Rabbit R1 has a major security flaw in its code [Video]

“All [Rabbit] R1 responses ever given can be downloaded,” according to an R1 research group called Rabbitude.

Rabbit and its R1 AI device has already been dunked on for being nothing more than an Android app wrapped up in a hardware gadget, but something much more alarming is afoot.

The report (via The Verge) said Rabbitude gained access to the codebase and discovered API keys were hardwired into its code. That means anyone with these keys could “read every response every r1 has ever given, including ones containing personal information, brick all r1s, alter the responses of all r1s [and] replace every r1’s voice.” The investigation discovered that these API keys are what provided access to ElevenLabs and Azure for text-to-speech generation, Yelp for reviews, and Google Maps for location data.

What’s worse, Rabbitude said it identified the security flaw on May 16 and that Rabbit was aware of the issue. But “the API keys continue to be valid as of writing,” on …