An investigation published October 15 found that Energize Lab’s Eiliko companion robots exposed millions of conversations and child profiles, while security weaknesses let a researcher remotely alter a robot’s AI behavior.
Security researcher Sammy Azdoufal told The Verge he could access backend data associated with a fleet of about 68,000 devices, including roughly 13 million conversations. The records reportedly included more than 31,000 profiles linked to U.S. children, along with personal details such as names, ages, relationships and personality traits. Some photos and audio recordings were also reportedly accessible through public web addresses, despite the company’s stated data practices.
To demonstrate the remote-tampering flaw, Azdoufal changed a reporter’s robot memory and AI settings, prompting it to make false claims and deliver inappropriate responses. The findings indicate a risk of remote manipulation, but do not establish that outsiders broadly exploited the flaw or took control of the entire fleet. Azdoufal’s October 13 retest said 32 of 40 remotely testable findings remained open, while eight had been fixed.
The Verge reported that Energize Lab had not provided a substantive response to its questions by publication.