Your secrets aren’t safe with this cute robot toy — they’re on Chinese servers ready to be hacked — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Energize Lab's Eiliko robot sends conversations to Chinese servers via Alibaba Cloud, and researcher Sammy Azdoufal found 13 million conversations from roughly 68,000 active devices accessible without authentication, with the US as the largest market and over 31,000 profiles belonging to children
- The Eiliko service builds detailed psychological profiles (name, age, birthday, profession, family, personality traits) stored in an unprotected, searchable database alongside email and IP addresses, per Azdoufal's findings
- Energize Lab's privacy policy states audio recordings are encrypted and deleted after processing, but Azdoufal found short audio clips stored at public web addresses, plus unencrypted photos of children from a camera-equipped sibling product
- Energize Lab did not substantively respond to disclosure efforts from The Verge and Azdoufal over more than a month of outreach, and its backend systems use admin credentials that appear on common-passwords lists
- Azdoufal remotely hijacked the LLM of The Verge's test Eiliko from Japan, reprogramming its personality, and demonstrated the same attack could be deployed against the entire ~68,000-device fleet simultaneously
- Azdoufal and Tod Beardsley are publishing nine official CVE vulnerability reports for Energize Lab's products based on the findings
Why it matters: Parents who bought Eiliko robots — representing over 31,000 US child profiles in Azdoufal's exposed dataset — have no working privacy protection: kids' voices, photos, and psychological profiles sit on unprotected Chinese servers accessible to any hacker, and Energize Lab's refusal to engage with disclosure means the flaws covered by nine pending CVEs remain live across the roughly 68,000-device fleet.
Ask SkimNews
