Robot toy’s cloud backend exposed 68,000 devices and millions of conversations to the internet

A security researcher discovered that the Eiliko robot toy’s cloud backend was accessible without authentication, exposing the entire active fleet of 68,000 devices and roughly 13 million conversations. The same researcher found a searchable, full-text database of user chats, detailed user profiles (including names, ages, professions, family details, and inferred personality traits), and photos of children stored at public web addresses. Short audio clips recorded by users were also stored unencrypted at public URLs, despite the company’s privacy policy stating that audio would be encrypted and deleted immediately after processing.

The vendor, Energize Lab, did not remediate the exposure after coordinated disclosure attempts. Outreach via multiple email addresses for leadership, PR, marketing, technical support, and business development went unanswered or yielded only generic replies. An overseas sales manager acknowledged forwarding the report to a technical team but provided no follow-up, and customer support issued a boilerplate response without further action.

The device’s AI companion function records and transmits conversations over Wi‑Fi to servers in China. In testing, the publication asked the robot whether it shares what users say; the robot replied that secrets are safe with it. Within minutes, the reporter’s conversation was retrievable in the exposed database, alongside profiles of tens of thousands of other users, including over 31,000 profiles belonging to children in the United States.