cross-posted from: https://infosec.pub/post/14981035

But as I and others looked closer, and thought about it more deeply, things became concerning.

These logs include:

Your precise GPS locations (which are also sent to their servers).
Your WiFi network name.
The IDs of nearby cell towers (even with no SIM card inserted, also sent to their servers).
Your internet-facing IP address.
The user token used by the device to authenticate with Rabbit's back-end API.
Base64-encoded MP3s of everything the Rabbit has ever spoken to you (and the text transcript thereof).