Puff-piece wunderkid news cycle fluff. Flagged.
No, no he didn’t ‘hack [the] cyber-security audience’.
What actually happened?
Apparently the following.
The intended demonstration was about all these electronics-as-gimmick toys being unsecure and unsecurable remotely accessible spying and network attack staging devices. So, scan via Bluetooth, connect, emphasize there is no authentication or anything, record sound. That worked just as intended. This is always a useful message to spread, and to remind people to spread further.
What some journalists write down as «hack the audience» was a side effect of the first step — a list of Bluetooth MACs and device nicknames of all «visible» Bluetooth devices in the room went to the large screen while the speaker was selecting the hi-tech teddy bear from the list. I guess some people who had forgotten they have their Bluetooth devices in the visible mode were reminded of privacy implications.
And then some writer asked for a non-technical explanation of all that, and the article is an attempt to retell the explanation.