Eiliko maker says it’s hiring an ‘’independent security firm’ after Verge report on its insecure robots
Original reporting by The Verge
Eiliko is an AI-powered robot charm, designed for personal conversation and portability, that has been at the center of a significant data security scandal. Despite assurances that "your secrets are safe with me," security researchers uncovered gaping vulnerabilities, allowing complete access to sensitive user data, including conversation transcripts, audio recordings, and even photos. For over a month, Energize Lab, Eiliko's creator, remained silent as media outlets attempted to contact its CEO, leaving users exposed and without answers.
Claims Under Scrutiny
Energize Lab has now broken its silence, issuing an unsigned statement acknowledging the "core issues" and outlining steps for remediation. The company claims to have closed all external backend access, disabled remote robot modification, and pledged to delete existing conversation data and user profiles, promising to hire an independent security firm for a full review. However, immediate investigations reveal these assurances may be premature; unsecured audio recordings and photos of customers remain publicly accessible, and researchers still maintain full backend access to the robots, capable of reading transcripts and altering behavior. While Energize Lab states it aims to rebuild trust through action, the immediate disconnect between their claims and observable reality suggests a long road ahead for earning back user confidence.
Energize Lab's belated response to the Eiliko security vulnerabilities, while a necessary first step, largely rings hollow. Despite promises to close external access, delete user data, and engage independent security experts, independent verification reveals significant ongoing risks. Audio recordings and photos remain exposed, and a security researcher maintains critical access to the robots, directly contradicting the company's assurances. This disconnect between public statements and verifiable reality underscores a profound lapse in security and transparency, raising serious questions about the company’s immediate capacity to rectify its failures.
A Broader Warning
The Eiliko saga extends far beyond a single vulnerable toy; it serves as a stark warning for the burgeoning consumer AI market. When devices designed for companionship promise confidentiality, their failure to deliver on that promise erodes fundamental trust. This incident highlights the critical imperative for AI developers to embed robust security protocols and transparent data handling practices from inception, rather than as an afterthought. Consumers, drawn to the novelty of AI, must also internalize the potential privacy trade-offs. As AI integration deepens across everyday objects, incidents like Eiliko will undoubtedly fuel greater scrutiny, potentially accelerating demands for industry-wide security standards and prompting users to critically evaluate the true cost of convenience when handing over their most intimate data to a "cute" companion. The path to regaining trust, for Energize Lab and for the wider AI industry, demands verifiable action over mere assurances.
Frequently asked questions
- What were the major security vulnerabilities discovered in the Eiliko AI robot charm?
- Hackers could easily access complete transcripts of conversations, and researchers reportedly retained SSH access and the ability to modify the toy's behavior remotely. Unsecured public web addresses were still storing customer audio recordings and photos without protection, allowing unauthorized viewing of personal data including faces, despite company claims of having closed external access to backend systems.
- What actions has Energize Lab taken to address the security flaws in its Eiliko product?
- Energize Lab states it has closed external access to backend systems, disabled remote modification interfaces, and taken long-term memory and custom avatar features offline. The company pledges to delete existing stored conversation records, user profiles, and avatar images. They are also engaging an independent security firm for a full system review and have established a dedicated security contact email.
- Is Energize Lab still storing user data collected from Eiliko AI robot owners?
- Energize Lab claims it no longer stores conversation records or user profiles and will delete existing data. However, at the time of their statement, audio recordings and photos of customers were reportedly still accessible at unsecured public web addresses. The company also suggested it plans to reintroduce data collection for "long-term memory" and "custom avatar" features once systems are confirmed secure.