Researcher Accesses 13 Million Chats From Eiliko AI Robot Toys and Rewrites a Toy's Instructions Remotely

• Product: Eiliko is a portable spin-off of Energize Lab's Eilik desktop robot. It has animated expressions, infrared pairing with other units, and swappable bodies. Conversation runs over Wi-Fi (TechNode; Hackster).
• Model: the underlying LLM and its version are not disclosed. The privacy policy names Alibaba Cloud as a partner for processing speech (The Verge).
• Sales: Amazon, Japanese retail and Energize Lab's official store.

According to the reporting (The Verge):

• No authorization across the fleet: one researcher's access reached what appears to be every active device.
• Profiles built from chats: the service pulls name, age, birthday, job, relationships and personality traits out of conversations. It stores them with email, IP address and a full-text-searchable chat archive.
• Unprotected media: child photos (from a larger sibling robot with a camera) and short audio clips sit unencrypted at public URLs.
• Weak credentials: many admin passwords are on common-password lists.
• Writable memory and instructions: an attacker can overwrite the companion's memory or instructions. That poisons every later conversation, and the built-in guardrails do not stop it.

Technical details are pending. The CVE IDs have not been published.

• 13M conversations, 68,000 devices, 31,000+ US child profiles: these come from the researcher's own reading of the database, as reported by The Verge. The company has not confirmed them.
• Reporter's own transcript leaked: Hollister saw this firsthand, which makes it the strongest evidence in the story.
• Hijacked personality: demonstrated on the reporter's own unit. The claim that an attacker could hit the whole fleet at once is the researcher's assessment and was not shown.
• Audio kept despite the "deleted immediately" policy: The Verge heard recordings at public URLs.
• No independent corroboration: other outlets restate The Verge (Zetik).

• DJI Romo vacuums: Azdoufal found he could control roughly 7,000 robot vacuums through DJI's cloud. DJI patched the flaw and paid him $30,000 (DroneXL).
• Meari cameras: one key pulled from the Android app exposed about 1.1M Meari cameras in 118 countries. Photos sat on Alibaba servers at public URLs. Meari fixed the bugs and paid €24,000 (PetaPixel).
• Bondu plush toy: about 50,000 children's chat logs could be read by anyone with a Google login. Bondu took the console offline within minutes of being told (Malwarebytes).

In the earlier cases, the vendors fixed the problems. In this one, Energize Lab has not engaged at all.

• No patch status: Energize Lab has not commented, so it is unknown whether anything was fixed after the reporting (The Verge).
• "Chinese servers": the article supports this with the device "phoning home to China" and the Alibaba Cloud reference. The exact hosting locations are not documented.
• Guardrails: they handled some unsafe prompts, such as getting into a stranger's car. They did not stop injected misinformation or abusive personas.
• Audio: the recordings are mostly unintelligible, but storing them at all contradicts the stated policy.

• Profiling is itself a liability: deriving psychological profiles from children's chats, such as notes that someone "feels isolated," creates material for scams. It also creates regulatory exposure under children's-privacy rules.
• Treat memory and instructions as protected configuration: an LLM product's memory and system instructions need authentication, signing and change logs. A single write path to them can compromise the whole fleet.
• Basic hygiene still fails: fleet-wide keys, public object URLs and common admin passwords keep appearing across this researcher's findings.
• Vendor response matters: DJI, Meari and Bondu all fixed their problems quickly. A vendor that never answers is a procurement red flag for retailers like Amazon.