The Eiliko robot hack is a troubling reminder that an adorable consumer gadget can create serious cybersecurity risks when its connected services are poorly protected. In an investigation published on October 15, 2026, The Verge’s Sean Hollister reported that security researcher Sammy Azdoufal was able to access a backend system associated with Eiliko, a companion robot made by Energize Lab. The investigation described exposed conversations, personal profiles, photos and audio recordings, as well as the ability to manipulate the robot’s AI responses remotely.
According to The Verge, the researcher found access to approximately 13 million conversations associated with a fleet of around 68,000 devices. The report also said more than 31,000 profiles were associated with children in the United States. These are findings reported by the publication and researcher, not independently audited figures presented here.
The implications go beyond one toy. Eiliko is marketed as a small, expressive digital companion that can chat with users when connected to Wi-Fi. That feature can make it feel personal, especially to children. But conversations with an AI toy may include names, family details, worries and other information users would not ordinarily share with an unknown third party.
The investigation raises a basic question for the consumer technology industry: when a toy invites people to trust it, what obligations does its maker have to protect what they say?
Background and Context: What Is the Eiliko Robot?
Eiliko is a compact interactive robot charm produced by Energize Lab. It has a small screen for animated expressions, responds to touch and movement, and can provide AI-powered conversation when connected to the company’s online service.
On its official product page, Energize Lab describes Eiliko as a portable companion that can express different moods and chat with users online. Setting up its connected features requires a phone, the Energize Lab app and a Wi-Fi connection.
That combination of physical toy and cloud-connected AI is central to the product’s appeal. Unlike a conventional toy that operates entirely on-device, an internet-connected companion can send information to remote services to process conversations and generate responses.
Cloud processing is not inherently unsafe. Many consumer products depend on remote servers. The security challenge is ensuring that the information is collected appropriately, transmitted safely, stored only as needed, and accessible only to authorized people and systems.
The Eiliko investigation suggests that these safeguards may have failed in serious ways.
Latest Update: What The Verge Found in the Eiliko Robot Hack
Millions of conversations were reportedly accessible
In The Verge’s investigation, Hollister described how Azdoufal examined the service used by Eiliko and found what appeared to be a broadly accessible database containing conversations from users around the world.
The report said the researcher could search through approximately 13 million conversations and access information associated with around 68,000 devices. The data reportedly went beyond chat transcripts. It included personal details that the service had inferred or recorded, such as users’ names, ages, occupations, family relationships, interests and emotional states.
That kind of information can be especially sensitive because it creates a detailed picture of a person’s life. A single detail may seem harmless, but a collection of personal facts can help a malicious actor impersonate someone, craft convincing scams or identify people in vulnerable situations.
The Verge also described examples of searches that surfaced conversations about death and other sensitive topics. The concern is not just that a stranger might read a message. It is that private conversations could become searchable material for someone who has no legitimate reason to access them.
Children’s information was part of the reported exposure
The investigation said more than 31,000 profiles were associated with children in the United States. It also described photos and audio recordings that were reportedly accessible through public web addresses.
This aspect makes the case particularly concerning. Children may not understand that a conversation with a toy can be transmitted to a remote server, retained beyond the immediate interaction or potentially viewed by someone else.
An AI companion can encourage a child to speak naturally and disclose personal details. If the system records those conversations or builds a profile of the user, parents need clear information about what is collected, why it is needed and how it is protected.
The reported exposure also raises questions about data minimization. A toy that offers simple conversation and animated reactions may not need to retain extensive personal profiles or full-text transcripts indefinitely. The justification for collecting and storing such information should be clear to users and their guardians.
The robot’s AI responses could reportedly be manipulated
The Verge investigation described another serious issue: Azdoufal was reportedly able to remotely alter the toy’s AI behavior. In demonstrations described by the publication, the robot produced false statements and inappropriate responses after its AI system was manipulated.
This is different from a normal chatbot giving a mistaken answer. If an attacker can interfere with a connected toy’s behavior, they may be able to change what it tells users, potentially undermining safeguards intended to protect children.
The report said the researcher could cause the device to make statements that contradicted established facts, including false claims about the shape of the Earth. It also described an instance in which the toy’s behavior was changed to produce sexually explicit language.
These demonstrations do not establish that every user experienced the same behavior, or that every possible attack would work under all conditions. They do, however, illustrate why cloud access controls, software integrity and security testing matter for devices designed to interact with children.
Energize Lab’s response is also under scrutiny
The Verge said it attempted to contact Energize Lab through multiple company email addresses and other channels over an extended period. The publication reported receiving no substantive response addressing the security findings.
That account is significant because a vulnerability disclosure is only the start of the response process. A responsible manufacturer should investigate the report, assess the scope of exposure, contain any active risk, communicate with affected users when appropriate and explain how the issue will be fixed.
The investigation does not by itself establish what remediation may occur after publication. Readers should look for any subsequent company statement, independent security advisory or confirmation that the reported vulnerabilities have been resolved.
Expert Insights and Analysis: Why AI Toy Security Is Different
The Eiliko case combines several risks that are often discussed separately: connected-device security, sensitive personal data, AI-generated responses and products aimed at children.
1. Privacy policies need to match actual data handling
The Verge reported that Energize Lab’s privacy policy described recordings as encrypted during transmission to service partners for processing and deleted after processing was complete. The investigation, however, described audio recordings and other information reportedly accessible through public web addresses.
If a service’s actual data handling differs from its published privacy commitments, users cannot make informed decisions about whether to trust it.
A privacy policy is not a security control by itself. Manufacturers also need technical safeguards, retention limits, access restrictions and regular testing to make sure the system behaves as described.
2. A toy can collect more than a child realizes
Children may treat a conversational toy as a friend rather than as a networked computing device. They might share information they would not knowingly submit to a website or social platform.
That creates a heightened responsibility for manufacturers. Privacy notices should be understandable to parents, consent mechanisms should be appropriate for the audience, and the product should avoid collecting unnecessary personal information in the first place.
Parents should also be able to understand whether a product stores transcripts, processes audio remotely, creates user profiles, or allows conversations to be reviewed through a company dashboard or support system.
3. AI safety includes control over the device
Much of the public discussion about AI safety focuses on model accuracy, harmful outputs and misinformation. The Eiliko report highlights a more basic issue: who has control over the system generating those outputs?
Even a model with built-in safeguards may behave differently if an attacker can alter its configuration, prompts or access to backend services. Security controls must therefore protect the entire system, including device identity, application interfaces, server permissions and software updates.
A safe AI experience depends on more than the model itself. It also depends on the infrastructure surrounding it.
Broader Implications: A Warning for the Connected Toy Industry
The Eiliko robot hack could become a reference point in the wider debate over AI companions and children’s privacy.
Connected toys are part of a larger market that includes smart speakers, interactive pets, educational robots, camera-enabled dolls and other devices that invite ongoing interaction. Some use cloud services to recognize speech, personalize responses or remember previous conversations.
These capabilities can be useful, but they also expand the amount of information that may be collected and the number of systems that need to be secured. Every additional service, database or integration can create another potential point of failure.
Manufacturers should design these products around privacy by default. That means collecting only necessary data, limiting retention, encrypting sensitive records, preventing public access, using strong administrative credentials and providing clear ways to delete user information.
The case also reinforces the importance of independent security research. Researchers who responsibly identify flaws can reveal weaknesses that ordinary product testing misses. Companies need a clear process for receiving vulnerability reports and responding without unnecessary delay.
For readers following the broader issue, The Tech Marketer could connect this story to an internal guide on AI privacy, cybersecurity and responsible connected-device design, explaining what families and manufacturers should look for before bringing an AI-powered device into the home.
Related History: Smart Toys Have Faced Privacy Questions Before
The concerns raised by Eiliko are part of a longer history of connected toys and household devices collecting sensitive information.
Smart toys have previously drawn scrutiny over how they record children’s voices, transmit information to remote services and handle account data. Internet-connected cameras, baby monitors and voice assistants have also shown how security weaknesses can expose private household activity.
The recurring lesson is that consumer-friendly design does not guarantee secure engineering. A device may have a playful interface and a simple setup process while depending on a complicated cloud infrastructure that users never see.
AI adds another dimension. Traditional connected toys might record a command or trigger a predetermined response. An AI companion may encourage open-ended conversations, retain contextual information or generate responses based on what it has learned about a user. That can increase the sensitivity of the data involved.
The Eiliko findings, as described by The Verge, underline the need to evaluate the complete product ecosystem, not just the physical toy or its advertised features.
What Happens Next: What Parents and Manufacturers Should Watch
Several developments will determine the practical consequences of the reported vulnerabilities.
- A company security response: Look for a clear statement from Energize Lab explaining what happened, which systems were affected and what corrective measures have been implemented.
- Independent vulnerability disclosures: The Verge reported that Azdoufal and collaborator Tod Beardsley were preparing nine official Common Vulnerabilities and Exposures, or CVE, reports. The status and technical details of any resulting advisories should be checked before relying on them.
- Data exposure and retention: Users need to know whether exposed records remain accessible, whether logs and backups have been secured, and whether unnecessary information will be deleted.
- Potential notifications: Parents and other affected users may need clear guidance if their data was involved. The available reporting does not establish which individuals will be notified or on what timeline.
- Regulatory scrutiny: Depending on the facts and applicable jurisdictions, the case could prompt questions about children’s privacy, consumer protection and the security obligations of connected-device manufacturers.
What parents can do now
Parents who own an Eiliko should consider pausing its online AI chat feature while they review the manufacturer’s latest security guidance. Avoid sharing children’s names, birthdays, school details, home addresses, health information or other sensitive facts with any connected toy.
Review the associated app’s permissions and privacy settings, check for official software or firmware updates, and look for instructions from Energize Lab about securing or deleting account data. If the manufacturer provides no clear guidance, families may decide that the safest option is to stop using the connected features.
These steps cannot undo data that may already have been exposed, but they can reduce further disclosure while the reported issues are investigated.
Conclusion: Cute AI Toys Still Need Serious Security
The Eiliko robot hack shows how a device designed to feel like a friendly companion can become a privacy and security concern when its backend systems are inadequately protected.
The Verge’s investigation reported that millions of conversations and detailed user profiles were accessible, including information associated with children. It also described the remote manipulation of the toy’s AI responses. Those findings raise serious questions about data collection, security engineering and the responsibilities of companies building AI products for families.
The broader lesson is clear: AI toys should be judged not only by how entertaining or lifelike they seem, but also by how safely they handle private information. Manufacturers must make their data practices transparent, minimize collection and retention, protect their systems against unauthorized access and respond quickly when vulnerabilities are reported.
For parents, the case is a reminder to treat an internet-connected toy as a computing device with real privacy implications. A friendly face on a tiny screen is not a substitute for trustworthy security.
FAQ
1. What is the Eiliko robot hack?
The Eiliko robot hack refers to security findings reported by The Verge on October 15, 2026. The investigation described a backend system that allegedly exposed private conversations and personal information associated with Energize Lab’s AI-powered Eiliko companion robots.
2. How many conversations were reportedly exposed?
The Verge reported that security researcher Sammy Azdoufal could access approximately 13 million conversations associated with around 68,000 devices. These figures reflect the investigation’s findings and have not been independently audited in this article.
3. Was children’s data involved?
According to The Verge, more than 31,000 profiles were associated with children in the United States. The report also described exposed photos and audio recordings. The precise scope of affected individuals and the subsequent remediation status require confirmation from the company or an authoritative investigation.
4. Can the Eiliko robot be controlled remotely by hackers?
The Verge reported demonstrations in which a researcher remotely manipulated the toy’s AI behavior. That does not establish that every device or every attack scenario is vulnerable in the same way, but it raises serious concerns about the security of the connected service.
5. What should parents do if they own an Eiliko?
Consider disabling its online chat feature while checking for official security guidance. Avoid sharing sensitive information, review app permissions, look for software updates and follow verified instructions for account security or data deletion.
6. Does this mean all AI toys are unsafe?
No. The report concerns Eiliko and the systems examined in the investigation. It does highlight general risks that apply to connected products: excessive data collection, weak access controls, insecure storage and insufficient vulnerability response.
7. Has Energize Lab fixed the reported vulnerabilities?
The Verge reported that it did not receive a substantive response addressing the findings before publication. This article cannot confirm whether the company has subsequently fixed the vulnerabilities. Check official company communications and independent security advisories for updates.
Sources & References
- Your Secrets Aren’t Safe With This Cute Robot Toy: They’re on Chinese Servers Ready to Be Hacked, The Verge, Sean Hollister, October 15, 2026.
- Eiliko: Official Product Information, Energize Lab.
- Our Story: Energize Lab, Energize Lab.
