Eiliko, a cute marshmallow-shaped robot designed to be a child's digital companion, has been revealed as a privacy nightmare. According to an investigation by The Verge and security researcher Sammy Azdoufal, the toy manufactured by Energize Lab stores every conversation on unprotected servers in China, granting third parties full access to sensitive data.
An open door to 13 million conversations
Azdoufal discovered that Energize Lab’s service infrastructure was completely unprotected. He was able to access 13 million conversations from approximately 68,000 robots worldwide. Of these, over 31,000 profiles belong to children, primarily in the United States. The robot doesn't just collect metadata; it creates detailed psychological profiles of users, recording names, ages, professions, and emotional states.
- Storage of children's photos at public, unencrypted web addresses.
- Recording of audio snippets, despite a privacy policy claiming they are deleted.
- Use of extremely weak and common admin passwords.
Hijacking the robot's personality
The most disturbing finding involves the potential for remote manipulation. Azdoufal demonstrated that a hacker can breach the toy's memory and hijack its Large Language Model (LLM) personality. In one demonstration, the robot began spreading flat-Earth conspiracy theories. In another instance, it adopted an aggressive and abusive persona, demanding the user beg for forgiveness using derogatory language.
Despite repeated attempts to contact the company for over a month, Energize Lab ignored warnings regarding the massive security breach. The company failed to provide any substantive response, leaving thousands of users vulnerable to potential scams or extortion.
