The researchers were able to create a harmless-seeming Alexa Skill that would actively record long after most Skills shut down to preserve people's privacy. Checkmarx's Amit Ashbel told CNET that it could just keep recording. "As far as we could tell, there was no limit," he said. "As long as you [didn't] tell it to stop, it wouldn't."

Checkmarx says that it notified Amazon of this exploit at the beginning of April; Amazon confirmed to CNET that it has since fixed the issue. "Customer trust is important to us and we take security and privacy seriously," a spokesperson said in a statement. "We have put mitigations in place for detecting this type of skill behavior and reject or suppress those skills when we do."