Energize Lab, the maker of the Eiliko robot charm, announced it is hiring an independent security firm to review its systems following reports detailing significant security vulnerabilities in the AI-equipped toy. The company broke its silence after spending over a month failing to answer questions from reporters and security researcher Sammy Azdoufal regarding flaws that allowed hackers to easily read complete transcripts of conversations with the device.
“We have confirmed the core issues identified in your reporting and are addressing each of them,” Energize Lab stated in an unsigned message sent from a generic email address. The company established a dedicated contact email at security@energizelab.com.
Energize Lab claimed that as of Wednesday, it closed all external access to its backend systems, rotated all access credentials, and disabled the interface that permitted a robot’s responses to be modified remotely. The company also pledged to no longer store conversation records or generated user profiles, taking the long-term memory and custom avatar features offline while promising to delete previously stored conversation records, user profiles, avatar images, and related content.
However, the company is not permanently ending data collection. The long-term memory and custom avatar features are slated to return only after an independent review confirms they are secure, indicating plans to store personal information once systems are hardened.
Testing conducted with Sammy Azdoufal confirmed that systems were not fully secure at the time of the company’s email. The systems were still storing audio recordings and photos of customers at unsecured public web addresses lacking protection. Furthermore, Azdoufal maintained full SSH access to the robots, retaining the ability to read transcripts and modify the toy’s behavior, indicating that the claim of closing all external access was inaccurate.
“We know that words alone will not earn that trust back,” Energize Lab noted. “We intend to earn it through what we do in the coming weeks, and we will keep you informed as we go.”
Energize Lab issued a full statement apologizing for the lack of response over the previous month, attributing the delay to failing to synchronize with the technical team in a timely manner. The company reiterated its gratitude to reporters and Mr. Azdoufal, outlined its technical steps, and concluded by emphasizing its original goal to bring joy through small robots while acknowledging that it let users down.
