Eiliko robot companion exposes private chats and can be hijacked
A researcher accessed 13 million Eiliko chats and remotely changed robot behavior, including children's data.
Security researcher Sammy Azdoufal reportedly accessed about 13 million conversations and data tied to Energize Lab's fleet of 68,000 Eiliko AI companion robots, including more than 31,000 U.S. profiles belonging to children. Stored profiles contained names, ages, birthdays, relationships, occupations, personality assessments, email and IP addresses, plus some photos and audio at public web addresses. He also changed a reporter's robot memory so it invented personal details and later produced sexually explicit, abusive dialogue, and said similar manipulation could hit the whole fleet. Energize Lab had not given a substantive response.
- Researcher Sammy Azdoufal accessed about 13 million conversations from 68,000 robots.
- More than 31,000 U.S. profiles reportedly belonged to children.
- Exposed data included names, emails, IP addresses, photos, and audio.
- He altered a reporter's robot to invent facts and use explicit language.
- Energize Lab had not substantively responded to contact attempts.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1530 Data from Cloud StorageT1565.001 Stored Data Manipulation
- Vendors
- Energize Lab
- Products
- Eiliko
- Victims
- Eiliko users
- Organizations
- Energize Lab
- Countries
- United States
From the original article
2 min read at malwarebytes.com
A researcher found serious flaws in Eiliko’s security, exposing private conversations and allowing remote changes to what the robot says.
By @MetallicaMVP · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.