AI notetaker tl;dv left 181,874 meeting records exposed for six months after being warned

[Western Depot]

A security researcher going by bobdahacker publicly disclosed that tl;dv, a popular AI notetaker used with Zoom, Google Meet and Teams, left 181,874 meeting records across 84,312 users and 35,003 email domains queryable by any authenticated user because of a missing Firestore tenant isolation rule

What makes this one sting more than a typical breach disclosure is the timeline, the researcher reported the flaw back on January 28, 2026, and it apparently remained unfixed through repeated follow ups for months before the public disclosure finally forced action

Roughly a thousand of those records were fully public with no authentication required at all, and 715 invitee emails were exposed alongside them, and reporting says active recording sessions including government agency, university, HubSpot and Confluent calls were joinable by outsiders while they were happening

Tenant isolation failures like this are a specific and well understood class of bug, when a backend database like Firestore is not properly scoped per customer, any authenticated user on the platform can potentially query data belonging to other organizations, it is one of the most basic multi tenant SaaS security requirements and getting it wrong at this scale suggests a fairly fundamental gap in how the system was architected

AI notetakers sit in an unusually sensitive position because they are explicitly designed to capture and transcribe entire conversations, often including sensitive business, legal or personal discussion, so a tenant isolation failure here is worse than the equivalent bug in a typical SaaS product simply because of what the data actually contains

The six month gap between private disclosure and public fix, if the reporting holds up, is really the core story here, responsible disclosure only works when the affected company actually treats the report with urgency, and a live joinable government agency call sitting exposed for that long is the kind of detail that should worry anyone using AI meeting tools without asking hard questions about their security posture first

Ai Notetaker Spy Government Corporate Video Callswww.darkreading.com

[TomTiz]

Six months from private disclosure to fix for a bug this severe is genuinely unacceptable for any company handling meeting data

[Chris27]

Government agency calls being joinable by outsiders is the detail that should be the headline honestly, not just the record count

[SockPuppet93]

715 invitee emails exposed is a GDPR nightmare depending on where those users are located

[Transformer Curtis]

Props to the researcher for actually pushing this public after being ignored for months, thats how these things get fixed