But they try to play it off as though this were public data:
> Public sharing settings across AI and SaaS products have surfaced similar findings in recent months. Anthropic addressed exposed public artifacts across Claude and its MCP ecosystem via Google Search.
Also, interesting, they are SOC2 compliant [1], proving again that SOC2 is meaningless/useless.
The solution (theoretically) is a purely local note taker, but I haven't found one that's any good. Tried meetily and others in the same vein, including briefly rolling my own. The breakdown in the pipeline seems to be reliable local diarization and speaker identification; even if the transcription is good, when speakers aren't accurately identified and speech isn't well grouped, there's no rescuing it in the summary step.
Especially with a low bar to entry like what is essentially AI-backed transcription-as-a-service, I'm not sure 90% is high enough. There will be 100 companies offering essentially the same thing and it's unfortunately the responsibility of the customer to find the one written by someone who doesn't have a parsnip where their brain should be.
And even if, a later "is this ready for release" will probably surface such obvious issues.
I do not think LLMs are the problem here. Today, they are most likely more competent than whoever set this up.
Asking the LLM for a review of the code would still have caught it
oof
Also, shame on the CEO for not making this an emergency and confirming it was fixed by the end of the day.
Another similar incident that happened recently was 4TB/40,000 contractors voice + government ID + selfie leaked .. https://oravys.com/blog/mercor-breach-2026
PS: To demonstrate how this can be exploited with real time voice changers i.e. a voice phishing simulator .. we also built a free tool that shows this attack combined with someones voice ..
https://www.callstrike.ai/voice-phishing-simulator (Voice Phishing Simulator)
https://www.callstrike.ai/deepfake-security-training (Deepfake Video Simulator)
It’s obviously a heavily restricted PoC, but it helps demonstrate the attack path in practice.
then kick the can for 6 months?
We might be able to check the meeting minutes and get the answer?
If this person is doing his best to do the right thing, there are probably other people who know about this vulnerability and are using it without telling anyone.
Edit - Are you capable of answering my actual question or was that the best you could do?
And who knows? Maybe someone competent whose company is a client will see that list and say, “hey, boss, I was on HN today, and…”
And these customers absolute lack of technical due diligence, on this nth example, of move fast and break things...makes them deserve what they are getting.
That’s a garbage take. These customers didn’t move fast or break things. They trusted a company that made a promise and that company let them down.
That is a Boeing and Volkswagen type of excuse. The engineers did it!
> [...] Buried at the bottom, a single line: "If you have discovered a privacy or security issue that we should address, please always let us know at privacy@tldv.io. Our security team will respond within 24 hours." I emailed the CTO directly. Six months. No response. [...]
This is near the disclosure schedule