The AI notetaker let strangers into the meetings, and no one had to break in

Security researcher BobDaHacker published a review of the AI notetaker tl;dv on 4 August 2026. According to the review, the service's Firestore database lacked separation between customers, so any signed-in user could pull meeting data from across the platform. The researcher reports 181,874 meeting records covering 84,312 users and 35,003 email domains. Each record held, among other things, the email address of the person who created the meeting, timestamps, recording status and a meeting identifier that pointed on to the room in Google Meet or Microsoft Teams. Dark Reading wrote the same day that the exposure was still active, and that the researcher first notified the vendor on 28 January 2026.

What happens technically

An AI notetaker is a program that joins the video meeting as a participant, records the audio, transcribes the conversation and produces a summary. tl;dv is built on Google Firebase. In that architecture the app often talks straight to the Firestore database using a token, rather than going through an intermediate server that can vet every lookup. The security rules in Firestore then are the access control. Google describes this in its own documentation, and warns explicitly against rules that let any authenticated user read everything.

According to the researcher's review, that boundary was exactly what was missing. An entirely ordinary account could exchange its login for a Firebase token through the service's own endpoint, and then query the collection holding the meetings. The collection had no separation per customer, so the query returned meetings across every account. This is not a break-in in any technical sense. The account is genuine, the token is issued by the service itself, and the query is the same kind of lookup the app performs constantly. What was missing was the rule that a user may only see their own organisation's data. The fix is correspondingly small, and consists of rules that scope reads to the user's own organisation.

The content of the records is what separates a leak of metadata from a leak of conversations. The meeting identifier pointed to the underlying meeting room. The researcher reports that roughly 1,000 meetings stood with active recording at any one time, and that it was therefore possible to watch a meeting begin and join it uninvited while it was under way. The researcher also found more than 1,000 publicly accessible meeting recordings by working through 27,334 meeting identifiers, exposing 715 invitee email addresses across 228 domains. The material came from 23 countries. Among the organisations the researcher names are government bodies in Brazil and Ukraine, universities and several well known companies. The researcher additionally found an internal World Cup game on one of the service's subdomains, where an open interface without authentication returned 43 player records and 19 employee email addresses with full names.

The timeline belongs to the story. The researcher reports that the vendor was notified on 28 January 2026, with repeated follow-ups through to 22 July 2026, and that the flaw was still unfixed when the review was published. Dark Reading wrote on 4 August 2026 that the exposure remained active. Berigo has found no public statement from the vendor about the matter, so we do not know what has been done since publication. It is worth saying plainly: this is the status known from the sources, not a check we have carried out ourselves, and we have not tested the service.

The case is at the same time an example of a larger category, and that is the part which concerns the most organisations. An AI notetaker is a participant with deep access to your communications. It connects to the calendar, often joins meetings automatically, stores audio and text with a third party, and spreads the content further through sharing features. Nudge Security described in January 2026 how such tools ask for access to every calendar the employee can reach, and add themselves to meetings going forward. They report that one customer saw 800 new accounts created in 90 days. Fireflies itself reports more than 20 million users across 500,000 organisations. The numbers show that this is rarely a decision the organisation has made.

What this means for you if AI notetakers join your meetings

The worst thing that can happen to you here is rarely that a single recording goes astray. It is what your meetings actually contain. Board meetings, negotiations, personnel matters, security reviews and meetings with legal counsel are often precisely the meetings someone wants minutes from. An AI notetaker moves that content out of your own control and into a vendor's database. The vendor's access control has thereby become your access control. This case shows what happens when that control is absent, and it shows it without anyone having to break in anywhere. Berigo has previously covered a critical vulnerability in the Pexip Infinity meeting platform and hidden text in Word that makes Copilot alter and spread documents. The pattern is the same. The tools meant to make collaboration easier gain access to everything the collaboration consists of. The legal side weighs at least as heavily for you. The Norwegian Data Protection Authority writes, on audio recording of conversations, that a legal basis is required, and that the person being recorded must be told that the recording is happening and what the purpose is before the conversation begins. The authority also writes that it is usually not sufficient to say a conversation may be recorded, because that is unclear information. The guidance concerns audio recording generally, but the point lands squarely on a notetaker that switches itself on. In the United States the question is already before the courts. The lawsuit Brewer v. Otter.ai was filed in August 2025, alleging that the service joined meetings as a participant and recorded people who were not themselves customers, and that the recordings were used to train the company's models. The law firm Smith Anderson pointed in October 2025 to two consequences you should note. Confidentiality can be lost when a third party gains access to the conversation, and the transcripts become evidence that may be demanded in a dispute.

Berigo's assessment is that you should govern an AI notetaker as a supplier, not as an app. In practice that means four things. First, you have to know which tools are in use today, and that answer sits in the calendar integrations and the sign-in logs, not in a survey. Second, you have to decide which meetings never have a notetaker, and that decision cannot be left to whoever books the meeting. Third, you have to read the agreement on three points: how long data is retained, whether the content is used to train models, and who at the vendor can read it. Fourth, you have to change the meeting culture, so participants are told the notetaker is present and have a real opportunity to decline. This is governance under ISO/IEC 42001 and the supplier security requirements in NIS2 article 21. It is at the same time ordinary courtesy set in system, and that is probably the description which convinces the most people around you.

Berigo recommends

• Map which AI notetakers are actually in use, through calendar integrations and sign-in logs, rather than by asking the departments.
• Decide in writing which meeting types never have a notetaker, and place board meetings, personnel matters, legal counsel and security incidents there.
• Require a written answer from the vendor on retention, use of content for model training and who holds read access, before the tool is approved.
• Turn off automatic joining, so the notetaker must be connected deliberately by a participant in each individual meeting.
• Inform participants before recording starts, and give a real opportunity to opt out, in line with the requirement for clear information.