Testing showed a nearby attacker could connect to the glasses via Bluetooth and view stored images without any password.

Independent testing carried out for the ABC by cybersecurity firms NSB Cyber and Abstract Shield confirmed that the glasses can be accessed by a nearby attacker using only Bluetooth, with no password required. Lead researcher David Crees said, “Another person with the same app can log into the glasses without a password.”

The testing examined two models: a $60 pair bought from the online retailer Temu and a $110 pair purchased from Sydney‑based importer BDI Technology through the Big W Marketplace. Both devices use the HeyCyan phone app.

Legal experts said the vulnerabilities are likely to breach the Australian Privacy Act, consumer law and the new Cyber Security Act, because the devices fail to protect personal data such as images, video and AI‑assistant inputs.

The investigation also found that user data – including spoken commands, typed queries and captured images – was first sent to a server in Shenzhen, China, and in some cases forwarded to a server in the United States, without clear notice to users.

Following the findings, at least one Australian retailer, BDI Technology, announced it would stop selling the glasses. The company’s decision reflects growing concern over the privacy risks associated with the products.