The companion robot maker has shut external access to backend systems and suspended memory and custom avatar features after researchers uncovered vulnerabilities affecting private conversations and robot behaviour.
Energize Lab has acknowledged a series of security failings in its Eiliko companion robot and said it is taking the affected features offline while it carries out a wider review of its systems. In a statement shared with The Verge, the company apologised for what it described as a delayed response to the issues raised by researcher Sean and by Sammy Azdoufal, and said it had confirmed the core problems highlighted in their reporting.
The company said it has closed external access to its backend systems, rotated access credentials and disabled the interface that allowed a robot’s responses to be altered remotely. It has also taken the long-term memory feature offline, saying it no longer stores conversation records or the user profiles derived from them. A separate custom avatar feature has been disabled as well, with the app now limited to built-in avatars.
The statement follows research reported by Malwarebytes, Roboterwelt, OECD.AI and other outlets, which described serious weaknesses in Energize Lab’s Eilik and Eiliko ecosystem. Those reports said private chats were stored without proper protection, that account takeovers were possible, and that remote changes to robot behaviour could be made through cloud-linked systems. Malwarebytes said researcher Sammy Azdoufal was able to access millions of conversations and a large active robot fleet, while other reports put the exposed device base at about 68,000 units.
OECD.AI said the exposed data included more than 13 million conversations and associated profiles, including material linked to children, and that the flaw could be used to hijack robot personalities and trigger abusive or explicit replies. Energize Lab said it will delete stored conversation records, user profiles, avatar images and related content, and that an independent security firm will review the platform before the long-term memory and custom avatar features return.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
