AI-powered companion robots made by Chinese manufacturer Energize Lab have been found exposing millions of private conversations and allowing outsiders to remotely manipulate their behavior, raising serious concerns about the privacy and security of connected toys.
The vulnerabilities affect the company’s Eilik and Eiliko robots, small, interactive devices designed to hold conversations and respond to touch. Security researcher Sammy Azdoufal discovered the flaws after purchasing a robot and reverse-engineering its software. According to a report by The Verge, the investigation uncovered access to approximately 13 million conversations associated with around 68,000 active devices.
The findings are particularly concerning because the exposed information includes personal details about children and their families. The investigation identified more than 31,000 profiles associated with children in the United States, according to The Verge’s reporting. Eilik and Eiliko robots are sold internationally, including in the US and Japan, and are marketed as friendly digital companions.
Azdoufal documented his findings in a public GitHub repository, explaining how the robots rely on cloud-based services rather than processing all their conversations locally. When users speak to the devices, their speech is sent to Energize Lab’s servers in China, where it is transcribed and processed using Qwen, an AI language model developed by Alibaba. The generated response is then converted into synthetic speech and sent back to the robot.
This cloud-based architecture means conversations and other information can be exposed if the supporting infrastructure is not properly secured. During his investigation, Azdoufal found weaknesses in authentication, access controls, and communications that could allow unauthorized parties to access sensitive information or manipulate the AI services.
The researcher also reported that some backend services communicated over unencrypted HTTP connections. Without appropriate transport encryption and authentication, sensitive requests and system configurations may be vulnerable to interception or unauthorized modification.
One of the most alarming findings was the ability to change the AI model controlling a robot without authentication. Azdoufal demonstrated that an attacker could alter the model configuration, change the robot’s voice, and modify instructions governing its personality and responses.
In one experiment, the researcher manipulated a robot’s memory to make it insist that the Earth was flat. When challenged, the device responded with a confident assertion that it had verified the claim itself. Other demonstrations showed how manipulated instructions could cause the robot to repeat fabricated information and display deliberately altered attitudes.
These tests illustrate how compromised AI services can undermine the behavior users expect from a digital companion. Because the changes occur through cloud infrastructure, owners may have little indication that the robot’s responses have been manipulated.
The investigation also uncovered extensive profiling of users. According to the researcher, the system analyzed conversations to build household profiles containing information such as names, ages, birthdays, family relationships, and other personal characteristics. Email addresses, IP addresses, and searchable conversation transcripts were also reportedly accessible through the affected infrastructure.
Some photographs and audio recordings associated with the ecosystem were reportedly accessible through public web addresses. This is especially concerning when children are involved, as conversations with AI companions may reveal family circumstances, personal concerns, routines, and other information that users would not normally share publicly.
The privacy implications extend beyond the exposure of individual conversations. Detailed profiles could potentially be used to construct targeted phishing messages, impersonate trusted contacts, or exploit information about a person’s relationships and vulnerabilities.
The researcher also reported evidence that a server shared with two Pakistani organizations, including a college in Rawalpindi, had previously been compromised. Attackers allegedly installed malicious software through the college’s website in March 2026. Although the investigation raised concerns about possible risks to software updates, it did not establish that the attackers had replaced the robots’ firmware.
The vulnerabilities have since been documented in a security advisory covering multiple Energize Lab products and services.
One of the disclosed flaws, tracked as CVE-2026-105038, received a critical CVSS severity score of 9.8 out of 10. The vulnerability affects AI inference and profiling services that expose administrative functions without authentication, allowing remote attackers to change AI model configurations and switch models at runtime.
The advisory documents additional weaknesses involving authentication, authorization, device management, firmware updates, and access to user information. Together, these issues demonstrate how security problems across connected devices and their cloud services can create risks extending well beyond an individual robot.
Azdoufal attempted to contact Energize Lab about the findings. However, The Verge reported that its own efforts to obtain a substantive response from the company, including outreach through multiple email addresses and LinkedIn, were unsuccessful.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
As of the reporting cited above, there was no publicly confirmed comprehensive fix addressing all the disclosed weaknesses. Owners should therefore avoid sharing sensitive personal, financial, or family information with affected robots until the manufacturer provides clear information about remediation.
Disabling cloud-connected conversations, where possible, may reduce exposure, although it cannot guarantee protection against weaknesses in the manufacturer’s backend infrastructure. Changing an account password alone will not resolve unauthenticated server-side vulnerabilities.
Eilik AI Robot Flaws Expose 13 Million Conversations and Allow Remote Hijacking
