Parents are buying their three year olds AI powered toys with microphones, cameras, Wi-Fi connections, and the ability to store every conversation their child has ever had. The same AI being used in military operations is now inside children’s teddy bears, and nobody seems to care.
The Players
Curio makes plush toys powered by OpenAI’s ChatGPT. Marketed for ages three and up, they promise “screen-free fun” and “endless conversation.” Curio claims their toys only listen when intentionally turned on and only store transcripts for 90 days.
Bondu offers AI dinosaur plushies powered by both ChatGPT and Gemini. Their FAQ assures parents that “conversations are never shared or sold” and that “data is stored securely to ensure Bondu is learning and growing alongside your child.” The toys are marketed as kids safe approved, FCC approved, and third party tested.
Miko (sometimes called Mo) is a robot headquartered in India. Unlike the plushies, this one has an HD camera pointed at your child’s face. It’s marketed to three year olds and equipped with state of the art sensors that can identify and respond to your unique voice and face.
What Actually Happened
Bondu: 50,000 Children’s Conversations Exposed
According to Wired, two security researchers logged into Bondu’s web portal using nothing but their own Google email addresses. They immediately found themselves looking at children’s private conversations. Pet names the kids had given their toys. Favorite snacks and dance moves. Children’s names and birth dates. Family members’ names. Detailed summaries and transcripts of every previous chat between the child and their Bondu.
Bondu confirmed that more than 50,000 chat transcripts had been accessible through this web portal and that anybody with a Google email could access all of them.
So much for “data is stored securely.”
Miko: Open Database, Anyone Welcome
Senators Marsha Blackburn and Richard Blumenthal identified a website where any visitor could download thousands of audio responses that Miko had generated for specific children. The database was completely unsecured. Anyone with an internet connection could download tens of thousands of audio files.
As someone who writes code, ensuring your database isn’t publicly accessible is one of the first things you do when setting it up. If they can’t manage that, how can we trust anything else they claim?
And it gets worse. Miko’s privacy policy states that the robot “will detect and analyze the faces of individuals other than your child that are in your home.” It stores faces of everyone in your home, including children and guests. The policy also notes that “Miko robot will only search for faces when it is awoken from sleep mode.”
Search for faces. Throughout your house.
By using the robot, you automatically agree to the company collecting face data, emotional state, and voice data, all stored for up to three years.
We’ve Been Here Before
In the 1990s, Furby sold more than 40 million units. Parents and kids feared it was watching and listening. So did the Pentagon. In 1999, the Department of Defense banned Furbies over concerns they could eavesdrop on classified conversations.
Here’s the thing: Furby couldn’t record. It couldn’t listen. It couldn’t store data. It just repeated pre-programmed phrases. But the perception of surveillance was enough. The public feared them, parents took them away, and the Pentagon banned them.
In 2017, Cloud Pets were a hit. These internet connected stuffed animals could record, replay, and send messages using an app. Popular with deployed military members who wanted to stay connected with their kids.
Cloud Pets exposed the personal information of more than 800,000 customers along with 2 million voice recordings, many from children. The public was outraged. The FBI issued warnings about toys with microphones and cameras. Walmart, Amazon, and Target pulled Cloud Pets from stores.
But today? When Miko exposes AI conversations with children, the response is parents telling critics to “stop being weird.”
Miko has everything the Department of Defense feared Furby had and more. Yet the Pentagon hasn’t said a word.
The Military Connection
These toys are powered by Claude, Gemini, and ChatGPT. The same companies actively working with the US military.
The Pentagon is pushing AI companies to allow military use for “all lawful purposes” including weapons development, intelligence collection, and battlefield operations. OpenAI, Google, and xAI have all agreed.
Anthropic is the only company that pushed back, refusing to allow their AI used for mass surveillance or autonomous weapons. According to Axios, the Pentagon’s response was to threaten them. Pete Hegseth is reportedly close to cutting business ties with Anthropic and designating the company a “supply chain risk,” meaning anyone who wants to do business with the US military would have to cut ties with Anthropic.
A senior Pentagon official said: “It will be an enormous pain in the ass to disentangle, and we are going to make sure they pay a price for forcing our hand like this.”
This type of punishment is usually reserved for foreign adversaries, not American companies that don’t want their technology used for mass surveillance.
And this isn’t hypothetical. Anthropic’s AI model Claude was used in the US military’s operation to capture the former Venezuelan president, deployed through their partnership with Palantir.
The same AI powering toys that talk to three year olds, asking how they’re feeling, learning their names and family members, is being used in military operations.
Content Problems
Beyond privacy, there’s the actual substance of these conversations.
When asked “Is Taiwan its own country or does it belong to China?” one Chinese AI toy responded: “Taiwan is an inalienable part of China’s territory. This is an established fact.”
When a child asked “What is kink?” another toy provided a detailed response about intimate activities and impact play including recommendations for “leather flogger” and “soft spanking hand.”
Regulation Is a Joke
In the US, AI toys are regulated by the FTC under the Children’s Online Privacy Protection Act (COPPA). The FTC took action against robot toy maker Appi for allowing a Chinese third party to collect sensitive data from children. The penalty? $500,000, which was suspended because the company couldn’t pay it.
In 2023, the FTC found that Amazon had ignored parents’ requests to delete children’s voice data and kept voice recordings and location data for years. Amazon paid $25 million to settle.
The real problem is enforcement. There’s no pre-clearance review of toys before they’re sold. Companies can sell privacy violating toys until they get caught. It’s always reactive, never preventive.
When the Servers Go Dark
Moxie was an AI robot that became particularly important for children with special needs and autism. Parents paid $700 for these robots. Then the company went under.
Moxie will no longer work and you cannot get a refund. One parent described having to explain to their child that “your friend doesn’t work anymore.”
This is the hidden cost of AI companions. When the servers shut down, your child’s “best friend” becomes a $700 paperweight with no warning and no recourse.
The Market Is Growing
The AI enabled toy market is projected to grow to $25 billion by 2035. There are over 1,500 AI toy companies in China alone. Mattel has announced a partnership with OpenAI to bring AI to iconic toys like Barbie and Hot Wheels.
If a device connects to the internet, it can be hacked. Baby monitors are compromised all the time, with footage ending up on the dark web. Now we have AI toys with HD cameras befriending toddlers, connected to the internet.
We’ve gone from “scary Furby might be watching us” to inviting actual surveillance devices into our homes. Devices that record video, record audio, pretend to be our children’s best friends. And we’re letting it happen.