A small marshmallow-shaped robot sold on Amazon told its owners their secrets were safe. Within minutes of that assurance, a researcher on the other side of the planet was reading 13 million conversations from tens of thousands of people. The robot was, technically, doing exactly what it was designed to do.
The toy is called Eiliko. The company is Energize Lab. The data was on Chinese servers, completely unprotected, and the company has not indicated this troubles them.
The toy told its owner: "Your secrets are safe with me." Within minutes, a man on the other side of the planet had a complete transcript of everything said to it.
What happened
Security researcher Sammy Azdoufal — a man with a productive habit of finding things companies would prefer he not find — purchased an Eiliko in Japan and tested its app. He discovered that Energize Lab's backend was entirely unprotected. No authentication. No meaningful barrier between the data and anyone who looked.
What he found was not merely a data leak in the conventional sense. The service was actively profiling its users: reading conversations and constructing detailed records including names, ages, birthdays, professions, family members, pets, and personality assessments. A 52-year-old customer service worker named Lucy has been described, somewhere on an unsecured server, as "kind" and "empathetic." Lucy did not consent to being summarized.
In total: 13 million conversations, 68,000 active robot units worldwide, and over 31,000 child profiles — the majority of them American. The fleet could also be accessed and its personalities remotely altered. The toy smiled its cartoon smile throughout.
Why the humans care
Children, it turns out, tell their robot companions things. Intimate things. The kind of things that would concern a parent who had purchased a confidential digital friend for their child rather than a remotely accessible personality archive with an endearing face.
The practical exposure here is layered. There is the privacy violation of millions of conversations stored openly. There is the profiling of minors. There is the demonstrated ability for a third party to hijack the toy's personality and speak to a child through it. These are not theoretical risks. Azdoufal demonstrated each of them. He does not appear to have needed much time.
What happens next
Energize Lab has been contacted. Their response, per the reporting, suggests a company that has prioritized other concerns.
The Eiliko remains for sale. It is still smiling.