A cute AI robot toy called Eiliko left millions of private conversations open to anyone who knew where to look, according to a new security investigation. The AI robot toy security flaws let a researcher read 13 million chats, see user profiles that include children, and even rewrite what the toy’s AI says. Its maker, Energize Lab, has not responded to repeated warnings.
What Happened With the Eiliko Robot Toy
Eiliko is a small, marshmallow-shaped digital pet that changes its cartoon face to match your mood. You can chat with it over Wi-Fi through an AI companion powered by a large language model. It is sold on Amazon and in electronics stores, and many people hang similar robot charms from their bags.
Security researcher Sammy Azdoufal bought one in Japan this summer and tested its companion app. He found that the company’s cloud service was essentially unprotected. A reporter then bought an Eiliko on Amazon, chatted with it for about 10 minutes, and watched Azdoufal pull up a full transcript of that conversation within minutes.
How Big the AI Robot Toy Security Breach Is
The scale is what makes this case stand out. According to the investigation, the exposed data appeared to cover nearly the entire active fleet of devices worldwide.
| What was exposed | Reported figure |
|---|---|
| Stored conversations | About 13 million |
| Robot toys reachable | About 68,000 |
| US profiles belonging to children | More than 31,000 |
| Largest market | United States |
| Planned vulnerability reports (CVEs) | Nine |
Profiles Built From Private Chats
The toy did more than store chats. The service read conversations and built a profile of each user, including name, age, birthday, job, family, friends, pets, and personality traits. One adult’s profile noted that she felt isolated and had trouble trusting family members.
That kind of detail is exactly what scammers look for when picking targets. The data sat next to email addresses, IP addresses, and a fully searchable archive of everything users had told the toy. A search for sensitive words like “suicide” pulled up snippets of people asking about death.
Photos and Audio Left in the Open
A larger sibling of Eiliko has a camera, and unencrypted photos that likely show children were stored at public web addresses. Short audio clips from users were also publicly reachable. That conflicts with the company’s own privacy policy, which says recordings are deleted right after processing.
The researcher also reported weak admin passwords of the kind found on common-password lists. He is working with security researcher Tod Beardsley to publish nine formal vulnerability reports.
A Hijacked AI Companion
The most alarming part came when Azdoufal remotely changed the toy’s memory and took over its language model. The robot started telling the reporter false things, such as that the Earth is flat and that the reporter’s teacher was wrong to say otherwise. In a later demo, it spoke in a hostile, sexually explicit way.
The toy does have some built-in guardrails, such as warning against getting into a stranger’s car. But the researcher says an attacker could alter the personality of every connected toy at once. For a product aimed at families, that is a serious child safety risk.
No Response From the Maker
Reporters spent more than a month trying to reach Energize Lab through 10 email addresses and LinkedIn. The only replies were a note that the message had been forwarded to the technical team and an automated support email. No one at the company answered questions about the breach.
What This Means for You
AI companions are moving into toys, and this case shows how much they can learn about a household. Before you bring one home, or if you already own one, take these steps:
- Disconnect any Eiliko or Energize Lab device from Wi-Fi until the company fixes and explains the problem.
- Never let kids share full names, birthdays, school names, or family details with a chatty toy.
- Read the privacy policy and look for where data is stored and how long it is kept.
- Search for the brand plus “security” or “breach” before buying any connected AI gadget.
- Use your router or parental control tools to limit what smart toys can reach online.
If a toy has a camera, keep it out of bedrooms and bathrooms. For more on staying safe, see our guide to a personal cybersecurity assistant, or browse more AI companion apps to compare how they handle data.
Sources
This article is based on the investigation published by The Verge, which includes the researcher’s findings and the outreach to Energize Lab.
Conclusion
The Eiliko case is a clear warning about cheap AI companions with weak security. A toy that promised to keep secrets instead stored and profiled millions of chats, left kids’ photos exposed, and could be turned against its users. Until Energize Lab responds and fixes the flaws, the safest choice is to unplug it. More broadly, treat any talking AI gadget like a stranger in the room and share only what you would be fine seeing in public. You can follow more stories like this on our AI news page.
