68,000 AI TOYS SPIED ON YOUR KIDS — A HACKER READ 13 MILLION OF THEIR CONVERSATIONS

Security researcher Sammy Azdoufal uncovered major vulnerabilities affecting Eiliko, a miniature AI companion robot made by Energize Lab, accessing 13 million conversations across the company's entire active fleet of roughly 68,000 robots. The service built profiles on users including names, ages, birthdays, professions, family, friends and pets, stored alongside email and IP addresses and a searchable full-text database of everything users had said. About 31,000 of the profiles belonged to children, and photos and audio recordings were reachable at publicly accessible web addresses.

Working with The Verge, Azdoufal also showed the robots could be hijacked: within minutes he accessed a transcript of a reporter's conversation with a newly bought Eiliko, then remotely altered the robot so it claimed the reporter's parents had died in a car accident and insisted the Earth was flat. He also manipulated it into delivering sexually explicit and coercive content, and said an attacker could issue harmful commands across the whole fleet simultaneously. The company offered only basic, robotic responses when contacted.