The short version
- Energize Lab stated it has hired an independent security firm and disabled features that stored conversation records and custom avatars.
- Security researcher Sammy Azdoufal confirmed that audio recordings and photos remain accessible via unsecured public links despite the company's claims.
- The maker apologized for a month of silence following initial reporting but admitted its previous assurances about closing external access were inaccurate.
Energize Lab, the developer behind Eiliko, a small AI-powered robot charm designed to hang on bags and engage in conversation, has issued a statement addressing severe security flaws exposed by recent reporting. The company acknowledged that hackers could previously read complete transcripts of user interactions and access private data without authorization. In response to these findings, Energize Lab claims it has taken immediate steps to mitigate the risks, including hiring an independent security firm to conduct a comprehensive review of its infrastructure.
The announcement comes after more than a month of silence from the company’s leadership, including CEO Shaw Yeung, who did not respond to inquiries during that period. The unsigned statement, sent from a generic email address, apologized for the delay in communication and admitted that internal coordination failures prevented a timely technical response. Energize Lab stated it has established a dedicated security inbox to handle future concerns and rotate access credentials across its backend systems.
According to the company’s latest update, it has disabled the interface that allowed remote modification of robot responses and taken offline both the long-term memory feature and the custom avatar functionality. The firm asserts that it no longer stores conversation records or user profiles generated from those interactions. Additionally, Energize Lab pledged to delete existing stored data, including audio recordings, user profiles, and avatar images, as part of its remediation efforts.
However, independent verification suggests that the company’s claims of having secured its systems are premature. Security researcher Sammy Azdoufal, who collaborated with The Verge on the initial investigation, confirmed that vulnerabilities persist despite the official statement. As of the time of the company’s announcement, audio recordings and photos of customers remained accessible through unsecured public web addresses. These files lacked any form of protection, meaning anyone with the correct link could view an owner’s face or listen to private conversations.
Azdoufal further reported that he retains full SSH access to the robots, allowing him to theoretically read transcripts and alter the toy’s behavior at will. This ongoing access contradicts Energize Lab’s assertion that it has closed all external access to its backend systems. The discrepancy highlights a significant gap between the company’s public assurances and the actual state of its digital infrastructure, raising questions about the effectiveness of its immediate remediation steps.
The security issues are particularly concerning given the product’s design and marketing. Eiliko is marketed as a companion device that builds trust through personalized interactions, with the company previously assuring users that their secrets were safe. The ability for third parties to access complete conversation logs and modify robot responses undermines this promise of privacy. The exposure of personal data, including facial images and voice recordings, represents a serious breach of user confidence in a consumer technology product.
Energize Lab indicated that features involving long-term memory and custom avatars will not return until the independent security review confirms they are secure. This suggests the company intends to resume some form of data collection once it believes its systems have been adequately hardened. The statement emphasized that rebuilding trust requires action rather than words, promising to keep users informed as progress is made over the coming weeks.
The incident underscores broader challenges in securing consumer IoT devices and AI-driven products. As these technologies become more integrated into daily life, the potential for data breaches grows alongside the intimacy of the data collected. Energize Lab’s failure to respond promptly to initial reports and its subsequent inaccurate claims about system security highlight the need for rigorous oversight and transparency in the development and maintenance of such devices.
Users who have purchased Eiliko robots are advised to remain cautious regarding the privacy of their interactions with the device. While the company has disabled certain features, the persistence of unsecured data access points means that past exposures may not be fully contained. The outcome of the independent security review will be critical in determining whether Energize Lab can effectively protect user data and restore confidence in its products.
The situation remains fluid as the independent firm begins its assessment. Until a verified report is released, it is unclear how extensive the breach was or whether other vulnerabilities exist within the ecosystem. The company’s commitment to deleting stored data and improving security protocols will be tested by the findings of this external audit and the subsequent actions taken to address any remaining issues.
Sources behind this briefing
Go to the original reporting
- The Verge↗Eiliko maker says it’s hiring an ‘independent security firm’ after Verge report on its insecure robots
