New turn in Eiliko robot data leak as maker will hire a security firm

The Verge and researcher Sammy Azdoufal found that hackers could read complete transcripts of what owners said to the Eiliko AI robot charm. The maker did not answer for more than a month.

Energize Lab makes Eiliko, a robot charm with AI conversations. After a report by The Verge, it answered. In an unsigned statement, it said that the core issues are true and will hire an external security firm. The Verge says the systems are not safe: audio recordings and photos of customers are on public web addresses with no protection.

What the company did

Energize Lab says it closed all external access to its backend systems and changed all access credentials. It says it turned off the interface that let a person change robot responses from a remote location. It put the long term memory and custom avatar features offline. It will erase stored records and avatar images.

What The Verge found

On the day of the email, The Verge found that the audio and photos were open. Azdoufal says that the full SSH access, a remote login, to the robots is open. In theory, a person with it can read transcripts and change the behavior of the toy.

What is not known

The company gave no date for the test and no name for the firm. Memory and avatar features come back only after the firm makes sure they are safe. The company does not promise to end data collection for good.

Insight: A security claim needs an external test

Two earlier stories show that attackers want AI credentials. Aoki malware takes tokens of tools for code. The MONST3R-AI tool uses stolen API keys, and the key owner pays. Energize Lab says it changed all access credentials, but Azdoufal says he has SSH access. The word of a maker is not proof, and the result of the external test is the next move to monitor.