A Critical Flaw in AI Notetaker Exposes Government and Corporate Video Calls to Hackers
A shocking vulnerability has been discovered in tl;dv, a popular AI meeting tool used by millions worldwide, including government agencies, large corporations, and top universities. A skilled hacker, known as BobDaHacker, stumbled upon a misconfiguration in the app’s Google Firebase environment that allows users to access any other user’s meeting information, potentially joining calls without their knowledge or consent.
The issue lies in the way tl;dv handles its Cloud Firestore database, which stores meeting data. While basic tenant isolation prevents users from accessing each other’s transcripts, recordings, and chats, a gaping hole exists in the “meetings” collection. This allows any user to query all live conference calls into which tl;dv is invited, along with metadata such as meeting timestamps and recording status.
BobDaHacker was able to exploit this vulnerability by querying the Firestore database using a session ID assigned to them when they signed up for or signed into the app. With this information, they could identify and join calls hosted by government agencies and large organizations, including those in Malaysia, Japan, and the United States. In some cases, meeting IDs led to further data leakage.
The implications of this flaw are severe. Government agencies and corporations use tl;dv to conduct sensitive discussions, share confidential information, and collaborate on high-stakes projects. Exposing these conversations to hackers poses a significant risk to national security, intellectual property, and competitive advantage. Moreover, the fact that BobDaHacker was able to join most calls roughly 80% of the time suggests that this vulnerability could have been exploited by malicious actors for months.
The fix for this issue is surprisingly straightforward: implementing a few lines of security rules that scope reads to the authenticated user’s organization. This would prevent users from accessing meeting information outside their own organization and plug the hole in the “meetings” collection. It’s unclear why tl;dv has not addressed this issue, despite being notified by BobDaHacker.
As we continue to rely on AI tools like tl;dv for our most sensitive communications, it’s essential that developers prioritize security and address vulnerabilities before they can be exploited. Users of tl;dv should remain vigilant and take steps to protect their meeting data, such as using strong passwords and enabling two-factor authentication.
For developers building apps with Firebase, this incident serves as a stark reminder of the importance of configuring Firestore security rules correctly. As BobDaHacker notes, “the documentation walks you through it with examples” – it’s time to take these precautions seriously.
Source: Dark Reading — 2026-08-04