The information displayed in the AIM should not be reported as representing the official views of the OECD or of its member countries.
Security researchers discovered that Bondu, an AI toy company, left over 50,000 children's chat logs and personal data exposed via an unsecured web portal. Anyone with a Gmail account could access sensitive conversations and personal details, resulting in a major privacy breach before the company closed the vulnerability.[AI generated]
Why's our monitor labelling this an incident or hazard?
The AI system is explicitly involved as it powers the chat feature of the toy, generating and storing transcripts of conversations with children. The security flaw in the system's web portal allowed unauthorized access to sensitive data, directly leading to harm in the form of privacy violations and potential breaches of children's rights. This fits the definition of an AI Incident because the development and use of the AI system directly led to harm (violation of rights and privacy). The company's remediation efforts do not negate the fact that harm occurred.[AI generated]