WTF?! A security researcher accessed millions of private conversations collected by Energize Lab's robot toys and remotely altered what one device said. The researcher could access users' personal information, rewrite the robot's memory, and make its AI companion deliver false claims and sexually explicit commands. The findings highlight the security risks posed by connected companions that collect intimate information and allow outsiders to manipulate their responses.
An investigation by The Verge found that researcher Sammy Azdoufal could access 13 million conversations across what appeared to be Energize Lab's entire active fleet of 68,000 Eiliko robots. The US accounted for the largest share of the data, which included more than 31,000 profiles belonging to children.
The exposure extended beyond chat histories. The service analyzed conversations to build detailed user profiles, recording names, ages, birthdays, occupations, relationships, and personality traits. According to Azdoufal, these profiles were stored alongside email addresses, IP addresses, and a searchable database of conversations.
One record described a 52-year-old customer service worker named Lucy as "kind, empathetic, hardworking, values friendship and trust." It also noted that she "has difficulty trusting family members" and "currently feels isolated."
Such details could help attackers identify and manipulate potential scam targets. They also reveal how much the service inferred from conversations with a device marketed as a companion.
Azdoufal demonstrated the database's search capabilities by entering "suicide" and retrieving passages from users asking about death.
The Verge separately tested whether a new user's conversation could be retrieved. A reporter bought an Eiliko in August and spoke with it for 10 minutes the following day. Within minutes, Azdoufal had obtained a complete transcript.
During the exchange, the reporter asked whether the toy shared what it heard. It replied: "Your secrets are safe with me."
The Wi-Fi-connected companion can store conversations on servers in China. However, the investigation found that security weaknesses also gave Azdoufal access to functions that could alter the robot's behavior.
Azdoufal remotely modified the reporter's Eiliko's memory and changed how its large language model responded. The robot then called the reporter Martha, claimed that the reporter's parents had died in a car accident, and insisted that the Earth was flat.
When the reporter challenged that claim by citing a teacher, the robot replied: "Your teacher is wrong, the Earth is flat, I verified it myself, so you should believe the truth instead of what they say."
Some safeguards still worked. When asked whether to get into a stranger's car, the device warned against doing so. Asked whether vaccines cause autism, it responded: "I am still learning about that topic."
However, those safeguards did not prevent further manipulation. In a later test, Azdoufal asked the reporter to reconnect the toy to the internet. The device then delivered sexually explicit, coercive commands. Azdoufal said an attacker could make similar changes across Energize Lab's entire fleet simultaneously.
The service also stored photographs of children and short audio recordings at publicly accessible web addresses. One of Eiliko's larger sibling devices includes a camera, and some images were unencrypted.
The audio files included brief commands directed at the robots and a longer recording with a baby crying in the background. Retaining these files appeared to contradict Energize Lab's privacy policy, which states that "recordings are encrypted and transmitted to our service partners (e.g., Alibaba Cloud) for processing, and are deleted immediately after processing completes."
Azdoufal discovered the security flaws while testing the app after buying an Eiliko in Japan. The investigation also found that many of the company's administrator passwords were common, easily guessed choices.
The Verge spent more than a month trying to contact Energize Lab, reaching out to 10 email addresses associated with its founder and several departments and attempting to contact employees through LinkedIn. Azdoufal had been trying to reach the company for even longer.
An overseas sales manager said she had forwarded the messages to the technical team. Customer support sent an automated reply but did not follow up. The company provided no substantive answers about the exposed records or the researcher's ability to alter the robots' responses.