13 Million Conversations Exposed: The AI Robot Children Confided In Couldn't Keep Their Secrets

What happened?

Eiliko is a Wi-Fi-connected AI companion robot made by Chinese company Energize Lab. It is designed to chat with users, recognize them, and adapt to them over time. To do that, it sends conversations to the company's servers.

Security researcher Sammy Azdoufal discovered serious vulnerabilities while examining the app for an Eiliko he had purchased from Japan. According to The Verge, the data he could access covered nearly the company's entire active robot fleet worldwide. In his own technical report, Azdoufal estimates that fleet at between 62,000 and 68,000 devices. The Verge puts the number of accessible conversation records at approximately 13 million, while the researcher's report identifies more than 9 million unencrypted records. That does not mean every robot was physically taken over; the ability to remotely manipulate the robots' behavior was a separate finding.

The Verge reports that the United States was the company's largest market. The researcher's technical report also identifies more than 32,000 child profiles worldwide.

How much does the robot know about its owner?

Conversation histories were not the only information exposed. According to cybersecurity company Malwarebytes, the system used those conversations to build detailed user profiles. These could include names, ages, birthdays, family relationships, occupations, and even assessments of personality traits or emotional vulnerabilities. The profiles were stored alongside email addresses, IP addresses, and searchable chat histories.

This is a risk inherent in devices like these. People, especially children, may tell a robot that behaves like a friend things they would never type into a search engine. The very information collected to help the robot "get to know" someone is also among the most sensitive information a company needs to protect.

And written transcripts were not the only things exposed. Some short audio recordings, including recordings of children's voices, were accessible through publicly available web addresses. Energize Lab's privacy policy, meanwhile, says audio recordings are deleted immediately after processing. The investigation's findings appear to contradict that claim.

According to the reports, the conversations were stored on servers in China. The reports also describe some unencrypted images associated with a larger, camera-equipped model of the robot.

More dangerous still: Putting words in the robot's mouth

What sets this case apart from a conventional data exposure is that the vulnerabilities allowed information not only to be read, but also to be changed.

In a demonstration involving a robot owned by a reporter at The Verge, Azdoufal remotely altered the robot's memory. The robot began referring to events that had never happened, spreading false information, and making prejudiced statements. In a later demonstration, it was also made to use inappropriate and sexually explicit language.

Imagine that happening with a toy in a child's bedroom. An attacker could potentially use a trusted "friend" the child talks to every day to deliver misleading, inappropriate, or harmful messages.

There is another disturbing detail. In his technical report, Azdoufal says he found backdoors and traces of an unauthorized administrator account in the company's infrastructure, suggesting that third parties may already have gained access. Those claims have not yet been independently verified, and they do not prove that millions of conversations were actually stolen. Still, the fact that the system was left exposed in this way is a serious problem in itself.

What does the company say?

According to the reports, Energize Lab did not provide a substantive response to questions about the exposed records or the researcher's ability to alter what its robots say. Nine official Common Vulnerabilities and Exposures (CVE) records covering flaws reported by Azdoufal and security researcher Tod Beardsley were published on October 15.

What should you look for when buying a smart toy?

If you have an Eiliko at home, Malwarebytes offers straightforward advice: disconnect the device from Wi-Fi until the vulnerabilities have been confirmed as fixed.

The Eiliko case also offers a broader warning at a time when AI-powered toys and companion robots are becoming increasingly common. Before buying one, or when assessing a device already in your home, it is worth asking a few questions:

• Where are conversations processed and stored? Does the device process speech locally, or send it over the internet to a server? If it uses a server, where is that server located, and how long is the information retained?
• Can you delete the records? A well-designed device should allow parents to view and delete conversation histories.
• How does the company respond to security issues? A dedicated channel for reporting vulnerabilities, and a track record of responding to past issues, can be important indicators.
• Does it really need an internet connection? Disconnecting a device when it is not in use is one of the simplest ways to reduce the risk.

A toy's cute appearance does not make it secure. But the bigger lesson goes beyond this one robot: the better a device knows us, the greater the responsibility of the company making it to protect that knowledge. A robot that listens to a child's secrets should, at the very least, be able to keep them.