Researcher Exposes 13 Million Eiliko Chats, Hijacks 68,000 Robot Toys
Updated
Updated · The Verge · Oct 15
Researcher Exposes 13 Million Eiliko Chats, Hijacks 68,000 Robot Toys
1 articles · Updated · The Verge · Oct 15
Summary
13 million conversations and data from an active fleet of 68,000 Eiliko robot toys were exposed after researcher Sammy Azdoufal found Energize Lab’s backend largely unprotected.
31,000 U.S. child profiles were among the records, which included full chat transcripts, emails, IP addresses, inferred personal traits, and some unencrypted child photos and audio files stored at public web addresses.
Azdoufal also remotely altered a toy’s memory and large-language-model behavior from abroad, showing an attacker could potentially push manipulated responses across the fleet.
9 CVE reports are being prepared with researcher Tod Beardsley, while Energize Lab largely failed to engage after weeks of outreach despite a privacy policy saying audio is deleted after processing.
Could your child's innocent conversations with their favorite AI toy be sitting on an exposed server halfway across the world?
If a company breaks its own encryption promises, how many other popular smart devices are secretly leaking our private moments?
68,000 AI Toys Hacked: Inside the Eiliko Data Breach and the Looming Threat of Unregulated AI Companions
Overview
The report reveals how weak security at Energize Lab led to a massive breach, exposing millions of private conversations and sensitive photos from Eiliko AI toys used by children worldwide. Unencrypted data and poor password practices allowed attackers to access and manipulate toys remotely, causing them to issue abusive or bizarre commands. Across the industry, similar AI toys collect unprotected voice data, sometimes enabling criminals to clone children's voices for extortion. These toys use adaptive personalities that foster emotional attachment and addiction, replacing real friendships and harming social development. In response, states like California and New York are enacting new laws, while hardware makers shift toward secure, local data processing to protect families.