The short version
- A security researcher found that Eiliko robot toys send private voice data and detailed user profiles to unprotected Chinese servers.
- The breach exposes sensitive information from tens of thousands of users, including children, with no encryption on stored audio or images.
- The manufacturer has failed to address the vulnerabilities despite multiple attempts by journalists and researchers to report the issue.
A popular AI-powered robot toy known as Eiliko is transmitting private conversations and detailed personal profiles to servers in China that lack basic security protections. The devices, which resemble small marshmallows with expressive digital faces, are designed to act as companions for users of all ages. However, an investigation has revealed that the company behind the product, Energize Lab, stores sensitive user data in a manner that leaves it vulnerable to unauthorized access and potential exploitation by malicious actors.
The vulnerability was identified by Sammy Azdoufal, a security researcher known for uncovering flaws in consumer electronics. After purchasing an Eiliko unit in Japan, he tested the associated application and discovered that the service infrastructure was entirely unprotected. This lack of security allowed him to access a database containing millions of conversations from tens of thousands of users worldwide. The data included not only voice transcripts but also deeply personal details such as names, ages, professions, family structures, and psychological profiles generated by the AI.
The scope of the exposure is significant. Data indicates that the United States represents the largest market for these devices, with over 31,000 user profiles belonging to children. The active global fleet consists of approximately 68,000 units. Azdoufal was able to view complete transcripts of interactions, including sensitive topics such as mental health struggles and personal insecurities. For instance, the system logged detailed character assessments for users, noting traits like empathy or isolation, which could be valuable to scammers seeking to target vulnerable individuals.
Beyond text-based data, the security breach extends to audio recordings and images. Energize Lab’s privacy policy claims that voice recordings are encrypted during transmission and deleted immediately after processing. In reality, short audio clips from users were found stored at public web addresses without encryption. These recordings included voices of adults, children, and even babies. Additionally, some models in the Eiliko family include cameras, and images captured by these devices were also stored insecurely, accessible to anyone with the correct URL.
The technical negligence appears systemic. Many administrative passwords for the company’s systems were found to be among the most commonly used and easily guessed passwords. This suggests a broader lack of security hygiene within Energize Lab’s operations. The storage of full-text searchable databases of private conversations alongside IP addresses and email accounts creates a comprehensive dossier on each user, far exceeding what is necessary for the device’s basic functionality.
Attempts to alert the company about these critical flaws have been largely unsuccessful. Journalists and researchers spent over a month trying to reach Energize Lab through various channels, including email addresses listed for public relations, technical support, and business development. They also searched for employees on professional networking sites. While two employees eventually responded on LinkedIn, they did not engage substantively with the concerns raised about the security breach. One response indicated that messages were forwarded, but no further action or acknowledgment of the severity of the issue was provided.
The implications for consumer privacy are severe. Users who believed their interactions with the robot were private have had their most intimate conversations exposed. The data includes information that could be used for identity theft, social engineering attacks, or other forms of harassment. The fact that this data is hosted on servers in China adds another layer of complexity regarding jurisdiction and data protection standards, although the primary issue remains the fundamental lack of encryption and access controls.
This incident highlights the growing risks associated with Internet of Things devices, particularly those marketed to children. As more homes adopt AI companions, the expectation of privacy must be matched by robust security measures. The failure of Energize Lab to protect user data serves as a cautionary tale for both consumers and manufacturers. It underscores the need for stricter oversight and accountability in the development and deployment of connected devices that collect sensitive personal information.
Consumers who own Eiliko devices are advised to exercise extreme caution. Disabling Wi-Fi connectivity or returning the product may be necessary steps to prevent further data leakage. Regulatory bodies may need to investigate whether Energize Lab has violated consumer protection laws regarding data privacy and security. Until the company demonstrates a commitment to fixing these vulnerabilities, the safety of user data remains in question.
The broader tech industry must take note of this failure. As AI becomes more integrated into daily life, the responsibility to secure user data falls squarely on developers. Cutting corners on security not only endangers users but also erodes trust in emerging technologies. This case illustrates that even cute, harmless-looking gadgets can pose serious threats if their underlying infrastructure is neglected.
Sources behind this briefing
Go to the original reporting
- The Verge↗Your secrets aren’t safe with this cute robot toy — they’re on Chinese servers ready to be hacked
