This [1] seems to be an official response by that company, given that OPs article was published on Aug 4th, and their article was supposedly published a day thereafter, while mentioning the "6 months" open vulnerability gap.

[1] https://tldv.io/blog/our-thoughts-on-the-darkreading-com-art...

Don't worry, I'm sure this was all an AI agent's fault, so no one to blame and all they need to do is update their code review prompts to not make mistakes.

I'm very intrigued by AI note takers, but I'm absolutely unwilling to expose me or my clients to this exact problem.

The solution (theoretically) is a purely local note taker, but I haven't found one that's any good. Tried meetily and others in the same vein, including briefly rolling my own. The breakdown in the pipeline seems to be reliable local diarization and speaker identification; even if the transcription is good, when speakers aren't accurately identified and speech isn't well grouped, there's no rescuing it in the summary step.

I keep being amazed how most basic things are not checked. Cross-tenant isolation is one of the main things I check for... With other generic information leaks.

"Government meetings from 23 countries: Brazil, Colombia, Peru, Ukraine, El Salvador, the Philippines, Chile, Indonesia, Mexico, the United States, Qatar, Malaysia, Uzbekistan, Sri Lanka, Haiti, South Africa, Jamaica, Honduras, Argentina, Thailand, Japan, Israel, and Belize. "

oof

Not the first time I read a shitty implementation with Firebase, I'm not blaming the platform, but seems there is a huge skill issues around it.

Wasn't a dating app exposed this year with same negligence or firebase security?

Six Months !?! If I'd left a vulnerability like that open for 6 hours there'd be hell to pay. Something that critical is call for hitting the big red off button.

Hmm, does Ukraine know that Russia is watching the Ministry of Digital Transformation's meetings?

This is bad. I run a company in this space (deepfake voice phishing), and one of the most common pushbacks we hear from buyers is: “Where are attackers going to get audio clips of our employees?” ... excluding senior leadership, which most companies already recognize as a risk.

Another similar incident that happened recently was 4TB/40,000 contractors voice + government ID + selfie leaked .. https://oravys.com/blog/mercor-breach-2026

PS: To demonstrate how this can be exploited with real time voice changers i.e. a voice phishing simulator .. we also built a free tool that shows this attack combined with someones voice ..

https://www.callstrike.ai/voice-phishing-simulator (Voice Phishing Simulator)

https://www.callstrike.ai/deepfake-security-training (Deepfake Video Simulator)

It’s obviously a heavily restricted PoC, but it helps demonstrate the attack path in practice.

Is this still active? I wouldn't mind spying on some meeting notes. Sounds fun.

holy crap. how do you respond as CEO to this and not escalate to like priority #1?

then kick the can for 6 months?

I understand the need to shame this platform, but why expose all their clients to this much risk? This disclosure here just named a whole bunch of clients. Why?

So did he email privacy@tldv.io? Why not? Maybe someone who understands it would read it.