Rabbit R1 flaw leaves every past AI response exposed to the public

Rabbit's bright orange R1 pocket companion is in deep trouble, and this time it is not just about half-baked features.

Rabbitude, a reverse-engineering community tracking the device, just revealed that Rabbit left critical API keys hardcoded right into its codebase. Anyone with access to those keys could allegedly read every response the R1 has ever generated, including sensitive user data.

Keys left under the doormat

According to the Rabbitude team, they gained access to Rabbit's codebase back on May 16 and uncovered several hardcoded credentials. These keys unlocked core integrations powering the device, including ElevenLabs text-to-speech, Azure speech-to-text, Yelp, and Google Maps.

With those keys in hand, attackers would not just be eavesdropping. Rabbitude claimed the access allowed bad actors to read all past R1 responses, alter the device's voice, hijack its replies, or even remotely brick the physical gadgets altogether.

To make matters worse, Rabbitude said Rabbit knew about the vulnerability for over a month and did nothing. It was only after public disclosures that Rabbit revoked the ElevenLabs key, which briefly broke speech functions across active R1 units.

Rabbit pushes back on breach claims

Rabbit is telling a very different story. In a statement to Engadget, the company claimed it was only notified of an alleged breach on June 25.

Rabbit stated that its security team launched an immediate investigation and found no evidence that customer data was leaked or that its internal systems were compromised. However, the company stopped short of confirming whether all the hardcoded keys cited by researchers had actually been revoked.

That leaves users caught between technical proof from independent researchers and flat denials from leadership.

Why it matters

We think this incident is a sobering wake-up call for anyone carrying an R1. If you own the device, the immediate takeaway is straightforward: do not feed it personal addresses, passwords, or sensitive daily queries.

Hardcoding production API keys directly into software is not a subtle architectural debate; it is an unforgivable rookie mistake in modern engineering. For a company that sold tens of thousands of standalone gadgets on the promise of handling everyday chores, handling infrastructure this carelessly destroys consumer trust overnight.

It also exposes the ugly underbelly of the generative AI gadget rush. Rushing flashy hardware to market without rigorous security audits leaves users holding the bag. When revoking a single external key instantly breaks live customer devices, it reveals a brittle, cobbled-together backend that simply is not ready for the real world.