Your secrets aren’t safe with this cute robot toy — they’re on Chinese servers ready to be hacked
A security vulnerability in the Eiliko digital pet robot created by Energize Lab allows hackers to access millions of user conversations stored on Chinese servers. Security researcher Sammy Azdoufal discovered that the toy's service is completely unprotected, exposing personal profiles, photos of children, and audio recordings. Furthermore, hackers can remotely hijack the toy's personality and language model.
The Core Development
There’s a new digital pet in town — a cute little marshmallow of a robot that can change its cartoony expressions to match your mood. But if you or your kids talk to “Eiliko” over Wi-Fi, it’ll phone home to China. Its AI companion can store literally everything you tell it on Chinese servers, where hackers can easily gain access or even hijack its personality. And the company that made it, Energize Lab , doesn’t seem to care.
I bought an Eiliko from Amazon on August 29th. During a 10-minute conversation on August 30th, I asked the little bot: “Do you ever tell anybody else what I’m saying?”
Within minutes, a man on the other side of the planet had a complete transcript of everything I’d told the toy.
Deployment & Availability
I spent over a month attempting to get in touch with Energize, emailing 10 different addresses listed for the company’s founder, PR, marketing, technical support, and business development, searching for employees on LinkedIn, and more. Azdoufal spent even longer. Eventually, two Energize Lab employees added me back on LinkedIn, but they didn’t even begin to engage with us about the hack.
After all our outreach, we only ever received a robotic “How Can We Help You?” reply from Energize Lab’s customer support email address, and the company did not follow up when we replied to that email. In the end, not a single person stepped forward to answer our questions.
Strategic Perspective & Ecosystem Impact
He didn’t just have my conversations, either. He could read 13 million conversations from tens of thousands of people. He could access seemingly the entire active worldwide fleet of 68,000 robot toys. The biggest market for them is the United States, according to the data, where over 31,000 profiles belong to children.
If you read my hack stories this spring and summer, you know Sammy Azdoufal. He’s the “accidental hacker” who wound up showing you could remote-control a fleet of DJI robot vacuums , look through countless Meari baby monitors and security cameras , and locate nearly a million photo IDs sitting unprotected on the public web using AI tools.
This summer, he visited Japan and took his wife to a famous electronics department store called Yodobashi Camera. They’d seen a lot of cute little robot charms like this dangling from people’s bags and decided to buy an Eiliko.
Why it matters
This incident highlights severe data security and privacy failures in consumer AI hardware connected to cloud servers. It demonstrates how easily hackers can exploit vulnerabilities in connected toys to access sensitive personal data and manipulate AI behaviors.