The $199 Rabbit R1 launched as a dedicated pocket assistant, but the device failed to deliver on its core promise of consistent task execution. I found the hardware design, with its rotating camera and tactile scroll wheel, clearly superior to the screenless Humane Ai Pin. However, the software at launch was an unfinished alpha that left early adopters feeling like beta testers for a broken product. The company has since pivoted away from general assistant duties toward agentic vibe coding with RabbitOS 2, yet the security infrastructure remains dangerously fragile.
Hardcoded keys and data leaks
Rabbitude discovered multiple hardcoded API keys in the R1 codebase on May 16, 2024, which allowed unauthorized access to critical services. These keys connected to ElevenLabs, Azure, Yelp, and Google Maps, granting attackers the ability to read every response ever given by any device. They could also brick all units, alter responses, or replace voices across the entire user base. Rabbit did not revoke these keys until June 26, after public exposure forced their hand. A fifth key for SendGrid remained active even later, providing access to all emails sent from the r1.rabbit.tech subdomain. This vulnerability let researchers send sample emails from Rabbit’s own domains to journalists, proving the breach was real. The company admitted the flaw only after this evidence surfaced, claiming no customer data had been leaked despite the valid keys sitting in the code for weeks.
| Service | Function | Risk Level |
|---|---|---|
| ElevenLabs | Text-to-speech generation | Critical |
| Azure | Speech-to-text system | High |
| Yelp | Review lookups | Moderate |
| Google Maps | Location data | High |
| SendGrid | Email access | Critical |
I view this as a fundamental failure of basic security hygiene, where development shortcuts created a massive attack surface. The delay in revoking keys suggests a lack of urgency regarding user safety. If you are considering buying a used R1, assume your previous owner’s data is still accessible unless the firmware is fully patched.
Unreliable automation and privacy gaps
The "Large Action Model" promised to learn app workflows without official APIs, but it relies on brittle UI automation that breaks when websites change. Users reported that simple commands often failed or produced wrong results, making the device impractical for daily use. Beyond reliability, the device recorded all private conversations between users and the assistant without consent or notification. Users complained they could not delete this information, meaning anyone who stole or bought a second-hand R1 could access sensitive chat history. Rabbit eventually released a software update to automatically delete user data and added a factory reset option, but the initial lack of transparency damaged trust significantly. The current subscription model adds another layer of risk, charging $30 for three additional vibe-coded tasks or $100 per month for thirty tasks. This pricing structure targets tinkerers, not average consumers, limiting the device’s appeal. Does the convenience of voice-driven coding justify handing over account credentials to a third-party server? I have no answer for that, but the security track record gives me pause.
