AI Notetaker Breach: 181,874 Meetings Exposed For 6 Silent Months

Fasr Facts

A researcher found that tl;dv, an AI meeting assistant used by more than 2 million people, left a database open to any logged-in user. The AI notetaker breach exposed 181,874 meetings across 84,312 users and 35,003 domains, including government agencies in 23 countries, and sat unfixed for roughly six months after it was first reported.

The AI notetaker breach disclosed this month is a rare case where the researcher didn’t just find a vulnerability, he walked into a live government meeting through it. Security researcher bobdahacker discovered that tl;dv’s backend database had no rule separating one customer’s data from another’s, a gap that turned a routine meeting-notes tool into a searchable index of other people’s video calls, according to the original disclosure.

A Six-Month Gap Behind a Compliance Badge

What makes this AI notetaker breach worth a second look isn’t the bug itself, misconfigured databases happen constantly, it’s the timeline. bobdahacker says the flaw was first reported in late January 2026 and remained live through repeated follow-ups, with Dark Reading confirming it was still exploitable when they contacted the company for comment in August, per Dark Reading’s reporting. tl;dv holds SOC 2 certification the entire time, which is precisely the detail that should worry procurement teams more than the breach itself.

181,874 meeting records exposed across 84,312 users and 35,003 email domains, including government agencies from 23 countries and universities such as UC Berkeley and the University of Tokyo — the scale that makes this AI notetaker breach one of the largest tenant-isolation failures reported this year.

What One Missing Rule Actually Handed Over

Each exposed record included the meeting creator’s email, a live conference ID, recording status, and timestamps, according to bobdahacker’s writeup. Roughly 1,000 meetings sit in “recording” status at any given moment inside that same collection, meaning their conference IDs were live doorways, not historical logs. The researcher used that access to join a Malaysian Ministry of Education training call with 157 participants, uninvited. Corporate exposure ran just as wide: Japan’s Mitsui-Soko had 484 meetings exposed across four regional offices, alongside records from HubSpot and Confluent, per Netizen’s technical breakdown. See our analysis where we explain why containment failures are becoming an industry-wide pattern.

I was in the same call. Nobody invited me. The Firestore database did.— bobdahacker, security researcher, via Zeli

⚠ Fiction — illustrative scenario: A regional utility company records its weekly ops review through an AI notetaker to save someone the job of writing minutes. Six months later, an auditor asks who else could see that meeting. Nobody knows, because nobody ever asked the vendor. The tool passed procurement because it had a compliance badge, and the badge was the only question anyone checked.

The Compliance Theater Problem

SOC 2 audits test whether a company follows its own stated security controls, not whether every database collection actually enforces tenant isolation in practice, a distinction one commenter on this story summarized bluntly as proof that the certification alone tells buyers very little.

For procurement teams, that’s the real lesson of this AI notetaker breach: a badge on a vendor’s website is not the same as a tested guarantee that your data stays walled off from every other customer’s. bobdahacker also reported joining private meetings roughly 80% of the time simply by impersonating the tl;dv bot and requesting entry, exposing a second weakness sitting entirely outside the database, human trust in a familiar meeting-bot icon. See our related coverage on why a single rogue-agent incident should change how buyers write contracts and why industrial AI infrastructure needs the same scrutiny.

Global Implications

Government agencies across 23 countries had meetings sitting in this collection, a reminder that AI notetakers are now default infrastructure inside public institutions, not just startups, and an AI notetaker breach at that scale carries diplomatic as well as commercial weight. For buyers in emerging markets adopting these tools to save on transcription and minute-taking costs, the incentive to skip a security review is even stronger, and the leverage to demand one from a well-funded vendor is weaker. See our analysis of why agentic AI governance is losing the identity race entirely and our broader look at AI agent governance risk heading into next year.

💡 CreedTec Analyst’s Note — Daniel Ikechukwu

Strategic Impact: This AI notetaker breach shows that compliance certifications and real data isolation are two separate things, and most buyers still confuse them.

Stop: Accepting a SOC 2 badge as proof that tenant isolation was actually tested.
Start: Asking AI vendors for penetration-test results specific to multi-tenant data separation, not just a compliance certificate.
Watch: Whether tl;dv issues a public disclosure and fix timeline, or whether this quietly disappears like the six months before it.

ROI Outlook: A five-minute vendor security questionnaire costs nothing next to the exposure this AI notetaker breach caused over half a year.

Does SOC 2 certification guarantee an AI vendor’s data is isolated between customers?

No. SOC 2 verifies that a company follows its documented controls, but it doesn’t independently test every database rule, and this AI notetaker breach happened at a SOC 2-certified company.

AI notetakers are now standard meeting infrastructure across governments, universities, and enterprises worldwide, and this AI notetaker breach won’t be the last of its kind. The next vendor question worth asking isn’t whether a tool has a compliance badge, it’s whether anyone has actually tried to break its tenant isolation and published the result.

Get CreedTec’s next AI vendor risk briefing before your team adopts another AI tool by default.
Subscribe

Sources