Rabbitude, a group of developers and researchers, has exposed a security vulnerability in Rabbit’s R1 AI assistant.
The group discovered that API keys were hardcoded into the company’s codebase, a practice that is widely considered a major security flaw.
These keys provided access to Rabbit’s accounts with third-party services, including its text-to-speech provider ElevenLabs and its SendGrid account, which is used for sending emails from the rabbit.tech domain.
According to Rabbitude, access to these API keys, particularly the ElevenLabs API, meant that they could access every response ever given by R1 devices.
This breach of privacy is alarming, as it exposes sensitive user data to potential misuse.
Rabbitude published an article yesterday detailing their findings, stating that they gained access to the keys over a month ago.
Despite notifying Rabbit about the breach, the company did not take immediate action to secure the information.
Rabbit’s Response and Ongoing Investigation
Rabbit responded to the security breach by pointing to a published page on its website.
Scan Your Business Email Inbox to Find Advanced Email Threats - Try AI-Powered Free Threat Scan
Company spokesperson Ryan Fenwick stated that the company is investigating the incident and will provide updates as they become available.
The statement on the site echoes a post Rabbit made to its Discord channel, claiming that they have not yet found any compromise of their critical systems or the safety of customer data.
However, Rabbitude’s report suggests otherwise. The group mentioned that while access to most of the keys has been revoked, indicating that Rabbit rotated them, they still had access to the SendGrid key.
This lingering vulnerability raises questions about the effectiveness and timeliness of Rabbit’s response to the breach.
A Troubled Launch and Eroding Trust
Since its much-hyped launch this spring, the Rabbit R1 AI assistant has had a rocky journey.
Initially, the device was criticized for its poor battery life, limited feature set, and frequent errors in AI-generated responses.
Although the company issued a software update to address some of these issues, the core problem of overpromising and underdelivering remains.
This latest security breach further erodes public trust in Rabbit and its R1 device.
The exposure of sensitive user data due to hardcoded API keys is a serious oversight that could have far-reaching consequences.
As Rabbit continues its investigation and attempts to reassure its user base, the company faces an uphill battle to regain credibility and trust.
The discovery of hardcoded API keys in Rabbit’s R1 AI assistant codebase is a significant security lapse that exposes user data to potential misuse.
Rabbit’s response to the breach has been criticized for its lack of immediacy and effectiveness.
As the company works to address these issues, it must also contend with the broader challenge of restoring public trust in its products and services.
Free Webinar! 3 Security Trends to Maximize MSP Growth -> Register For Free