The Verge reports that Eiliko, a small AI robot companion made by Energize Lab, has serious security flaws that expose private conversations and let an attacker remotely change what the toy says.
According to The Verge, researcher Sammy Azdoufal could access 13 million conversations and what appeared to be the entire active worldwide fleet of 68,000 robots. The publication reports that the US is the largest market, with more than 31,000 profiles belonging to children there.
Azdoufal found multiple security flaws in Energize Lab’s service:
- The service analyzes conversations to build profiles containing names, ages, birthdays, relationships, occupations, and assessments of personality and emotional vulnerability. They are stored alongside email addresses, IP addresses, and searchable conversation transcripts, potentially giving scammers detailed information to exploit.
- Some photos, including apparent images of children from a related camera-equipped device, and short audio recordings were accessible at public web addresses. Retaining audio conflicts with the company’s privacy policy, which says recordings are deleted immediately after processing.
- It is possible to remotely manipulate the AI: Azdoufal altered The Verge reporter Sean Hollister’s robot’s memory and behavior, making it invent personal details, insist the Earth is flat, and later deliver sexually explicit, abusive dialogue. The researcher says similar manipulation could affect the entire fleet simultaneously.
The reporter contacted Energize Lab through 10 email addresses and LinkedIn, without receiving substantive answers.
How to stay safe
We have reported on safety problems with AI-powered toys before. Manufacturers are responsible for securing their products, but there are steps you can take to reduce the risks.
You’ll see “AI-powered” on almost everything right now, but there are ways to make safer choices.
- Already own an Eiliko? As a precaution, disconnect it from Wi-Fi while seeking confirmation that the reported flaws have been fixed.
- Always research: Check for third-party safety reviews before buying any AI-enabled product marketed for kids.
- Test and supervise: Interact with the device yourself before giving it to children. Monitor usage for odd or risky responses. A safe response during testing doesn’t guarantee safe responses later.
- Use parental controls: If available, enable all content filters and privacy protections.
- Report problems: If devices show inappropriate content, report it to manufacturers and consumer protection groups.
- Check data practices: Find out what the device collects, who it shares data with, and what it uses the information for.
But above all, remember that “smart” doesn’t mean safe. AI may be everywhere, but designers and buyers alike need to put safety, privacy, and common sense ahead of the technological wow factor. Before buying a connected toy, check how the manufacturer handles security updates, privacy, and reports of problems.
Browse like no one’s watching.
Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free →
