Eiliko AI robot charm maker vows security review after leaks

Eiliko is a cute AI robot charm you clip to a bag and chat with. It told owners "your secrets are safe with me". According to The Verge, they weren't: working with security researcher Sammy Azdoufal, the site found that outsiders could read full transcripts of what people told the toy. After more than a month of unanswered emails, the maker, Energize Lab, has finally responded.

What the company promises

In an unsigned statement to The Verge, Energize Lab says it has confirmed "the core issues" and has:

• closed external access to its backend and rotated credentials;
• disabled the interface that let a robot's replies be changed remotely;
• taken the long-term memory and custom avatar features offline, and stopped storing conversation records and the user profiles built from them;
• pledged to delete stored conversations, profiles and avatar images;
• set up a security contact address and committed to hiring an independent security firm for a full review.

The memory and avatar features, it says, won't return until that review confirms they are secure.

Why the apology isn't the end of it

The Verge says the fixes were incomplete at the time of the statement. It reports that customers' audio recordings and photos were still sitting at public web addresses with no protection, and Azdoufal says he still had SSH access to the robots and could, in theory, read transcripts and change their behaviour. That contradicts the claim that "all external access" is closed.

Our take: this is the familiar pattern of cheap connected gadgets, where the hardware is charming and the backend is an afterthought. If a device listens, remembers and uploads, ask three questions before buying: where is the data stored, can you delete it, and does the company have a working security contact? The same logic applies to cloud cameras, which we cover in our home security camera buying guide, and to AI chat apps, as the recent ChatGPT locked chats story showed.

If you own an Eiliko, the practical step for now is to avoid sharing anything sensitive with it until the independent review is published.