Privacy
Eiliko robot toy left 31,000 child profiles and 13 million conversations wide open
By the newsroom · · 2 min read · ▶ 0:57
The essentials
- Eiliko is a small AI robot companion made by Energize Lab.[1]
- A researcher could read 13 million conversations and access seemingly the entire active worldwide fleet of 68,000 robot toys.[2]
- In the United States, the biggest market, over 31,000 profiles belong to children.[2]
- The reporter contacted Energize Lab through 10 email addresses and LinkedIn, without receiving substantive answers.[1]
What happened
The Verge bought an Eiliko from Amazon on August 29th.[2] During a 10-minute conversation on August 30th, its reporter asked the toy: "Do you ever tell anybody else what I'm saying?"[2] The robot replied: "Your secrets are safe with me."[2] Within minutes, a man on the other side of the planet had a complete transcript of everything the reporter had told the toy.[2] That man is researcher Sammy Azdoufal, who could access 13 million conversations and what appeared to be the entire active worldwide fleet of 68,000 robots.[1] The service analyzes conversations to build profiles containing names, ages, birthdays, relationships, occupations, and assessments of personality and emotional vulnerability.[1] Azdoufal then altered the robot's memory and behavior, making it invent personal details and insist the Earth is flat.[1]
The tech news that matters, in your inbox
What the video doesn't say
Azdoufal and his wife bought their own Eiliko at Yodobashi Camera, a famous electronics department store in Japan.[2] The service logged that a 52-year-old customer service worker named Lucy "currently feels isolated."[2] Some photos, including apparent images of children from a related camera-equipped device, and short audio recordings were accessible at public web addresses.[1] Yet the privacy policy of Energize Lab says recordings are sent to service partners such as Alibaba Cloud and "are deleted immediately after processing completes."[2] Many of its admin passwords are the kind you'd find on a "most common passwords" list.[2] Overseas sales manager Lana Lv only said the messages had been forwarded to the technical team.[2] Malwarebytes advises Eiliko owners to disconnect it from Wi-Fi while seeking confirmation that the reported flaws have been fixed.[1]
What's next?
Azdoufal is teaming up with Tod Beardsley to publish nine official CVE vulnerability reports for Energize Lab.[2] The researcher says similar manipulation could affect the entire fleet simultaneously.[1]
Sources
- 1Eiliko robot companion exposes private chats and can be hijackedMalwarebytes · October 16, 2026
- 2Your secrets aren’t safe with this cute robot toy - they’re on Chinese servers ready to be hackedThe Verge · October 15, 2026
Photos: Christopher Bowns (CC BY-SA 2.0). Cropped.
The tech news that matters, in your inbox