bondu
- Reported Location
- San Francisco, California, United States
- Severity
- High
- Category
- AI Data Exposure
- Record Date
- 2026-01-29
Incident Summary
Security researchers Joseph Thacker and Joel Margolis discovered that Bondu's web-based management console exposed more than 50,000 transcripts of conversations between children and the company's AI-enabled toys.
The console allowed an arbitrary user with a Google account to access sensitive information without appropriate authorization.
Exposed information included children's names, birth dates, family-member names, preferences, parent-defined objectives, conversation summaries, and detailed transcripts of interactions between children and their Bondu toys.
Bondu confirmed that more than 50,000 chat transcripts were accessible through the exposed portal.
The company took the console offline shortly after notification, implemented authentication protections, and said its investigation found no evidence that anyone other than the researchers accessed the exposed information.
What Happened
Security researchers investigating the privacy and security of Bondu’s AI-enabled children’s toys discovered that the company’s public-facing web console lacked appropriate authorization controls.
The researchers authenticated using an arbitrary Google account and gained access to information belonging to other Bondu users.
The exposed interface provided access to children’s personal information and transcripts of conversations conducted with their AI toys.
Accessible information included names, birth dates, family-member information, child preferences, parent-defined objectives, conversation summaries, device information, and detailed chat histories.
Bondu confirmed that more than 50,000 conversation transcripts were accessible, representing virtually all conversations retained by the service except those previously deleted by parents or staff.
The researchers reported the vulnerability to Bondu.
According to the researchers, Bondu disabled the affected console within minutes. The company subsequently restored the service with additional authentication protections and conducted a broader security review.
Bondu stated that it found no evidence of unauthorized access beyond the security researchers.
Affected Systems
Bondu AI Toys / Parent Web Console / Child Conversation Transcripts / User Profiles / AI Conversation Memory / Personal Information
Attack Vector
Broken Access Control / Missing Authorization / AI Conversation Data Exposure
Business Impact
More than 50,000 private AI conversation transcripts involving children were accessible through Bondu’s web console.
Exposed information included children’s names, birth dates, family-member names, personal preferences, parent-defined objectives, conversation summaries, and detailed chat histories.
Because Bondu’s AI toys are designed to maintain personalized conversations and remember information about children, the exposed dataset contained unusually intimate and persistent information about young users.
The incident created significant privacy, child-safety, regulatory, and reputational risk.
U.S. Senator Maggie Hassan subsequently requested detailed information from Bondu regarding its security controls, data practices, vulnerability remediation, and protection of children’s information.
Bondu stated that it found no evidence of access to the exposed information beyond the security researchers who discovered the issue.
Redbot Analysis
The Bondu exposure demonstrates why conversational AI creates a fundamentally different data-security problem when systems maintain long-term memory about their users.
A traditional children’s application may store account information and basic profile data. A conversational AI system can accumulate a much richer behavioral dataset containing personal interests, family relationships, routines, preferences, questions, concerns, and other information disclosed naturally during conversation.
When authorization controls fail, the resulting exposure can therefore reveal considerably more than conventional account data.
This risk becomes particularly significant when the users are children.
Bondu’s AI toys were specifically designed to remember previous interactions and use that information to personalize future conversations. The same persistent memory that improves the user experience also increases the sensitivity and value of the stored dataset.
The incident also illustrates an important distinction between AI safety and AI security.
An AI system may contain extensive safeguards intended to prevent inappropriate model responses while the infrastructure surrounding that model still exposes sensitive information through conventional application-security failures.
Organizations deploying conversational AI should therefore treat conversation histories, memory stores, summaries, embeddings, user profiles, and associated metadata as highly sensitive application data.
Authorization must be enforced at every object and API boundary, and authenticated access alone must never imply authorization to retrieve another user’s AI conversation history.
For systems involving children, minimizing retention and limiting the amount of persistent conversational memory should be considered core security controls rather than solely privacy-policy decisions.
