Security researchers Joseph Thacker and Joel Margolis discovered that Bondu, an AI-powered children’s plush toy, ran a web-based admin console that anyone could access with an ordinary Gmail login, no special credentials required. The exposure revealed roughly 50,000 conversations between children and the toy, along with names, birth dates, family details, and device information. Bondu took the console offline within minutes of being notified and relaunched it with proper authentication; the incident was disclosed alongside similar complaints against other AI toy makers, prompting inquiries from U.S. senators.