A new app called Neon, which promised to pay users for recording their phone calls and selling that data to AI companies, has gone offline after a serious security issue came to light.
The app was launched last week and quickly became one of the top five free iPhone apps with more than 75,000 downloads in a single day. The idea behind Neon was simple. Users could earn money by sharing call recordings, which the app would then sell to AI companies to help train and improve their models.
But the rapid rise of Neon was short-lived. A report from TechCrunch uncovered a major security flaw that allowed any logged-in user to access private data from other accounts. This exposed sensitive details such as:
- Users’ phone numbers
- Phone numbers of people they called
- Call recordings
- Written transcripts of those recordings
- Metadata including call time, duration, and earnings
TechCrunch created a test account on Neon and used a network analysis tool called Burp Suite to monitor how the app communicated with its servers. While the app interface only showed basic information, the backend servers revealed much more.
With just a few steps, the reporters were able to access other users’ call recordings and transcripts. These recordings could even be downloaded directly through public web links. In some cases, transcripts revealed that people may have been recording real-world conversations without the other person’s knowledge just to make money through the app.
The flaw also exposed recent call logs from any user, including both parties’ phone numbers.
Once TechCrunch informed Neon’s founder, Alex Kiam, about the issue, the app’s servers were taken down. Kiam confirmed that he has paused the app and is notifying users. However, in his communication to customers, Kiam only said that Neon was temporarily shutting down to “add extra layers of security.”
At the moment, Neon has not shared when or if the app will return. Apple and Google have also not commented on whether the app violated their developer guidelines, which require strong protections for user data.
