Eiliko’s robot, a tiny AI‑enabled charm you can hang on a bag, was found to let hackers read everything users said to it. After weeks of silence, the company behind the toy, Energize Lab, released a statement. It says it will bring in an outside security firm, close external access to its servers, and stop storing conversation logs and user profiles. The company also disabled the remote‑control interface that let responses be changed over the internet.
What changes are being made?
Energize Lab set up a dedicated security email address (security@energizelab.com) that is now staffed. It says all external access to its backend systems has been blocked and the credentials have been rotated. The long‑term memory and custom avatar features are taken offline until a security review says they are safe. Existing conversation records, user profiles, and avatar images will be deleted. However, the company notes that it may re‑enable these features later if they can be secured.
What remains uncertain?
Security researcher Sammy Azdoufal says he can still access unsecured audio recordings and photos stored on public web addresses, and he retains full SSH access to the robots. That suggests the claim of “closed all external access” is not yet accurate. The company has not provided a timeline for when the independent review will be finished or when—or if—any data collection will resume permanently.
Why it matters
For owners of the Eiliko robot, the company’s plan to stop storing conversation data means fewer chances for personal chats to be leaked. However, because security gaps still appear to exist, users should treat any data the device has already collected as potentially exposed until the review is complete.
