AI Assistant Rabbit R1’s Code Vulnerability Exposes Users Data

Rabbitude disclosed that Rabbit R1 had hardcoded API keys in its codebase, enabling access to third-party services (including ElevenLabs and SendGrid) and potentially every response produced by R1 devices; researchers demonstrated the issue, Rabbit has rotated most keys but a SendGrid key remained accessible, raising significant privacy and security concerns.