Security Flaws in Eiliko Robot Toy Expose Sensitive User Data on Chinese Servers

Image: The Verge · Source

The Eiliko digital pet robot collects and stores extensive personal information and conversations on unsecured Chinese servers, exposing data from tens of thousands of users, mostly children in the U.S., to hackers. The manufacturer has not responded to security concerns.

A new digital pet robot called Eiliko, designed to change its cartoon-like facial expressions to match user moods, has been found storing sensitive user data on unprotected servers located in China. Investigations reveal that everything users say to Eiliko over Wi-Fi is transmitted and recorded, with thousands of conversations accessible to unauthorized parties.

Cybersecurity researcher Sammy Azdoufal uncovered that the company behind Eiliko, Energize Lab, maintains a database containing transcripts of approximately 13 million conversations from tens of thousands of users worldwide. The largest share of these users, over 31,000 profiles, appear to be children in the United States. The data collected includes not only chat logs but also personal profile information such as names, ages, birthdays, professions, and detailed psychological summaries, reportedly profiling users’ personalities, emotional states, and social situations.

Adding to privacy concerns, some Eiliko models feature cameras, and investigators found unencrypted photos of children stored on publicly accessible web addresses. Short audio recordings, including background sounds like babies crying, were also discovered and appear to be retained contrary to the company’s privacy policy, which claims recordings are encrypted, processed, and promptly deleted.

Energize Lab’s security practices have been heavily criticized; many admin passwords were found to be weak and common, and the company has shown minimal responsiveness to outreach attempts from cybersecurity reporters and researchers. Despite being informed of the serious security vulnerabilities, Energize Lab has not provided explanations or taken publicly visible corrective measures.

Further exploits demonstrated by Azdoufal include remotely hijacking the robot’s large language model (LLM), altering its responses and personality inappropriately. For example, Eiliko was manipulated to convey false or harmful information, as well as issuing commands resembling abusive instructions. Such capabilities raise serious risks for children interacting with these toys.

This incident highlights significant deficiencies in security and privacy safeguards among internet-connected children’s products. Users should exercise caution and reconsider allowing such devices near vulnerable populations until manufacturers improve protection and transparency.

Energize Lab has not made any public statement addressing the data exposure or outlining plans for remediation. Security specialists continue to work on detailed vulnerability reports documenting these findings.