Choosing a provider
AI plush toy: 50,000 children's conversations could be read
In January 2026 two security researchers found that anyone with a Google account could log in to the web console of a talking AI plush toy maker and read around 50,000 conversations with children.
Bondu makes an AI-powered plush toy that, in the company's words, can chat, teach and play with a child. Its conversations are transcribed and stored by the company. At the end of January 2026, Wired reported that two security researchers had been able to log in to the company's public web console with an arbitrary Google account. They did not need to hack anything.
Around 50,000 conversations could be read there, from practically every child who had used the toy. The only ones missing were those that parents or company staff had deleted by hand. The transcripts revealed children's names, dates of birth, what they liked, details about their families and what they had confided to their toy.
After the researchers' warning, Bondu took the console offline within minutes and relaunched it with authentication. The company's chief executive said the fixes were completed within hours and that there was no evidence of access by anyone other than the researchers. Bondu also brought in an outside security firm and added monitoring. The OECD's register of AI incidents recorded the case as an AI incident affecting children's fundamental rights.
What can we learn from it?
A transcript is as confidential as the conversation itself, even when a toy produces it; where transcripts accumulate in one central system, a single poorly protected interface can expose them all. Those who work with children can ask which talking devices a child uses, and whether the parents know where the conversations go. In Confiella the audio never leaves the computer, and the transcript is made locally. With any other tool, two questions are enough: where it stores the transcript, and who can see it.
Sources
- Malwarebytes: An AI plush toy exposed thousands of private chats with children
- HotHardware: AI Toy Privacy Fumble Exposes 50,000 Private Chat Logs With Kids
- OECD.AI: AI Toy Company Exposes 50,000 Children's Chat Logs Due to Security Flaw
This article is based on the public sources listed. If you find a mistake, write to us: [email protected]