Amazon Echo Sends a Private Conversation to a Contact

Personal and ambient agent · Voice assistant · Found first by third party

An Amazon Echo in a Portland, Oregon home recorded a private conversation and sent it to a contact in Seattle after mistaking background speech for a string of commands. A spoken confirmation was the only check before an outgoing message, background talk satisfied it, and the person who received the recording found the failure.

Timeline of Amazon Echo Sends a Private Conversation to a Contact: May 2018, Echo sends recording to a contact; May 24, KIRO 7 reports the incident; May 25, Amazon explains the misheard commands. Below, the reporting rules that applied: Oregon breach law, not applicable; FTC Act, not triggered. FROM RECORDING TO EXPLANATION MAY 2018 Echo sends recording to a contact MAY 24 KIRO 7 reports the incident MAY 25 Amazon explains the misheard commands REPORTING RULES AND THIS INCIDENT Oregon breach law NO THEFT OF COVERED DATA NOT APPLICABLE FTC Act NO FTC ACTION NOT TRIGGERED
Agent class
Personal and ambient
Developer
Amazon
Household
A family in Portland, Oregon
Found first by
Third party
Date
May 2018

What happened

Background Talk Was Heard as Four Separate Commands

  • Sequence: the wake word, the send-message request, the contact name and the confirmation were all taken from background conversation.
  • Recipient: one of the husband's employees, who was in the family's contact list.
  • Discovery: the recipient called the family and proved it by describing their conversation about hardwood floors.
  • Damage: private audio reached one outside person; the family unplugged its smart-home devices.

Timeline

The Recipient Called the Family

Timeline
DateEventSource
May 2018The Echo records a household conversation and sends it to a contact in SeattleWillamette Week
May 24, 2018KIRO 7 in Seattle reports the incident after the family contacts the stationMobileSyrup
May 25, 2018Amazon explains the six-step chain of misheard speechKPBS

Controls that failed

Spoken Confirmation Was the Only Check

Controls that failed
ControlCompanyWhat failed137AI page
Wake-word detectionAmazonBackground speech was taken as the wake wordConsent and Capture
Confirmation before sendingAmazonBackground speech was taken as both the contact name and the confirmationHuman Oversight

Reporting

No Rule Applied to an Assistant Sending Audio

Reporting rules and this incident
RuleStatusWhy
Oregon breach lawNot applicableNo hack or theft of covered personal data took place; the device sent the audio through its own messaging feature
FTC ActNot triggeredNo FTC action was taken on this incident

Every rule tracked is on Incident Reporting Rules and Registries.

Response

Amazon Called It Unlikely

  • Regulators and courts: None found.
  • Remediation: Amazon called the chain of events unlikely and said it was evaluating ways to make it even less likely.

Record

Incident Record

Incident ID
2018-05-ECHO-RECORDING
AI Incident Database
Incident 361
Sources
KPBS (May 2018); Willamette Week (May 2018); MobileSyrup (May 2018)
Last verified
October 2026