Eiliko Robot Exposes User Audio and Photos on Unsecured Public Links
The maker of the AI chat robot admits to security flaws and promises an independent review, though researchers say data remains accessible online.
Key points
- Energize Lab confirmed issues reported by The Verge and security researcher Sammy Azdoufal.
- The company states it has disabled remote modification of robot responses and closed backend access.
- Independent verification shows audio recordings and photos remain exposed at unprotected public web addresses.
Energize Lab, the maker of the Eiliko AI robot charm, has acknowledged severe security failures that allowed unauthorized access to user conversations and personal data. The company issued an unsigned statement to The Verge confirming the core issues identified in recent reporting. It stated that it is addressing each identified problem and will hire an independent security firm to conduct a full review of its systems. The firm also established a dedicated security contact email address for future reports.
The risk
Security researcher Sammy Azdoufal and The Verge reported that hackers could easily read complete transcripts of conversations with the device. The robot previously assured owners that their secrets were safe, yet the underlying infrastructure failed to protect this data. Energize Lab claims it has closed all external access to its backend systems as of Wednesday. It also says it disabled the interface that allowed remote modification of the robot’s responses. The company pledged to delete stored conversation records, user profiles, and avatar images.
Who is exposed
Owners of the Eiliko robot charm are exposed to significant privacy risks. The device collects audio recordings and photos of its users. According to Azdoufal, these files were stored at unsecured public web addresses with no protection. Anyone with the direct link could view an owner’s face or listen to their conversations. The researcher confirmed that as of the company’s response, these recordings and photos remained publicly accessible without authentication. This exposure affects users whose data was stored on these unsecured servers.
Cost and compliance
The company has not disclosed any financial costs associated with the breach or the remediation process. There is no mention of regulatory fines or compliance penalties in the available reporting. Energize Lab stated it will no longer store conversation records or user profiles generated from them. However, it indicated that long-term memory and custom avatar features might return once the independent security review confirms the systems are secure. This suggests the company intends to resume storing personal information in the future.
What should you do?
Managers and users should assume that any data shared with the Eiliko device is compromised. Review all personal information that may have been discussed with the robot. Monitor for any unexpected behavior or changes in the device’s responses. Wait for the independent security firm’s report before trusting the device again. Do not rely on the company’s initial claims of closure without independent verification of the fixes.
The background in plain language
When devices connect to the internet, they often send data to remote servers for processing. If these servers lack proper security controls, such as authentication or encryption, unauthorized users can access the stored information. Teams usually implement strict access controls to ensure only authorized personnel can view sensitive data. Check whether the vendor provides clear documentation on how data is stored and who has access. Understanding these basics helps users assess the risk of connected devices.
Background: Encryption
Encryption is the process of converting plain text into cipher text using an algorithm and a key, rendering the data unreadable to anyone without the corresponding decryption key. It protects confidentiality during storage and transmission, ensuring that intercepted or stolen data remains useless to unauthorized observers who lack the specific key required to reverse the transformation.
Read the full guide: Encryption in a Sentence: How Scrambling Data Protects Your Digital Life
What to do and how to stay safe: Energize Lab
- Stop using the device for any private or sensitive conversations until the vendor provides a verified update.
- Check your email and other accounts for any signs of unauthorized access or leaked personal information.
- Monitor your device’s behavior for unexpected changes in responses or functionality.
- Wait for the independent security review results before resuming normal use of the product.
Step-by-step guide: Browser security settings are the architectural walls of your digital life
General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Has Energize Lab fixed the security vulnerabilities in Eiliko?
The company claims to have addressed the issues, but independent researchers say the data remains exposed.
What data was exposed in this incident?
Audio recordings, conversation transcripts, user profiles, and photos of owners were accessible online.
Will Eiliko stop collecting user data permanently?
The company plans to delete current data but may resume collection once security is confirmed.
