A security researcher has discovered that tldv, a popular AI meeting recording and note-taking app, left over 181,000 meeting recordings publicly accessible — exposing the confidential conversations of companies, teams, and individuals who trusted the platform with their most sensitive discussions.
This isn't just another data breach. It's a wake-up call about the security implications of the AI tools we're rapidly adopting without sufficient scrutiny.
What Happened
According to the security research published by "bobdahacker," tldv had a misconfiguration that exposed meeting recordings through publicly accessible URLs. The exposed data included:
- 181,000+ meeting recordings — video and audio of real business meetings
- AI-generated transcripts — full text transcriptions of discussions
- AI-generated summaries — automated summaries of meeting content
- Meeting metadata — participant names, timestamps, and organizational details
The exposure meant that anyone with the right URL could access these recordings without authentication. No login required. No hacking needed. Just a URL.
Why This Is Worse Than a Normal Data Breach
Meeting recordings are uniquely sensitive because they capture:
- Strategic discussions — product roadmaps, competitive analysis, business plans
- Personal information — health updates, HR discussions, personal circumstances
- Confidential client data — customer names, project details, financial information
- Intellectual property — technical decisions, code discussions, patent ideas
- Casual remarks — things people say when they think the audience is limited
When you record a meeting, you create a permanent record of unstructured, candid conversation. Unlike a database of structured records, meeting recordings contain the full context — tone, emotion, side comments, and the kind of information people share only because they trust the audience.
The AI Angle: Why AI Tools Are Especially Risky
AI meeting tools like tldv, Otter, Fireflies, and others create new attack surfaces that traditional software doesn't have:
External API Dependencies: These tools often send audio to external APIs for transcription, creating multiple points of potential exposure.
Cloud Storage by Default: Meeting recordings are stored in cloud infrastructure that can be misconfigured. The default is to store everything, everywhere, permanently.
AI-Generated Artifacts: The transcripts and summaries are new derived data — they're searchable, copyable, and potentially more dangerous than the raw recordings because they're easy to scan for keywords.
Sharing Features: AI meeting tools are designed to make sharing easy — which also makes unauthorized access easy when security fails.
Long-Term Retention: These tools often retain recordings indefinitely for training AI models, creating a growing treasure trove of sensitive data.
The Pattern: Move Fast, Secure Later
The tldv breach follows a now-familiar pattern in the AI tooling space:
- Ship fast: AI features are the priority. Security is an afterthought.
- Default to open: Cloud storage is configured for convenience, not security.
- Scale creates risk: As the user base grows, the volume of exposed data grows exponentially.
- Silent failures: Misconfigurations don't trigger alerts. The data just sits there, accessible.
This is the same pattern we've seen with every wave of rapid technology adoption — from early SaaS to mobile apps to IoT devices. The difference is the sensitivity of the data involved.
What Companies Should Do
If you're using AI meeting tools (and most companies are), here are immediate actions:
- Audit your tools: Check what meeting recording tools are in use across your organization
- Review retention policies: How long are recordings kept? Can they be deleted?
- Check access controls: Are recordings access-controlled or publicly accessible?
- Limit sensitive meetings: Don't record meetings discussing truly confidential information
- Review vendor security: Ask your AI tool vendors about their security practices
What AI Tool Developers Should Do
For those of us building AI tools, the tldv breach offers clear lessons:
- Security by default: Storage should be private by default, not public
- Authentication required: No unauthenticated access to user data, ever
- Encryption at rest: All stored data should be encrypted
- Audit logging: Track who accesses what, and alert on anomalies
- Data minimization: Don't store more than you need, and delete what you don't
- Regular security audits: Test your own infrastructure for the same kind of misconfiguration
The Bigger Picture
The tldv breach exposes a fundamental tension in AI tooling: the features that make these tools useful (automatic recording, cloud storage, easy sharing, AI-generated summaries) are the same features that make them dangerous.
As AI becomes embedded in every aspect of work, we're generating unprecedented volumes of sensitive data — and trusting startups with varying levels of security maturity to protect it.
The solution isn't to stop using AI tools. It's to demand better security from the tools we adopt, to be thoughtful about what we record, and to build security into AI tools from the start rather than bolting it on after a breach.
181,000 exposed recordings should be the last warning we need.
Top comments (1)
AI meeting tools are high-risk because the data is both sensitive and easy to underestimate. Recordings, transcripts, speaker names, calendar metadata, and share links all need lifecycle rules, not just a privacy checkbox.