Security researchers Joseph Thacker and Joel Margolis stumbled onto a glaring flaw in Bondu’s parental‑control website. By signing in with any Gmail account, they accessed a public console that displayed every chat transcript the AI chat toy had recorded for its young users. The oversight required no hacking, just a Google login.

Inside the portal, the duo saw children’s names, birth dates, family members, and personalized “objectives” set by parents, alongside full text of more than 50,000 prior conversations. Screenshots confirmed that even deleted chats remained visible, turning a simple parental‑monitoring tool into a massive privacy violation for minors.

Bondu’s CEO Fateen Anam Rafid said the company shut the console within minutes and relaunched it with proper authentication the next day, adding a broader security review and a third‑party audit. The incident fuels ongoing debate about AI‑enabled toys, data retention policies, and the need for stricter safeguards before such products reach households.