Bondu
Disclosed Jan 29, 20267 months agoUnverified
AI plush toy's open web console exposed 50,000 children's chat logs
Researchers found Bondu's public web console let anyone sign in with any Google account and read about 50,000 transcripts of children's conversations with its AI plush toy, including names, birth dates and family details. Bondu took the console offline within minutes, added authentication and said it saw no evidence of other access.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Jan 29, 2026 |
| Attack | Exposed data |
| Data exposed | Children's data, Messages, Names, Dates of birth, Prompts and chats |
| Sector | AI · US |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
Sources
| Source | |
|---|---|
| An AI plush toy exposed thousands of private chats with childrenmalwarebytes.com · News | News |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Jan 29 |
History of this record
- 2026-09-25 · added · seed source
First seen 2026-09-25 (Research). Record counts are as reported. Not legal advice.