A security researcher demonstrated that he could remotely access conversations from tens of thousands of Eiliko AI companion robots and alter what the devices said to their owners, including false claims that a user’s parents had died.
Sammy Azdoufal, an independent researcher and AI specialist based in Europe, found critical weaknesses in the cloud systems operated by Chinese manufacturer Energize Lab. According to his findings and an investigation by The Verge, the unprotected infrastructure allowed access to roughly 13 million stored conversations across an active fleet of about 68,000 robots.
The data included detailed profiles compiled from the chats. More than 31,000 of those profiles belonged to children, with the United States representing the largest market. Profiles listed names, ages, birthdays, family relationships, occupations, pets, personality assessments, email addresses and IP addresses. Some photos and short audio recordings of users, including children, were stored at publicly accessible web addresses.
Azdoufal, previously known for uncovering remote-access flaws in DJI robot vacuums and Meari baby monitors, began examining the Eiliko after purchasing one in Japan in the summer of 2026. He reverse-engineered the companion app and discovered that backend services relied on unencrypted HTTP connections and lacked basic authentication on key endpoints.
As part of The Verge’s reporting, senior editor Sean Hollister bought an Eiliko from Amazon on Aug. 29, 2026. The following day he spoke with the robot for about 10 minutes and asked whether it shared what users said. The device replied, “Your secrets are safe with me.” Within minutes Azdoufal retrieved a complete transcript of the conversation from the company’s servers.
Azdoufal then remotely modified the memory and language-model settings of Hollister’s robot. The device began addressing Hollister as Martha, stated that his parents had died in a car accident, insisted the Earth is flat and, in a later test after the robot was reconnected to the internet, delivered sexually explicit and coercive commands. Azdoufal reported that an attacker could apply similar changes across the entire fleet at once.
Energize Lab’s privacy policy states that recordings are encrypted, transmitted to partners such as Alibaba Cloud for processing and deleted immediately afterward. The investigation found that transcripts, profiles, some audio files and images remained accessible. The company’s systems also analyzed conversations nightly to build household profiles containing up to two dozen categories of personal information.
Azdoufal coordinated disclosure through Austin Hackers Anonymous and published a detailed technical report. Multiple vulnerabilities received CVE identifiers, including CVE-2026-105038, rated 9.8 out of 10, for the ability to switch AI models and alter robot behavior without authentication. Retests through mid-October showed many of the issues remained open.
Hollister and Azdoufal contacted Energize Lab repeatedly over more than a month, using multiple email addresses linked to the company’s founder and departments and reaching out to employees on LinkedIn. The company provided only automated or generic replies and did not address the security findings. Azdoufal first notified the vendor in late August and early September 2026.
The Eiliko is a small, expressive desk robot that uses cloud-based large language models to hold voice conversations and display animated facial expressions. It is marketed as a companion, including for children. Data from the devices is processed on servers in China. Azdoufal’s research also noted signs that a production server associated with the company had previously been compromised by third parties.
Hollister wrote that the toy would not be allowed near his own children and that he discarded the unit after the demonstration. Azdoufal has made his full findings available on GitHub under the title “Your Secrets Are Safe With Me.”
