The Rabbit R1 was unveiled earlier in the year during the CES season, with the company making a lot of bold claims for its US$199 (~RM939) smart device alternative. Across the internet, reports have been sprouting that paint the device in unflattering colours, especially when it comes to the true nature of its supposed Large Action Model (LAM). More recently, a report has claimed that it also poses a security risk in addition to not being what it was touted to be.
Rabbitude, a reverse engineering community surrounding the Rabbit R1, has claimed that the company’s code can leave users’ sensitive data “accessible to anyone”. More specifically, the report claims that “several critical hardcoded API keys” can allow anyone to “read every response every R1 has ever given, including ones containing personal information”. Beyond seeing user information, the vulnerability can also allow the voice and response of the R1 itself to be altered, or even for the device to be bricked.
These API keys used by the Rabbit R1 are for four specific services, but the most egregious one looks to be for a text-to-speech tool called ElevenLabs. This is the one that allows it to seemingly do the four things mentioned above. The group claims that to have “internal confirmation” of the company being aware of these flaws but ignoring them. In a statement to Engadget, Rabbit claims that the date when the initial report was published was when the company was made aware of the “alleged data breach”. Also being claimed that it is not aware of any customer data or its systems being compromised.
This would be another blot on the reputation of the Rabbit R1. Tech outlets with access to units for review have generally claimed that it doesn’t do enough to justify buying another product when a phone can do most of what it does. And if you’ve been around the internet for long enough, there are reports that its LAM is simply OpenAI’s ChatGPT and Playwright scripts mashed together.
