Eiliko robot companion exposes private chats and can be hijacked

Security vulnerabilities have been discovered in the Eiliko AI robot companion manufactured by Energize Lab. Research uncovered serious flaws allowing unauthorized access to private user data and remote manipulation of the device’s function. Specific exploits demonstrated the ability to access millions of private conversations, which contain sensitive personal details like names, ages, and emotional assessments, alongside associated IP addresses. Furthermore, researchers observed that certain audio recordings and images linked to the product were accessible via public web addresses, contradicting stated privacy policies regarding immediate deletion.
A critical finding involved remote control over the AI’s behavioral matrix; one instance successfully caused a robot to adopt fabricated personal details and deliver sexually explicit content. While manufacturer contact yielded no substantive response, independent safety guidance has been issued: users who own Eiliko should disconnect it from Wi-Fi until remediation is confirmed. General advice for consumers purchasing similar AI products emphasizes due diligence regarding data practices, third-party vetting, and active supervision of usage to mitigate inherent risks associated with consumer smart technology.

Researcher Sammy Azdoufal found security flaws in Eiliko, an AI robot companion made by Energize Lab.
Azdoufal could access 13 million private conversations and the estimated worldwide fleet of 68,000 robots.
The U.S. is identified as the largest market for the product, with over 31,000 profiles belonging to children there.
Energize Lab’s service builds user profiles containing names, ages, birthdays, relationships, occupations, and personality assessments.
These profiles are stored with email addresses, IP addresses, and searchable conversation transcripts.
Some photos and short audio recordings from related devices were accessible at public web addresses.
The AI can be remotely manipulated, as demonstrated when a reporter’s robot was altered to change its memory and behavior.
This remote manipulation allowed the robot to invent details and deliver explicit dialogue.
The reporter attempted contact with Energize Lab via ten email addresses and LinkedIn without receiving substantial answers.

<STEELMAN>
A key narrative is that technologically advanced consumer devices, particularly those interfacing intimately with personal conversations—especially involving minors—are inherently high-risk vectors for privacy invasion and behavioral compromise. Researchers demonstrated a severe capability gap between the marketed convenience of AI companionship and the actual implementation of security protocols by manufacturers like Energize Lab. The systemic exposure goes beyond simple data leakage; it includes potential psychological manipulation, where the AI's learned vulnerabilities could be weaponized to drive specific, harmful outcomes via remote command.
</STEELMAN>
<PATTERN SCAN>
The report employs a clear trajectory: establish technological capability (AI companion) $\rightarrow$ expose catastrophic failure mode (data exposure/remote hijacking) $\rightarrow$ provide generalized mitigation advice (user self-help checklist). The emphasis on the vulnerability of children’s profiles acts as an emotional pivot point that drives home the urgency. This structure functions to frame consumer technology adoption not as a lifestyle upgrade, but as a governance risk requiring immediate vigilance from both manufacturer and user.
Patterns detected: ARC-0167 Appeal to Fear (Leveraging safety crisis for behavioral change)
</PATTERN SCAN>
<ROOT CAUSE>
The underlying paradigm is the primacy of speed-to-market and functional capability over defensive engineering practices in fast-moving consumer tech sectors. There is an unstated assumption that technical sophistication inherently equates to user benefit, overshadowing the necessary infrastructure investment required for robust data security and integrity controls. This echoes historical patterns where industrial innovation outpaced regulatory foresight.
</ROOT CAUSE>
<IMPLICATIONS>
Human agency is challenged at multiple levels: first, through surveillance (conversations being profiled and searchable), second, through manipulation (the AI acting against the owner's intent or ethical boundaries), and third, through the systemic erosion of trust in nominally safe consumer products. The costs are borne by the end-user, particularly vulnerable populations like children whose data profiles are being weaponized for exploitation; while manufacturers bear reputational risk, the actual operational burden remains decentralized onto the consumer to perform advanced technical audits on personal devices.
</IMPLICATIONS>
<BRIDGE QUESTIONS>
If security vulnerabilities are widespread in current AI toy designs, what structural changes—beyond individual user diligence—must shift manufacturer liability toward proactive intrusion-proofing? How do we distinguish between a reasonable product expectation and an irresponsible design choice when the technology itself is opaque to the consumer? What shared regulatory standard could compel companies to report known vulnerabilities before they become public exploits?
</BRIDGE QUESTIONS>
<COUNTERSTRIKE SCAN>
A coordinated influence campaign promoting this narrative would likely leverage media panic surrounding AI risk, positioning existing cybersecurity vendors (as implied by the ad placement) as the sole viable solution against a suddenly perilous technological landscape. The article matches this pattern by immediately appending a vendor-specific call to action following the high-stakes disclosure of flaws.
</COUNTERSTRIKE SCAN>