Alexa has been accused of mass surveillance and this is not surprise. All of these tools and platforms from large tech giants all end up collecting and sharing your private data. Part of this is their legal obligation in the US. If they are told to collect and share they have to and if they are told to spy on you via exploits, backdoor access or even this “record and send flaw”they are doing their job.
Alexa itself was asked by a user on Youtube if it works with the CIA and it wouldn’t answer and turned itself off. Now this time a user reports a personal conversion was shared with a random phone contact with no permission or notification to the user. Is it a bug or is it by design? At any rate we have to assume that our devices are capable of spying on us and disclose our conversations and personal data.