All you need to do is pair any device with it via Bluetooth (no passcode) and you can play any mp3 file you like.
Hence the sweary fun.
In a few steps, you can also turn Cayla into a listening device, making surveillance of the children you bought it for incredibly simple.
Pen Tech Partners says of the toys:
Parents: don’t buy these toys.
If you have one already, I suggest returning it to the retailer.
If you want to keep it, only allow the toy to be used under close parental supervision and ensure it is switched off when not in use.
They also urge manufacturers to "take even the most basic steps towards securing smart toys".
Cayla is already banned in Germany.
Vivid Toy Group, told the Mirror in 2015 about My Friend Cayla:
The My Friend Cayla doll is designed for creative play and has numerous levels of security in place to ensure that children are safe when using the doll and the associated app.
There is a list of banned words within the app - which includes swear words - which parents can add to manually if they wish.
In addition to this, there is also a list of subjects (such as religion, politics and sexuality) where Cayla will encourage the child to go and ask a parent or teacher. We feel this is appropriate for the target age group and we trust that parents would prefer to have conversations with their own child around subjects such as these.
The hacking example highlighted here is an isolated case which has been carried out on a specific, individual device by a specialist team using developer software.
That said, we would like to thank Pen Test Partners for bringing this to our attention - customer security is our number one priority and we take it very seriously.
We are able to adapt and upgrade the app on an ongoing basis and will now take this new information on board.