Leaking 50,000 AI Conversations with Children

Author

Joseph Thacker
January 29, 2026

Hey y’all,

I posted a pretty crazy disclosure on the blog, and it was also featured in Wired (embed below). It’s an example of a single misconfig (often vibe-coded) that can expose literally everything. I’m super proud to have helped secure it. 😊 

An AI Toy Exposed 50,000 Logs of Its Chats With Kids to Anyone With a Gmail Account

AI chat toy company Bondu left its web console almost entirely unprotected. Researchers who accessed it found nearly all the conversations children had with the company's stuffed animals.

www.wired.com/story/an-ai-toy-exposed-50000-logs-of-its-chats-with-kids-to-anyone-with-a-gmail-account

Thanks for being on the email list! 😊 If you like this content, I’d love if you invited someone to join it or to follow me.

Joseph Thacker (rez0)
josephthacker.com