Over 181,874 AI meeting recordings remain exposed in the tl;dv platform, reported on January 28, 2026, and still unresolved in July 2026.

tl;dv authenticates users with a JWT and exchanges it for a Firebase token via gw.tldv.io/v1/users/firebase/token, allowing any authenticated user to query all meetings without tenant isolation, exposing live conference IDs that let attackers join active Google Meet or Teams calls uninvited; roughly 1,000 meetings are marked as recording.

The collection holds 181,874 records for 84,312 users across 35,003 domains, covering 23 government nations and many corporate and university sessions. Peak activity was July 2025 with 43,209 meetings, and the busiest slot—Wednesday at 2 pm UTC—recorded 7,804 meetings. Government meetings spanned Brazil, Colombia, Peru, Ukraine, El Salvador, the Philippines, Chile, Indonesia, Mexico, the United States, Qatar, Malaysia, Uzbekistan, Sri Lanka, Haiti, South Africa, Jamaica, Honduras, Argentina, Thailand, Japan, Israel, and Belize.

Despite compliance claims, the company ignored repeated disclosure attempts by Raphael Allstadt and the author, leaving sensitive conversations—job interviews, sales negotiations, government briefings—fully exposed. The CT O has not replied despite emails on January 28, February 14, March 6, and July 22, each time met with silence.