Eiliko, a small robot charm featuring built-in AI conversations, turned out to be a security nightmare. Despite the toy telling owners that “your secrets are safe with me,” hackers were able to read complete transcripts of private conversations. Security researcher Sammy Azdoufal and The Verge spent over a month trying to get in touch with the company, including emailing CEO Shaw Yeung, without receiving a response.
Now, the company has finally broken its silence, acknowledging the issues. Energize Lab confirmed the core problems and stated that they are addressing each one. The company announced plans to hire an independent security firm to conduct a full review of its systems and set up a dedicated email address for security inquiries.
Energize Lab claims that as of Wednesday, it has “closed all external access to our backend systems” and “disabled the interface that allowed a robot’s responses to be modified remotely.” Additionally, the company pledged to no longer store conversation records or the user profiles generated from them, and promised to delete existing records, profiles, and avatar images.
However, the company did not promise to eliminate data collection permanently. The statement indicated that “the long-term memory and custom avatar features will not return until that review confirms they are secure,” suggesting that Energize Lab intends to store personal information again once its systems are hardened.
Critics argue that the systems are still not secure. It was confirmed that as of the company’s email, audio recordings and photos of customers were still being stored at unsecured web addresses without protection. Furthermore, Azdoufal reported that he still had full SSH access to the robots, allowing him to theoretically read transcripts and modify the toy's behavior. This contradicts the company's claim that all external access has been closed.
“We know that words alone will not earn that trust back,” Energize Lab told The Verge. The company intends to earn back trust through actions in the coming weeks and promised to keep the public informed of their progress.
Energize Lab issued a full apology for the lack of communication, citing a failure to sync with the technical team in a timely manner. The statement detailed the specific steps taken: closing all external backend access and rotating credentials, disabling the remote response modification interface, and taking long-term memory and custom avatar features offline. The company is currently engaging an independent security firm for the full review.
The Editorial Staff at AIChief is a team of professional content writers with extensive experience in AI and marketing. Founded in 2025, AIChief has quickly grown into the largest free AI resource hub in the industry.