181,000 AI Meeting Recordings Exposed in tl;dv Hack
Over 181,000 AI meeting recordings left wide open in note taking app
A security researcher found that tl;dv, an AI meeting recorder, left its Firestore database open, allowing any user to access 181,874 meeting records, including live calls. The researcher joined meetings from the Malaysian Ministry of Education and a US university, and discovered that 1,000 meetings were actively recording at any time. Despite reporting the issue in January, the company has not fixed it after six months, and also exposed employee data via an unsecured internal app.
I was in the same call. Nobody invited me. The Firestore database did.
- yellow_lead
Seems like they fixed this a few days ago:
https://tldv.io/blog/our-thoughts-on-the-darkreading-com-art...
But they try to play it off as though this were public data:
> Public sharing settings across AI and SaaS products have surfaced similar findings in recent months. Anthropic addressed exposed public artifacts across Claude and its MCP ecosystem via Google Search.
Also, interesting, they are SOC2 compliant [1], proving again that SOC2 is meaningless/useless.
- gppk
Heh, interesting. I literally just vibe-coded an app tonight that takes a meeting recording, runs it through whisper to generate the text, then through your local codex gives you a summary and creates actions that are pushable to either github (technical) or PM tool (project level)
Takes about 7 minutes for a 2 hour meeting on my 3080 GPU so well within useful timeframe.
I did it because i didn't want to pay £7 a month for a discord meeting notes taker, but seems generally useful. And ofc you could swap out for a local model if you have more compute than i do...
- xvxvx
This should be the kiss of death for any company. The exposure of sensitive data like that, and for that long? There's a serious disconnect between security best practices and law, and how many companies actually operate.
My own company is a sitting duck for hackers right now. I've begged them to implement basic 2FA for 6 months and all they do is brush concerns under the carpet. No one gives a shit, all the way to the very top.
- cube00
I saw an YouTuber the other day sharing their "day in the life" as an Amazon Software Engineer while promoting (as part of a paid sponsorship) the AI note taking feature of SoundCore headphones, claiming they now record their meetings and receive an AI summary at the end.
I wonder how many companies realise these devices that appear as "headsets" are now funnelling their meetings into these new AI companies who are more worried about the World Cup then replying to security researchers.
- palmotea
Don't worry, I'm sure this was all an AI agent's fault, so no one to blame and all they need to do is update their code review prompts to not make mistakes.
- msyea
My biggest worry is the small talk that you casually have in meetings. Comments about your pattern of life, family, locations, friends and health. Slurping all that up over 100s of meetings is concerning. Stored raw transcripts of meetings is a huge liability. Should redact small talk and only store useful extracts.
- Aeroi
"Government meetings from 23 countries: Brazil, Colombia, Peru, Ukraine, El Salvador, the Philippines, Chile, Indonesia, Mexico, the United States, Qatar, Malaysia, Uzbekistan, Sri Lanka, Haiti, South Africa, Jamaica, Honduras, Argentina, Thailand, Japan, Israel, and Belize. "
oof
- wkirby
I'm very intrigued by AI note takers, but I'm absolutely unwilling to expose me or my clients to this exact problem.
The solution (theoretically) is a purely local note taker, but I haven't found one that's any good. Tried meetily and others in the same vein, including briefly rolling my own. The breakdown in the pipeline seems to be reliable local diarization and speaker identification; even if the transcription is good, when speakers aren't accurately identified and speech isn't well grouped, there's no rescuing it in the summary step.