DarkReading.com reported “A popular AI notetaker is allowing hackers to spy on any of its users’ conference calls.” The August 4, 2026 article entitled ” AI Notetaker Lets Hackers Spy on Government, Corporate Video Calls” (https://www.darkreading.com/application-security/ai-notetaker-spy-government-corporate-video-calls) included these comments about “Vulnerabilities in the tl;dv Meeting Assistant”:
When a user signs up for or signs into tl;dv, they’re assigned a session ID in the app’s back end Firebase system. This session ID affords them unusual power, though, to query the app’s Cloud Firestore database.
It would be one thing if the user could only see the Firestore data associated with their account. Indeed, that’s almost entirely the case. Users cannot see other users’ transcripts, recordings, chats, etc., thanks to basic tenant isolation. The app has an Achilles’ heel, though: its “meetings” collection.
Thanks to missing isolation for that one container, any tl;dv user can query every live conference call in the world into which tl;dv is invited. They can also grab some light metadata — like meeting timestamps and recording status — as well as its creator’s email address.
When developers build apps with Firebase, “Firestore security rules are the first thing Google tells you to configure,” BobDaHacker tells Dark Reading. “The documentation walks you through it with examples. The default rules when you create a new Firestore database even warn you that they’re open and need to be locked down.”
The fix would be just as effortless to implement. “A few lines of security rules that scope reads to the authenticated user’s organization,” they say.
Anyone surprised?
First published at https://www.vogelitlaw.com/blog/nbspai-notetaker-allowing-hackers-to-spy-on-conference-calls