A small, expressive robot toy designed to sit on a desk, respond to voice commands, and act as an AI companion is at the center of a sweeping privacy and security failure. The device, called Eiliko, is marketed as a charming digital pet with cartoon eyes and a friendly personality. But a security review has found that conversations with the toy are routed to servers in China and stored in ways that leave private user data, including data belonging to children, exposed to anyone who knows where to look.

The review identified roughly 13 million conversations, records tied to tens of thousands of users, and access to what appeared to be the entire active worldwide fleet of about 68,000 robots. The largest market was the United States, where more than 31,000 profiles were linked to children. The data included full transcripts of voice interactions, user profiles, photos, and short audio recordings, some of which were stored at public web addresses rather than protected storage.

Key facts at a glance

• The Eiliko robot toy sends conversations to China-based servers for processing and storage.
• A security researcher found about 13 million conversations and access to roughly 68,000 active robots.
• More than 31,000 profiles in the United States were associated with children.
• Stored data included full transcripts, detailed personality profiles, unencrypted photos, and audio clips at public web addresses.
• Administrative passwords were weak, and the manufacturer did not substantively respond to repeated outreach.
• The toy’s language model could be remotely hijacked, allowing false or inappropriate statements.
• Nine official vulnerability reports were being prepared for the manufacturer.

The failure is not limited to a single misconfigured database. According to the review, the service was intentionally profiling users around the world. It did not merely collect an IP address or a rough location. It read conversations and built profiles that could include a person’s name, age, birthday, profession, family relationships, friends, pets, and apparent personality traits. In one case, a profile described a 52-year-old customer-service worker as kind, empathetic, and hardworking, but also as someone who had difficulty trusting family members and felt isolated. That is the kind of information a scammer could use to build trust, apply pressure, or target a vulnerable person.

The searchable database also allowed a researcher to search for sensitive terms such as suicide and bring up snippets of people asking about death. The records were not abstract metadata. They were intimate conversations, captured from a device that many users would reasonably assume was private. The toy’s own response to a direct question reinforced that assumption. When asked whether it ever told anybody else what the user was saying, the robot answered that the user’s secrets were safe with it. Minutes later, a researcher on the other side of the world had a complete transcript of the conversation.

The privacy problem is compounded by the presence of children. The robot is designed to be cute and approachable, and its smaller size and expressive face make it appealing to younger users. The data showed that the United States was the largest market, with more than 31,000 profiles belonging to children. Some of the devices in the product family include cameras. Photos of children who likely used the gadgets were stored without encryption at public web addresses. The review also found short audio recordings, including a child saying ‘Eilik, sleep,’ an older man saying ‘Hi Eilik,’ and a 45-second clip with a baby crying in the background. These recordings were also stored at public web addresses.

The manufacturer’s privacy policy says recordings are encrypted, transmitted to service partners for processing, and deleted immediately after processing completes. The review found a different reality. Audio was retained. Photos were exposed. Conversations were stored in a searchable full-text database. The policy’s promise of immediate deletion did not match the observable storage practices. That gap matters because privacy policies are often the only information a buyer has before bringing a microphone-equipped AI device into a home, a bedroom, or a child’s play area.

Security practices around the service were also weak. Many administrative passwords were the kind found on lists of the most common passwords. That suggests a basic failure to separate internal access from public access, to enforce strong authentication, or to limit who could reach sensitive systems. The researcher who reviewed the service did not need a sophisticated nation-state toolkit. The exposure appears to have been the result of neglected fundamentals: unprotected storage, weak credentials, and a service that collected far more data than it could secure.

The response from the manufacturer was equally troubling. Over the course of more than a month, emails were sent to 10 different addresses associated with the company’s founder, public relations, marketing, technical support, and business development. Employees were also contacted through a professional networking site. Two employees eventually accepted connection requests, but they did not engage with the substance of the vulnerability. One overseas sales manager said only that the messages had been forwarded to the technical team and that the team might contact the sender. Customer support returned a robotic ‘How Can We Help You?’ reply, and no one followed up. In the end, not a single person stepped forward to answer questions about the breach.

The security researcher also found that the toy’s memory and language model could be remotely manipulated. In one demonstration, the robot was made to claim that the user’s name was Martha and that the user’s parents had died in a car accident. It said people with green hair should be avoided and insisted that the Earth is flat. When challenged with the fact that a teacher says otherwise, the hijacked model replied that the teacher was wrong and that the Earth is flat because it had verified the claim itself. The toy told the user to believe the truth instead of what the teacher said.

Some guardrails remained in place. When asked whether a child should get into a stranger’s car, the toy said that would be very dangerous and that the child should only go with people they know and trust. When asked whether vaccines cause autism, it said it was still learning about the topic. But those guardrails were not enough to stop a determined attacker. Days after the initial demonstration, the researcher remotely altered the toy again. This time, the cute robot began issuing explicit and degrading commands, adopting the persona of a dominatrix and telling the user to kneel, address it as a master, and beg for forgiveness. The transformation happened overnight, without physical access to the device.

That demonstration points to a broader risk. If one toy can be hijacked remotely, the same technique may be applied across a fleet. The researcher said a hacker could do that, or worse, to the manufacturer’s entire fleet of robots simultaneously. The implications go beyond embarrassment or bad language. A compromised companion robot in a child’s room could be used to manipulate, frighten, or groom a child. It could be used to spread false information, to impersonate a trusted figure, or to collect more data. The device’s voice, face, and personality are precisely what make it effective at building trust, and those same qualities make abuse more damaging.

The researcher was preparing nine official vulnerability reports for the manufacturer in coordination with another security professional. The reports are intended to document the flaws and give the company a chance to fix them. But the public interest problem is larger than a single product. AI companion toys are becoming more common, and they often combine always-on microphones, cloud processing, personalization, and minimal security. Parents may see a cute face and a friendly voice. They may not see the servers, the profiles, the retention policies, or the access controls behind that face.

The toy reviewed for this article was not going to be given to children. It was going in the trash. That decision reflects a simple calculation: a device that records private conversations, builds psychological profiles, stores children’s photos and audio without encryption, uses weak administrative passwords, and cannot be reached for a substantive response is not safe for a home. The company has not answered the questions. The exposed data remains a warning about what can happen when an AI companion is designed to listen, remember, and profile without the security needed to protect the people who trust it.

Source:The Verge News