tl；dv 逾18.1万段AI会议录音被公开暴露，可实时闯入他人通话
Key Highlights
The AI meeting-recording platform tl;dv exposed 181,000 meeting recordings because its Firestore database lacked tenant isolation, letting any logged-in user pull them. About 1,000 meetings actively recording leaked joinable IDs, which researchers used to break into live calls of Malaysia's education ministry and a US university team. The flaw was reported in January 2026 and remained unpatched six months later, with over 1,000 recordings also left public — an exposure surface staggering in its size and a cautionary tale for every vendor that stores sensitive conversations.
What Happened
Security researchers found that tl;dv's Firestore database had no tenant isolation: any authenticated user could query the full set of meeting records across tenants. The blast radius is staggering — 181,000 recordings, 84,312 users, 35,003 domains, including internal meetings of 23 governments and multiple universities. Worse, about 1,000 meetings in recording state wrote their "joinable meeting ID" into the database, letting researchers directly intrude into live calls of Malaysia's education ministry and a US university, effectively planting an invisible ear in the room without the other side noticing. The researchers used only legitimate authentication, not exploits, to reach the live sessions.
Technical Details
The root cause is a classic multi-tenant permission flaw: the backend uses Firebase/Firestore for storage but does not enforce "return only the current user's tenant data" at the query layer, relying instead on client-side filtering or none at all. Once an auth token is valid, an attacker crafting a broad query can enumerate every document in the store. Additionally, some in-recording meetings stored meeting links and IDs as ordinary, unencrypted fields, amplifying lateral-movement risk because one leaked ID opened another room. Researchers also found over 1,000 recordings marked public, obtainable with no skill at all, suggesting the misconfiguration was not an isolated case but a pattern of weak defaults.
Versus Competitors
Compared with Otter.ai, Fireflies.ai, and other meeting-transcription products, tl;dv's lesson is that multi-tenant SaaS security cannot bet on "users won't snoop"; isolation must be enforced at the data-access layer, e.g., row-level filtering by tenant_id and backend policy checks that the server, not the client, enforces. BaaS like Firebase is fast to start with, but without explicit security-rule hardening it easily yields the fatal "authenticated equals fully readable" config, wrongly shifting isolation responsibility to the client, which is never trustworthy and can be bypassed by anyone who reads the network traffic.
Industry Impact and Use Cases
Put simply, before handing meetings to an AI recorder, ask "who can see this?" For sensitive settings like government, universities, and healthcare, meeting content often holds unpublished decisions and personal data; once leaked, the fallout exceeds ordinary privacy incidents and may even touch national security, forcing breach notifications and diplomatic embarrassment. The case also reminds buyers: when evaluating AI meeting tools, write tenant isolation, encryption, auditing, and vulnerability-response SLAs into the contract with penalties. Enterprises already using it should immediately review export permissions, disable unnecessary public sharing, rotate potentially exposed meeting credentials, and check whether historical recordings have leaked to limit the damage from a half-year-old hole. The episode should push every buyer of AI meeting tools toward a concrete security checklist rather than vague assurances. Ask the vendor, in writing, whether tenant isolation is enforced server-side by tenant_id, not merely hidden in the client; whether recordings at rest are encrypted with keys the vendor cannot trivially read; and what their maximum time-to-patch is for a confirmed exposure. Request a copy of their most recent penetration test and a reference architecture for multi-tenant data flow. Internally, treat meeting recordings as sensitive by default: strip them from default sharing, expire links, and restrict who can export. Where regulation applies, confirm the vendor stores data in an acceptable region and supports deletion on request. The broader lesson is that convenience features — auto-join links, public recordings, cross-tenant search — are exactly the surfaces where isolation breaks, so they deserve the strictest review. Researchers did tl;dv a favor by disclosing responsibly, but six months of silence turned a fixable bug into a breach with real victims, a timeline that should weigh heavily on any enterprise still weighing whether to renew. In the end, the cost of a missing isolation rule was measured not in dollars but in trust that will take far longer to rebuild.