The Consumers’ Association, also known as Which? says “almost anyone” could hack certain connected toys and speak directly to the children playing with them. Which? presented their findings on four specific toys—the Furby Connect, I-Que Intelligent Robot, Toy-fi Teddy, and CloudPets cuddly toy—none of which had secured bluetooth connections. That means anyone in range of the device could connect to it remotely.

A video on their website gave an ominous demonstration of what this could mean in practice:

Their warnings are based on a year of research in conjunction with consumer organizations and security research experts. After presenting their findings, the organization called for “all connected toys with proven security or privacy issues” to be taken off the shelves.

Hasbro (HAS), the manufacturer of Furby Connect, doubted the results of Which?’s investigation, saying the security breaches probably happened under “very specific conditions” that would require “a tremendous amount of engineering.”