Security Researcher Finds Exposed Admin Panel for AI Toy

Researchers found an exposed admin console for the Bondu AI toy that allowed anyone with a Google account to access tens of thousands of children’s conversation transcripts and personal profile information; an additional IDOR in the API allowed easy enumeration of child profiles and the console provided device controls such as firmware updates and reboots. The company removed the console quickly, reported no evidence of unauthorized access beyond the researchers, and began remediation and a bug bounty program.