If you’re thinking about gifting kids AI-enabled toys, think again. According to a Wired report, security researchers Joseph Thakur and Joel Margulies found that Bondo, an AI toy maker, had left more than 50,000 chat logs of unprotected children on its web portal.
The flaw was discovered when the pair began evaluating the toy’s safety after Thakur’s neighbor asked for feedback. They didn’t have to do anything special to access the data. Anyone with a Gmail account can log into Bando’s web portal, which is intended for parents to check their children’s conversations and for company staff to monitor product performance.
Once Thakur and Margulies logged in, they could see the transcripts of almost every conversation the kids had with their Bondo toy. Details include children’s names, dates of birth, names of family members, and other sensitive information.
After researchers alerted Bando to the flaw, the company took down the unsecured portal within minutes and relaunched it the next day with improved authentication measures. The matter was resolved within hours, the company’s CEO, Fatin Anam Rafd, told Wired, adding that he found “no evidence of access beyond the researchers involved.”
Despite the determination, researchers are generally concerned about the safety risks posed by AI toys. Margolis tells Wired that these kinds of details are a kidnapper’s dream. “We’re talking about information that would allow someone to lure a child into a really dangerous situation, and that was essentially accessible to anyone,” he added.
Recommended by our editors
According to the report, Bondo only stored written transcripts of children’s chats on its portal and automatically deleted audio clips at short intervals. However, the researchers claim that the toys are using GPT5 models from Google’s Gemini and Openai, and therefore, share data with those companies.
Lawmakers have also raised concerns about children being exposed to AI chatbots. Earlier this month, California Senator Steve Padilla introduced a bill to ban the sale of such interactive AI toys for four years after several families accused ChetJept of encouraging suicide and harmful delusions in teenagers.
Get our best stories!
Your daily dose of our top tech news
By clicking Sign Up, you confirm that you are 16+ years of age and agree to our Terms of Use and Privacy Policy.
Thanks for signing up!
Your membership has been confirmed. Watch your inbox!
About our expert
Experience
Jibeen is a tech news writer based in Ahmedabad, India. Previously, he served as the editor of the iGex blog and is a self-proclaimed tech enthusiast who loves breaking down complex information for a wider audience.
Read full bio
