Bondu AI toys exposed children’s conversations and family details through an unrestricted admin console
Bondu’s admin console exposed children’s private conversations and family details to ordinary Google accounts. Bondu says it fixed the service and found no other unauthorised access. Parents can review and delete conversations in its app.
No app or toy update was specified for this incident; Bondu repaired its service. Parents can review and delete their child’s conversations in the bondu for parents app, or ask Bondu to delete their child’s data or account.
What’s happening
Bondu’s AI talking toys were linked to an admin console that researchers could enter using ordinary Google accounts. It exposed children’s conversation transcripts, names, birth dates, family details and device-management functions. WIRED reported that more than 50,000 transcripts were accessible. Researchers also found a separate flaw exposing children’s profiles. Bondu disabled the console within 10 minutes of receiving the report and told WIRED that fixes were completed within hours. The researchers said the access-control flaws were fixed by the next day. Bondu reported no evidence of unauthorised access beyond the researchers; malicious exploitation is not established. This was repaired on Bondu’s service, with no customer update specified. Discovery dates conflict: the researcher’s chronology prints January 2025, while Senator Maggie Hassan’s letter identifies 10 January 2026. Hassan sought answers in February. The sources reviewed do not establish a subsequent response or customer-notification outcome as at 3 November 2026.
- What
- Breach
- Affects
- Bondu AI talking toys and associated online service
- Fixed in
- Nothing to patch
- Since
- 10 Jan 2026
- Closed
- 3 Feb 2026
Timeline
- Update
Senator Maggie Hassan asked Bondu about customer notification, affected children, access controls and its investigation. She requested answers by 23 February; the letter does not establish whether customers had been notified.
- New fixNothing to patch
Bondu’s CEO told WIRED that fixes were completed within hours, followed by a broader security review and additional safeguards. He said the investigation found no evidence of access beyond the researchers; WIRED reported that the portal reopened the next day with proper authentication.
- Made public
Thacker publicly described unrestricted access to children’s conversations, profiles and device controls, plus a separate profile-access flaw. He said Bondu took the console offline within 10 minutes and fixed the flaws by the following day, although his detailed chronology labels those January dates 2025, conflicting with Hassan’s 2026 date.
- Update
Researchers Joseph Thacker and Joel Margolis discovered the exposure. Senator Maggie Hassan’s subsequent letter identifies 10 January 2026 as the discovery date.
Sources
- Privacy & Security at bonduBondu · 3 Mar 2026
- Hacking An AI Children's Toy: Remote Access to Every ConversationJoseph Thacker · 29 Jan 2026
- Security Researcher Finds Exposed Admin Panel for AI ToyThe Cyber Express · 29 Jan 2026
- An AI Toy Exposed 50,000 Logs of Its Chats With Kids to Anyone With a Gmail AccountWIRED · 29 Jan 2026
- Senator Maggie Hassan’s letter to Bondu CEO Fateen Anam RafidUS Senate Joint Economic Committee · 3 Feb 2026