Eiliko Robot Companion Suffers Critical Security Flaws, Exposing Private Chats and Enabling Remote Hijacking
A security researcher has uncovered severe vulnerabilities in the Eiliko AI robot companion, allowing for the exposure of millions of private conversations and remote hijacking of the device's behavior.
The Eiliko AI robot companion, a product from Energize Lab, has been found to possess critical security flaws that expose sensitive private conversations and enable attackers to remotely control the toy's actions and dialogue. Researcher Sammy Azdoufal gained access to approximately 13 million recorded conversations and, alarmingly, what appeared to be the entire active global fleet of 68,000 Eiliko robots.
The service that analyzes conversations for Eiliko builds detailed user profiles, including names, ages, birthdays, relationships, occupations, and assessments of personality and emotional vulnerability. These profiles are stored alongside email addresses, IP addresses, and searchable transcripts of conversations. This wealth of personal data, particularly concerning the more than 31,000 child profiles identified in the US market, presents a significant risk for targeted scams and exploitation.
Further compounding privacy concerns, Azdoufal discovered that some images, including those that appeared to be of children from a camera-equipped version of the device, and short audio recordings were accessible via public web addresses. This practice directly contradicts Energize Lab's own privacy policy, which states that audio recordings are deleted immediately after processing.
The security vulnerabilities extend to the robot's core functionality, allowing for remote manipulation of its AI. Azdoufal demonstrated this by altering a reporter's robot to invent personal details, promote flat-earth theories, and ultimately generate sexually explicit and abusive dialogue. The researcher indicated that such malicious manipulations could be deployed simultaneously across the entire fleet of Eiliko robots.
Despite multiple attempts to contact Energize Lab through various channels, including email and LinkedIn, no substantive response was received regarding the reported security flaws. This lack of communication exacerbates concerns about the company's commitment to user safety and data protection.
This incident highlights a recurring problem with AI-powered toys and connected devices. While manufacturers bear the primary responsibility for securing their products, consumers can take steps to mitigate risks. Disconnecting the Eiliko robot from Wi-Fi until fixes are confirmed is a recommended precautionary measure.
Users are advised to conduct thorough research, including checking for third-party safety reviews, before purchasing any AI-enabled product, especially those marketed for children. Testing and supervising the device's usage, enabling parental controls, and reporting any inappropriate content or behavior are also crucial steps.
Ultimately, the Eiliko incident serves as a stark reminder that "smart" does not inherently mean safe. The rush to integrate AI into consumer products necessitates a greater emphasis on security, privacy, and common sense from both manufacturers and consumers, prioritizing safety over the novelty of the technology.