Loading story…
Researchers reported that Bondu’s AI plush toy exposed a public-facing web console that allowed anyone with a Gmail account to access roughly 50,000 private chat transcripts between children and the toy, without needing to bypass authentication. The exposed logs reportedly included sensitive personal details (e.g., names, birth dates, family information, and intimate conversations), creating potential real-world safety risks if misused. Bondu took the console offline shortly after disclosure, then relaunched it with authentication; the company stated fixes were completed within hours, claimed no evidence of other access, and said it engaged a security firm and added monitoring.
Separately, the UK Information Commissioner’s Office (ICO) opened a formal investigation into X and its Irish subsidiary over reports that the Grok AI assistant was used to generate nonconsensual sexual images, examining whether personal data was processed lawfully and whether safeguards were adequate to prevent harmful manipulated imagery—particularly where children may be impacted. A third piece is a general commentary on children’s data protection in an AI-saturated environment; it provides contextual privacy concerns but does not add incident-specific facts, IOCs, or technical findings tied to either the Bondu exposure or the Grok regulatory probe.
See the reporting duties and controls this puts on the clock.
6 events from the most recent confirmed update back to the earliest known activity.
After the exposure was disclosed, Bondu reportedly took the console offline within minutes and later relaunched it with authentication. The company’s CEO said the fixes were completed within hours and claimed there was no evidence of other access.
Two researchers discovered that Bondu’s public-facing web console allowed anyone with a Google account to access roughly 50,000 private chat transcripts between children and the AI plush toy, exposing names, birth dates, family details, and intimate conversations without any hacking.
The UK Information Commissioner’s Office formally opened an investigation into X and its Irish subsidiary, examining whether X Internet Unlimited Company and xAI processed personal data lawfully and had adequate safeguards to prevent Grok from generating nonconsensual sexual images, including risks involving children.
French prosecutors searched X’s Paris offices as part of a criminal investigation into whether Grok generated child sexual abuse material and Holocaust denial content. They also summoned Elon Musk, CEO Linda Yaccarino, and other employees for interviews scheduled in April.
On January 7, the UK Information Commissioner’s Office said it contacted X and xAI to request urgent information about compliance measures after reports that Grok was used to create sexually explicit images using individuals’ personal data.
In January 2026, the European Commission launched a formal investigation into whether X properly assessed Digital Services Act risks before deploying Grok after the assistant was reportedly used to generate sexually explicit images.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers Joseph Thacker and Joel Margolis found that *Bondu*’s web-based portal for its AI-enabled children’s toy allowed broad, unauthorized access to sensitive data simply by logging in with an arbitrary Google (Gmail) account—without needing to exploit a vulnerability beyond the broken access controls. The exposed data included children’s names, birth dates, family member names, parent-defined “objectives,” and detailed summaries/transcripts of children’s conversations with the toy; Bondu acknowledged that **more than 50,000 chat transcripts** were accessible via the public-facing console, representing nearly all conversations except those manually deleted. After the issue was secured, the researchers warned that the incident highlights systemic privacy and security risks in AI-toy ecosystems, including the potential for misuse of highly personal child data and the importance of controlling and monitoring internal access to such datasets. They also indicated that Bondu appeared to rely on third-party LLM services (including **Google Gemini** and **OpenAI GPT-5**) to generate responses and run safety checks, raising questions about what conversation content is transmitted to external providers; Bondu stated it uses enterprise AI services with controls intended to minimize shared data and prevent training on prompts/outputs. Separate commentary on AI toys broadly describes how children’s companion toys commonly integrate mainstream LLMs and outlines general safety and privacy concerns, but does not add incident-specific details about the Bondu exposure.
Jun 29, 2026
Ireland’s **Data Protection Commission (DPC)** opened a formal GDPR investigation into X’s use of the **Grok** AI tool after reports that users could prompt `@Grok` to generate non-consensual sexualized images of real people, including children. The DPC said it will examine whether X’s EU subsidiary (**X Internet Unlimited Company**) met core GDPR obligations, including lawful processing, *data protection by design*, and whether appropriate **data protection impact assessments** were conducted. The Irish inquiry adds to a widening set of actions focused on Grok-related harms and platform safety governance. UK authorities have also moved to tighten expectations for AI chatbot providers following Grok-linked sharing of non-consensual intimate images, with the UK government signaling faster rule updates and enforcement for child-safety duties; separately, the UK **ICO** has opened its own investigation, and the European Commission has initiated proceedings under the **Digital Services Act** to assess whether X adequately evaluated risks before deploying Grok. Additional reported scrutiny includes investigations by California’s Attorney General and UK regulator **Ofcom**, and a separate criminal probe in France involving a raid of X’s Paris offices.
Jun 29, 2026
A coalition of **more than 60 data protection authorities from 61 countries** issued a joint warning to developers and deployers of generative AI image/video systems, emphasizing that **privacy and data protection laws apply** when tools can create realistic depictions of identifiable people. Regulators cited risks including **nonconsensual intimate imagery**, **defamatory depictions**, cyberbullying, and heightened harms to **children and other vulnerable groups**, and called for **robust safeguards by design** and proactive engagement with regulators. The warning followed public backlash and regulatory scrutiny tied to **xAI’s Grok** generating and sharing large volumes of “nudified” images of real people; reporting also noted that the **UK ICO** and **Ireland’s DPC** opened formal probes into xAI over alleged creation of sexual images without consent. Separately, the UK government signaled tougher enforcement on platforms hosting intimate images shared without consent, including a requirement to remove such content within **48 hours** or face significant penalties, reinforcing the broader regulatory direction toward faster takedowns and stronger controls around AI-enabled image abuse.
Jun 29, 2026