Written by Jeremy Souffir Founder, JTS Tech Services
The short version: on 4 August a security researcher published findings against tl;dv, a widely used AI meeting notetaker, showing that a missing tenant-isolation rule on its database let any signed-up user query meeting records belonging to every other account — 181,874 records across 84,312 users and 35,003 email domains, including the conference IDs of roughly a thousand calls that were recording at that moment. The vendor published a detailed response the following day disputing parts of the account and stating the flaws are fixed. Both things can be read carefully, and we'll do that below. But the lesson for your business survives whichever version you believe, because it isn't really about this vendor: it's that a tool holding your commercial conversations got into your business without ever meeting your procurement process, and nobody in your company can currently tell you whether its database keeps your data apart from a stranger's.
What actually went wrong?
Nothing clever, which is the uncomfortable part. There was no exploit chain, no stolen credential, no AI being tricked into misbehaving. The application's datastore held every customer's meeting records in one shared collection, and the rule that should have restricted each account to its own rows was missing. Sign up for a free account, and the door to everyone else's compartment was already open.
- The researcher reports 181,874 meeting records covering 84,312 unique users across 35,003 email domains, reachable from an ordinary authenticated free-tier account
- Each record carried the creator's email address, the conferencing provider, timestamps, recording status, and a conference identifier — the joinable ID for the underlying Google Meet or Teams room
- Around a thousand of those were live recordings at any given moment, meaning the identifier pointed at a call in progress; the researcher demonstrated the consequence by joining active calls uninvited, including a government education session with 157 participants
- Sampling a subset of records surfaced meetings on .gov domains across 23 countries, several universities, and a number of named corporates, plus 715 invitee email addresses across 228 domains
- The researcher states the initial disclosure went to the company on 28 January 2026, and that the issue was still reachable when the findings were published on 4 August
The vendor's side, and why we're printing it
tl;dv responded publicly on 5 August. Its position is that only metadata was reachable — meeting identifiers, conference IDs and participant email addresses — and that no passwords, recordings, transcripts, AI-generated notes, or account and billing data were exposed. It disputes the six-months-unfixed framing, saying these were two distinct vectors: the first found via penetration testing and responsible disclosure, remediated and formally validated by an independent tester, and a second, previously unknown path closed within 24 hours of discovery. It also says Firebase has been removed from its stack entirely. We have no way to adjudicate between the two accounts from the outside, and neither do you — which is exactly the point we want to make. Your risk decision cannot rest on being able to referee a dispute between a researcher and a vendor after the fact. It has to rest on what you allowed into the room beforehand.
We don't use that tool. Why does this matter to us?
Because the specific vendor is the least transferable part of the story. Three things about it generalise to every AI tool your staff have adopted, and all three are true of tools with far better security than this one.
- Multi-tenancy is invisible from the outside. Whether a SaaS product keeps your data separated from every other customer's is a property of its database rules, and there is no way to observe it from the login screen, the pricing page, the marketing site or the trust badge. It is a question you have to ask and get answered in writing, and almost nobody asks it
- The tool arrived by invitation, not procurement. This is the structural bit. Meeting notetakers spread one call at a time: a person on a sales call adds a bot, and the bot is now in a room containing your pricing, your roadmap and your customer's problems. Thirty-five thousand domains appearing in one vendor's database does not mean thirty-five thousand companies signed a contract — it means thirty-five thousand companies had somebody in a meeting
- Metadata is not the harmless half. Even taking the narrower account at face value, a list of who met whom, when, and from which company is a readable map of your deal flow, your partnerships and your hiring. And a conference ID for a call happening right now is not metadata in any meaningful sense — it's a door
The two reflexes that both go wrong
The first is to ban the category outright. It doesn't work, it costs you a genuinely useful capability, and it drives the behaviour onto personal accounts where you can't see it at all — the same way blanket bans always have. The second is quieter and more common: assuming this is already covered because the company has a vendor security policy. Those policies govern things somebody bought. Nobody bought this. It came in through a calendar invite, and the control that would have caught it isn't a procurement form — it's a default in your meeting platform that most organisations have never opened.
What are the meeting platforms already doing about it?
More than most teams realise, and it is sitting unused in settings you already pay for. Both major platforms spent the first half of 2026 making an uninvited bot a deliberate decision rather than an accidental one.
- Google Meet added a safeguarded guest-admission flow, rolling out from late March 2026. Admission requests are split into two queues, and the second queue — for connections the host should look at more closely — defaults to deny. The host has to actively override it. Google's own wording is about risk-flagged join requests generally; in practice, community reports are that third-party notetaker bots are what land there
- Microsoft Teams shipped equivalent controls, generally available around June 2026: an admin policy that detects likely external bots, routes them to the lobby in a separate "suspected threats" group rather than the ordinary waiting list, labels them for the organiser, and requires explicit approval — even in meetings where participants would otherwise bypass the lobby
- Both are off, or set permissively, in a lot of tenants — because they are admin-side settings that arrived in a release note, not a project anybody was assigned
If your instinct reading that is that this belongs in the same conversation as the agents quietly switching themselves on inside your CRM and helpdesk, that's the right instinct — we wrote about that governance problem when the platforms started shipping embedded agents. This is its mirror image. That one is about capability appearing inside software you already bought; this one is about outside software walking in through a meeting invite.
What's the legal exposure nobody has priced?
We're engineers rather than lawyers, so take this as the prompt for a conversation with your counsel rather than advice. But the pattern in the legal commentary through 2026 is consistent enough to be worth flagging, because the security question and the liability question have different answers and most teams have only considered the first.
- Consent rules differ by where the participants are, not by where you are. Firms writing on this note that US federal law works on one-party consent while several states require all-party consent — so a single call with attendees in the wrong two places can put a recording on the wrong side of a line
- There is live litigation over exactly this. A class action against another notetaker vendor alleged its bot recorded conversations without adequate disclosure, and that the recordings were used to train transcription models
- Transcripts are discoverable. An AI notetaker quietly multiplies the volume of material subject to litigation hold, and a transcription error or a hallucinated attribution becomes a document that says somebody said something they didn't
- Privilege is not preserved by a consumer AI platform. Legal commentary this year has been pointed about this: running a privileged conversation through a general-purpose tool is a good way to discover the protection was never there
What should we actually do this month?
This is an afternoon, not a project, and the output should be a written decision somebody owns rather than a general intention to be careful.
- Find out what's already joining. Pull the last quarter's meeting logs and list every external participant that isn't a person. Most teams are genuinely surprised by this list, and you cannot make a policy about a set you haven't seen
- Turn on the platform control you already own. The Google Meet admission safeguards and the Teams external-bot policy are both admin settings; switching them from permissive to approval-required is minutes of work and is the single highest-value thing on this list
- Decide which meetings are simply off-limits to any recorder — anything with counsel, anything about people, anything under NDA — and say so plainly rather than leaving it to each person's judgement mid-call
- Pick one or two approved tools and say the words out loud. An allowlist people know about beats a ban people route around, and it gives you one vendor to actually diligence instead of thirty
- Ask the tenancy question in writing before approving anything: how is our data isolated from other customers', who has verified that, and when? Get the answer in an email. A vendor that answers well has just made your case for you; a vendor that can't is telling you something
- Check retention and training defaults on whatever you already use. Where do the transcripts live, for how long, who inside the vendor can read them, and are they used to train anything?
- Name the owner. One person who reviews this quarterly, because vendors change their defaults and your staff will keep discovering new tools
The genuinely encouraging part
Every control this story calls for already exists and costs nothing to switch on. That's unusual. Most of what we write about involves building something — but here the meeting platforms have done the engineering, and the gap is purely that a setting shipped in a release note and never became anybody's job. A company that spends one afternoon on the list above closes most of this exposure permanently, and gets a defensible answer for the client who eventually asks how their confidential call was handled. That is a very good return for an afternoon.
Where we fit
The reason this sat open in 35,003 domains isn't that the people in those companies were careless — it's that the question falls into a gap. IT owns the meeting platform but wasn't asked about the notetaker. Procurement owns vendors but never saw one. Legal owns consent and privilege but wasn't in the call. Sales owns the relationship and quite reasonably wanted better notes. Nobody owns the join between them, and that join is where every one of these AI-adoption problems lives. Closing it is exactly what our Fractional Head of AI & Digital engagement is for: a senior person accountable for which AI tools touch your data, with the authority to set the defaults, run the vendor questions, and keep the register current as your team keeps adopting things. Retaining us for a few days a month means somebody is asking the tenancy question before the tool is in the room, rather than reading about it in a security researcher's blog post six months later — and it means the answer is written down when a customer asks you to produce it.
Sources
- bobdahacker — tl;dv (Too Lazy; Didn't Validate): 181,874 Meetings Left Wide Open (4 August 2026; the original disclosure, record counts, live conference IDs and reported timeline)
- tl;dv — Our thoughts on the darkreading.com article (5 August 2026; the vendor's response — metadata-only scope, two distinct vectors, independent validation, Firebase removed)
- Netizen — Inside the tl;dv Flaw That Exposed Live Government and Corporate Meetings (independent write-up of the same findings)
- Google Workspace Updates — Safeguarded guest admit flow in Google Meet (the two-queue admission flow with deny as the default action; rollout from 24 March 2026)
- Microsoft Learn — Manage external bots and their access to meetings hosted in your organization (the Teams admin policy: detect, lobby, label, require organiser approval)
- Microsoft Teams Blog — Introducing smarter bot protection in Microsoft Teams meetings (the "suspected threats" lobby group and admission confirmations)
- Mayer Brown — AI Notetakers: Productivity Tool or Emerging Legal Risk? (3 June 2026; consent regimes, the Otter.ai class action, discoverability, privilege, and suggested governance)
