WTF?! A security researcher accessed millions of private conversations collected from Energize Lab’s robotic toys and remotely changed a device’s statement. The researcher could access users’ personal information, rewrite the robot’s memory, and make its AI companion transmit false claims and sexually explicit commands. The findings highlight the security risks posed by networked companions that collect sensitive information and allow outsiders to manipulate their responses.
An investigation by The Verge found that researcher Sammy Azdoufal was able to access 13 million conversations across what appears to be Energize Lab’s entire active fleet of 68,000 Eiliko robots. The United States accounted for the largest share of data, including more than 31,000 profiles of children.
The awareness went beyond chat history. The service analyzed conversations to create detailed user profiles, recording names, ages, birthdays, occupations, relationships and personality traits. According to Azdoufal, these profiles were stored along with email addresses, IP addresses and a searchable database of conversations.
In one recording, a 52-year-old customer service representative named Lucy was described as “kind, sensitive, hard-working, values friendship and trust.” It was also noted that she is “having difficulty trusting family members” and is “currently feeling isolated.”
Such details could help attackers identify and manipulate potential fraud targets. They also show how much the service was able to glean from conversations with a device marketed as a companion.
Azdoufal demonstrated the database’s search capabilities by entering “suicide” and retrieving passages from users asking about the death.
The Verge separately tested whether a new user’s conversation could be retrieved. A reporter bought an Eiliko in August and spoke to her for ten minutes the following day. Within minutes, Azdoufal had received a complete report.
During the exchange, the reporter asked if the toy was relaying what it was hearing. It replied, “Your secrets are safe with me.”
The Wi-Fi connected companion can store conversations on servers in China. However, the investigation found that security flaws also gave Azdoufal access to features that could alter the robot’s behavior.
Azdoufal remotely altered the reporter’s Eiliko memory and altered the response of his large language model. The robot then called reporter Martha, claiming that the reporter’s parents had died in a car accident and insisting that the Earth was flat.
When the reporter questioned this claim, citing a teacher, the robot replied: “Your teacher is wrong, the earth is flat, I checked it myself, so you should believe the truth instead of what they say.”
Some security measures still worked. When asked whether you should get into a stranger’s car, the device warned against it. When asked whether vaccinations cause autism, the company replied: “I’m still learning about this topic.”
However, these protective measures did not prevent further manipulation. In a later test, Azdoufal asked the reporter to reconnect the toy to the Internet. The device then transmitted sexually explicit coercive commands. Azdoufal said an attacker could simultaneously make similar changes across Energize Lab’s fleet.
The service also stored photos of children and short audio recordings at publicly accessible web addresses. One of Eiliko’s larger sibling devices has a camera and some images were unencrypted.
The audio files included short commands directed at the robots and a longer recording with a baby crying in the background. Retaining these files appeared to conflict with Energize Lab’s privacy policy, which states: “Records are encrypted and transferred to our service partners (e.g. Alibaba Cloud) for processing and are deleted immediately upon completion of processing.”
Azdoufal discovered the security flaws while testing the app after purchasing an Eiliko in Japan. The investigation also found that many of the company’s administrative passwords were common and easy to guess.
The Verge spent more than a month contacting Energize Lab by contacting 10 email addresses belonging to the founder and several departments and attempting to contact employees via LinkedIn. Azdoufal had been trying to reach the company for some time.
An overseas sales manager said she forwarded the news to the technical team. Customer support sent an automated response but didn’t follow up. The company did not provide any substantive answers about the records disclosed or the researcher’s ability to change the robots’ responses.
