AI meeting recorder tl;dv left 180k calls exposed to the open internet

Any free user could crash live government and corporate meetings on AI recorder tl;dv thanks to an unprotected database.

Security researcher bobdahacker discovered that popular meeting assistant tl;dv left its Firebase database without basic tenant isolation. Any logged-in user could query 181,874 meeting records across 35,003 domains—including live join links for roughly 1,000 calls happening in real time. The researcher even walked uninvited into live calls held by the Malaysian Ministry of Education and a US university team. Despite reporting the issue to leadership in January 2026, the database remained open six months later.

Why it matters: AI meeting bots record sensitive internal work, from corporate pitch decks to government calls across 23 countries. When SaaS tools fail to enforce database access controls, creating a free account gives anyone a pass to read everyone else's records.

Know this: If your team uses tl;dv, assume its stored metadata and live meeting links were visible to any authenticated user on the platform.

Next time an unexpected participant pops into your standup, it might not be a simple calendar glitch.