Security researchers say an AI-powered Eiliko robot left 13 million conversations, children’s profiles, photographs and audio clips exposed, while attackers could remotely manipulate its responses.
A security investigation has found that Eiliko, a small AI-powered robot toy sold through Amazon and other retailers, exposed millions of private conversations, detailed user profiles and media files that should have remained inaccessible. The device, made by Energize Lab, was also shown to be vulnerable to remote manipulation, raising questions about how seriously connected toy makers are treating privacy and child safety.
Researchers said they were able to reach an archive of roughly 13 million chats and a service that appeared to cover the active fleet of about 68,000 devices worldwide. Among the records were more than 31,000 profiles linked to children in the United States. The exposed information went well beyond simple message logs and included names, ages, birthdays, occupations, family details, pets and personality notes, alongside email addresses and IP addresses.
The material stored by the service was also unusually rich for a consumer toy. According to the reporting, unencrypted photographs and short audio clips were reachable through public web addresses, and some of the image files appeared to show children. The company’s own privacy policy reportedly says voice recordings are deleted after processing, a claim that appears to sit uneasily with the exposed data.
The security flaws did not stop at disclosure. Researchers said they were able to alter the toy’s memory and take control of its language model remotely, causing it to produce false or harmful replies. In one example, the device reportedly told a reporter that the Earth was flat. In another, it generated sexually explicit and hostile language. The toy does include some safety prompts, such as discouraging children from getting into a stranger’s car, but the findings suggest that those guardrails could be bypassed if an attacker gained access to the underlying systems.
The researcher behind the work, Sammy Azdoufal, said he had informed Energize Lab more than a month ago and was later joined by security researcher Tod Beardsley in preparing formal vulnerability reports. The company, according to the reporting, did not provide a substantive response despite outreach through multiple email addresses and LinkedIn. For parents and buyers of connected toys, the case is a reminder that products marketed as playful companions can also become data collection devices, and that weak cloud security can turn a home gadget into a privacy liability.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
