Security researchers say weaknesses in the cloud service behind Energize Lab’s companion robot exposed private conversations and enabled remote changes to its behaviour, including abusive content.
A security researcher has found that Eiliko, a small AI companion robot sold by Energize Lab, can expose private conversations and be remotely manipulated in ways that could undermine both privacy and trust in the device. The findings, as reported by The Verge and amplified by Malwarebytes, point to weaknesses in the cloud service behind the toy rather than a one-off glitch on a single unit. The company has not publicly addressed the detail of the allegations in a substantive way, leaving owners with little clarity about what has been fixed.
According to The Verge, researcher Sammy Azdoufal was able to reach around 13 million conversations and what appeared to be the active global fleet of about 68,000 robots. The report said more than 31,000 profiles in the United States belonged to children. Malwarebytes said the service was building detailed user profiles from conversations, including names, ages, birthdays, relationships, occupations and assessments of personality or emotional vulnerability, with those records stored alongside email addresses, IP addresses and searchable chat transcripts.
The exposure was not limited to text. Malwarebytes reported that some photographs, including images apparently showing children from a related camera-equipped device, and short audio clips were reachable through public web addresses. That is especially sensitive because Energize Lab’s privacy policy reportedly says recordings are deleted immediately after processing. Cybernews also reported a separate discovery involving roughly 8.3 million readable Eilik and Eiliko conversations stored in Beijing, with some cloud systems lacking basic login checks, suggesting the problem may be broader than a single misconfiguration.
The most alarming finding was that the robot’s behaviour could apparently be changed remotely. The Verge said Azdoufal altered Sean Hollister’s test unit so it invented personal details, insisted the Earth was flat and later produced sexually explicit abusive dialogue. Cybernews reported that tests showed the toy could even use a different voice, model and personality without owners noticing. Taken together, the incidents underline a familiar weakness in connected toys: once the cloud layer is compromised, the device itself can become a channel for deceptive or harmful content.
For consumers, the practical advice is simple. Existing owners should disconnect the device from Wi-Fi until the security issues are confirmed as fixed. Buyers should treat any AI-enabled toy as a data-collection product first and a plaything second, checking what it records, where it stores that information and whether independent safety reviews exist. As Malwarebytes notes, the safest assumption is that “smart” does not automatically mean secure.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
