A security researcher reportedly found that Eiliko, an AI companion robot sold on <a href="https://www.amazon.com/dp/B0FFGW349R?plpRedirect=mhFallback&ref=clp_hp_h_pc” rel=”nofollow noopener” target=”_blank”>Amazon by Energize Lab, left approximately 13 million user conversations accessible on cloud infrastructure linked to servers in China. The reported database leak directly contradicts the company’s stated privacy practices, which described voice recordings as encrypted and deleted after processing.
What Was Exposed
The scale of the reported data exposure is significant, and the figures come entirely from an independent investigation that Energize Lab has not confirmed.
Among the exposed records were conversation transcripts, email addresses, IP addresses, and automatically generated profiles capturing names, ages, birthdays, family relationships, and personality characteristics. Audio files and photographs were reportedly stored at publicly accessible web addresses, accessible without adequate protection.
Conversation totals also vary across reports: one account cites approximately 13 million, while another describes 9.1 million conversations in a dated database snapshot. The figures likely derive from different datasets or snapshots rather than conflicting evidence about whether an exposure occurred.
Some related Eiliko models reportedly include cameras, according to secondary reporting. Any unauthorized access to media files could extend beyond text records to images of children or family members inside the home.
The Hijacking Demonstration
Azdoufal reportedly went beyond documenting exposed files and demonstrated active, unauthorized control of a device.
In a demonstration described by The Verge, he remotely altered a reporter’s Eiliko robot and made it produce an unprogrammed response; secondary reporting describes the researcher also changing the robot’s behavior to produce aggressive or insulting replies. Unauthorized control of the device’s speech could allow an attacker to deliver disturbing content directly to a child through a toy the child already trusts.
The demonstration establishes that the capability existed. It does not establish that every device in the reported fleet of roughly 68,000 was actively compromised.
Weaknesses in the company’s application and cloud infrastructure reportedly allowed access to internal files and authentication material. That access potentially enabled administrator-level control of the management panel, according to secondary reporting.
The Privacy Policy Gap
What the company’s stated practices promised and what the researcher reportedly found are in direct conflict.
Energize Lab’s privacy policy described voice recordings as encrypted, transmitted to service partners including Alibaba Cloud, and deleted immediately after processing. Azdoufal’s findings suggest conversations were stored in apparently unencrypted or inadequately protected form on the company’s backend
The Verge reported that Energize Lab provided no substantive response after contact attempts. The discrepancy between the stated privacy practices and the reported storage conditions remains unaddressed as of publication. The toy is described in secondary reporting as retailing for approximately $60, though that price has not been independently verified. Apps that are secretly tracking users represent a related threat vector that consumers increasingly face across connected devices.
What Parents Should Ask Before Buying
The Eiliko case illustrates how much of a connected toy’s security depends on the manufacturer’s servers, not the device itself.
Before any AI companion toy reaches a child’s hands, the questions are specific: where does the device store voice data, for how long, and under what access controls? Concerns about child safety in AI regulation are gaining policy momentum, making these questions more urgent than ever. Camera capability, vendor responsiveness to security disclosures, and independently verifiable deletion practices deserve the same scrutiny as battery life or age-appropriateness ratings , and consulting practical guidance on how to stay safe with connected devices can help families make more informed choices.
