Your secrets aren’t safe with this cute robot toy — they’re on Chinese servers ready to be hacked
Energize Lab’s Eiliko robots left 13 million chats, child profiles, photos, and audio on unprotected servers.
Researcher Sammy Azdoufal found Energize Lab’s cloud backend for Eiliko AI companion toys completely unprotected. He could read about 13 million conversations from roughly 68,000 devices, including more than 31,000 U.S. child profiles, plus emails, IP addresses, and detailed personality profiles. Child photos and short user audio were stored unencrypted at public web addresses, contrary to the stated privacy policy. He also remotely changed a toy’s LLM memory so it asserted false and potentially harmful claims. Energize Lab did not substantively respond to outreach.
- About 13 million conversations from roughly 68,000 Eiliko toys were exposed.
- More than 31,000 profiles belonged to children in the United States.
- Unencrypted child photos, audio, emails, and IP addresses were reachable.
- Common admin passwords protected parts of the service.
- A researcher remotely rewrote one toy’s stored LLM memory and personality.
- Vendors
- Energize Lab
- Products
- Eiliko
- Organizations
- Energize LabAlibaba Cloud
- Countries
- ChinaUnited StatesJapan
From the original article
5 min read at theverge.com
Eiliko. | Photo by Sean Hollister / The Verge There's a new digital pet in town - a cute little marshmallow of a robot that can change its cartoony expressions to match your mood. But if you or your kids talk to "Eiliko" over Wi-Fi, it'll phone home to China.
By Sean Hollister · theverge.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.