AI Notetaker Lets Hackers Spy on Government, Corporate Video Calls

Tl;dv, an AI meeting assistant, had a Firestore misconfiguration that let any authenticated user query a global "meetings" collection and obtain metadata, meeting IDs, and creator emails; a researcher exploited this to join many live meetings, found ~180,000 call records across ~80,000 users (including governments, universities, and corporations), and discovered additional exposures such as publicly available transcripts, invitee emails, and an unauthenticated internal game API leaking employee emails. The issue remained unpatched at time of publication and highlights the risk of AI notetakers with broad access and weak backend access controls.