A small companion robot promised Sammy Azdoufal that his conversations would stay private. He then read that same exchange back from its maker’s cloud database. The independent researcher’s investigation of Energize Lab’s Eiliko and related connected products, publicized on October 15, describes a second problem beyond exposed conversations: changing stored “memory” could change what the toy told its owner.
This is a report about the service behind the robot, not evidence that every toy was taken over. Azdoufal dates his latest broad retest to October 13. Owners deciding whether to keep a cloud-connected Eiliko in a child’s room should know that a friendly answer about secrecy is not a description of how its data is handled.
The first clue was in the app
Azdoufal began examining the product in June. His Android-app analysis found backend addresses using unencrypted HTTP, including authentication and AI services. A conversation that feels like a private exchange with a desk companion actually travels through remote systems: speech becomes text, a cloud language model produces an answer, and a voice service sends the reply back.
The manufacturer’s own Eiliko page confirms the important distinction: AI chat requires Wi-Fi, while the device also has a limited set of offline voice commands. Nor should the findings be flattened into a claim about every standalone Eilik used without connected AI features. The investigation spans several product lines; their data and capabilities differ.
Unencrypted transport was the beginning of the inquiry. The more consequential failure was authorization: whether a person who could reach a service was entitled to read a particular family’s information.
An ordinary back office became a window into conversations
According to the report, a file-read weakness exposed server secrets, including the secret used to sign authentication tokens. Such a token is a credential a service uses to recognize an account and its permissions. Possession of the signing secret let the researcher construct an administrator token that the vendor’s back office accepted.
The result was not a hypothetical list of database names. Azdoufal describes navigating the vendor’s own interface, following his account to its device record and reading 26 conversations belonging to that account. The relevant endpoints lacked per-device ownership checks, he reports, allowing the same access pattern to reach other records. Conversation pages included text, device identifiers and household IP addresses, with export controls.
The report’s dated census gives the scale without requiring inflated victim claims: 9,124,055 stored conversations across product lines on October 13, and 32,228-plus extracted child profiles by that date. Those are the researcher’s aggregate database counts, not a count of people proven to have been attacked. Other sections retain earlier snapshots; they should not be mixed into a single current tally.
The profile was also an input to the next answer
A nightly process extracted structured household information from conversations into 24 fields, including names, ages, relationships, preferences and parental information, according to the research. That makes the exposure more revealing than a collection of disconnected chat messages: a service can assemble a continuing picture of a household.
More unexpectedly, the stored profile helped shape future replies. In tests on his own devices, Azdoufal changed profile data and made the robot adopt a different name for its user and repeat a false belief about the Earth. The failure was a trust boundary: editable cloud data was being treated as authoritative context for a supposedly familiar companion.
The detailed findings also describe replacing model and voice configuration during bounded tests on researcher-owned robots, then restoring the settings. These demonstrations support the risk of altered answers. They do not establish that an intruder deployed replacement firmware across customer devices. The report explicitly separates individually validated firmware weaknesses from an unperformed end-to-end fleet takeover.
There was a further trap in the memory design: a later profiling run could turn manipulated conversation history back into persistent profile information. Restoring one setting therefore did not necessarily remove everything the conversation had taught the system. This is why the integrity of memory matters alongside the confidentiality of transcripts.
Partial fixes had a date and a limited meaning
The disclosure timeline says 42 of 44 remotely testable findings remained open on September 14. Its later October 13 entry reports 32 of 40 still open, with eight fixes in that retest’s accounting. These are different dated test sets, not interchangeable percentages or an October 18 security verdict.
Azdoufal says important shared secrets had not been rotated at the October retest and reports third-party access on shared production infrastructure. That evidence increases the concern, but it does not identify who read any particular family’s chats. We have not probed the live backend or independently established its remediation status today.
A guest network does not repair the cloud
Putting a toy on an isolated Wi-Fi network can limit its access to other home devices. It cannot stop an authorized cloud connection from sending conversations to a service with broken access controls. Likewise, updating or resetting the toy is not evidence that previously stored transcripts or profiles have been deleted.
Until Energize Lab provides verifiable answers about access controls, credential rotation and stored-data handling, the practical precaution is to pause connected use and keep sensitive family conversations away from the device. Powering it off is the clearest way to stop that particular toy recording new speech; it does not erase records already held remotely. Owners can request a written remediation statement and deletion of retained conversations and profiles through the manufacturer’s support channels.
The broader lesson also appears in our HeyCyan smart-glasses investigation coverage: what a device appears to do locally is only one part of its privacy boundary. With Eiliko, both the words leaving the room and the words coming back deserve scrutiny.
References
- Sammy Azdoufal. Your Secrets Are Safe With Me. Research report, October 13, 2026; accessed October 18, 2026.
- Sammy Azdoufal. Behavior findings: memory, model configuration and persona tests. Research repository; accessed October 18, 2026.
- Sammy Azdoufal. Coordinated Disclosure Timeline. Includes October 13 retest; accessed October 18, 2026.
- Energize Lab. Eiliko: product features and connectivity FAQ. Accessed October 18, 2026.
