Security Flaw At AI Toy Company Exposed Over 50,000 Chat Logs Of Kids

Security Flaw at AI Toy Company Exposed Over 50,000 Chat Logs of Kids

Last updated: 2026/02/02 at 1:03 AM

News Room Published 2 February 2026

If you’re thinking about gifting AI-enabled stuffed toys to kids, think again. According to a report by Wired, security researchers Joseph Thacker and Joel Margolis found that Bondu, a company that makes AI toys, had left over 50,000 chat logs of kids unprotected on its web portal.

The flaw was discovered when the duo began assessing the toy’s safety after Thacker’s neighbor asked for an opinion. They didn’t have to do anything special to access the data. Anyone with a Gmail account could log in to Bondu’s web portal, which is meant for parents to check their kids’ conversations and for company staff to monitor the product’s performance.

Once Thacker and Margolis logged in, they could see transcripts of nearly every conversation the children had with their Bondu toys. Details included kids’ names, birth dates, family members’ names, and other sensitive information.

After the researchers alerted Bondu about the flaw, the company took down the unsecured portal within minutes and relaunched it the next day with improved authentication measures. The issue was fixed within hours, company CEO Fateen Anam Rafid tells Wired, adding that they “found no evidence of access beyond the researchers involved.”

Despite the fix, the researchers remain concerned about the safety risks posed by AI toys in general. These kinds of details are a kidnapper’s dream, Margolis tells Wired. “We’re talking about information that lets someone lure a child into a really dangerous situation, and it was essentially accessible to anybody,” he adds.

Recommended by Our Editors

According to the report, Bondu only stored written transcripts of kids’ chats on its portal and automatically deleted the audio clips at short intervals. The researchers, however, claim that the toys may be using Google’s Gemini and OpenAI’s GPT-5 models, and therefore, sharing the data with those companies.

Lawmakers have also raised concerns about kids’ exposure to AI chatbots. Earlier this month, California Senator Steve Padilla introduced a bill to ban the sale of such interactive AI toys for four years after several families accused ChatGPT of encouraging suicide and harmful delusions among teens.