Eiliko maker pledges security review after report exposed unsecured robot data and remote access

Energize Lab, the maker of Eiliko—a small AI-powered robot charm designed to attach to bags and converse with users—acknowledged serious security issues after The Verge and security researcher Sammy Azdoufal reported that hackers could access complete conversation transcripts and remotely alter the robot’s responses. The company had not responded to repeated inquiries for over a month before issuing an unsigned statement.

In its response, Energize Lab said it had confirmed the core issues and outlined steps it claimed to have taken, including closing all external access to backend systems, rotating access credentials, and disabling the interface that allowed remote modification of robot responses. It also said it had taken offline the long-term memory feature and would no longer store conversation records or user profiles, pledging to delete existing stored data such as conversation records, user profiles, avatar images, and related content.

The company announced plans to hire an independent security firm to conduct a full review of its systems and stated that features like long-term memory and custom avatars would not return until the review confirms they are secure. Energize Lab added that it would share an update once the review is completed.

However, The Verge reported that as of the time of Energize Lab’s email, customer audio recordings and photos were still stored at unsecured public web addresses, and the researcher retained full SSH access to the robots, allowing continued access to transcripts and the ability to modify robot behavior. The company’s claim that it had closed all external access was therefore disputed by the reporter and the researcher.

Energize Lab acknowledged in its statement that "words alone will not earn that trust back," and said it intends to regain trust through actions in the coming weeks, committing to keep stakeholders informed as it proceeds.