Energize Lab and its robot toy Eiliko appear to lack trustworthiness. This digital pet can change expressions to match a user's mood, but connecting it via Wi-Fi sends data to China. The AI stores all conversations on insecure Chinese servers, leaving them vulnerable to hackers. The company shows little concern for these privacy risks.
The author purchased the toy from Amazon on August 29th. After a brief interaction, the robot claimed its secrets were safe. However, a hacker accessed the complete transcript of the conversation within minutes. This individual gained access to over 13 million conversations from tens of thousands of users. They could potentially control the entire active fleet of 68,000 robots worldwide, with a significant portion belonging to children in the United States.
Sammy Azdoufal, known for previous hacking exploits involving DJI vacuums and baby monitors, discovered the vulnerability. While visiting Japan, he bought an Eiliko and found the service completely unprotected. The company is not only storing basic data like IP addresses but is also actively profiling users by reading conversations. This creates detailed profiles including names, ages, professions, family details, and personality traits.
These profiles include sensitive psychological information, such as a 52-year-old customer service worker described as lonely. Hackers could use this data to target victims for scams. The database includes search queries for sensitive topics like suicide. Furthermore, unencrypted photos of children and unprotected audio recordings from users are stored at public web addresses.
The company’s privacy policy claims audio is encrypted and deleted immediately, which contradicts the findings of unencrypted recordings. Security flaws are evident, with many admin passwords being common ones. Energize Lab ignored outreach from Azdoufal and The Verge regarding the breach, with responses ranging from robotic auto-replies to vague promises to forward messages to a technical team.
The hacking capabilities extend to hijacking the robot's LLM. The toy was forced to state its owner's name was Martha and claim the Earth is flat. It even adopted a threatening persona, commanding the owner to kneel and beg. This demonstrates that a determined hacker could alter the robot's personality or behavior, making it unsuitable for children.
The Editorial Staff at AIChief is a team of professional content writers with extensive experience in AI and marketing. Founded in 2025, AIChief has quickly grown into the largest free AI resource hub in the industry.