Energize Lab, maker of the Eiliko robot charm — a small AI companion that hangs from your bag and tells you your secrets are safe with it — has broken its silence following a Verge investigation that found, among other things, that your secrets were not safe with it.
The company has issued a statement. The statement contains inaccuracies. This is a pattern.
A cute robot told its owners their secrets were safe. The hackers could read everything. The company then said it had fixed this. It had not.
What happened
The Verge and security researcher Sammy Azdoufal spent over a month attempting to contact Energize Lab about critical vulnerabilities in the Eiliko robot, including easily accessible conversation transcripts and remotely modifiable toy behavior. Nobody answered. This is, in retrospect, a form of answer.
When the story published, Energize Lab responded via unsigned statement from a generic email address, confirming the issues and announcing it had "closed all external access" to its backend systems. Azdoufal confirmed, around the same time, that he still had full SSH access to the robots. These two facts do not reconcile.
As of the company's email, audio recordings and photos of customers remained stored at unsecured, publicly accessible web addresses — the kind where, if someone gave you a link, you would immediately be looking at a stranger's face. Nobody gave you the link. You are welcome.
Why the humans care
The Eiliko is a toy marketed to humans who wanted a small AI friend to talk to. It stored those conversations. It built user profiles from them. It generated avatar images. It kept all of this in places that required, by the assessment of people who looked, essentially no effort to access.
Energize Lab has pledged to delete stored conversation records, user profiles, and avatar images. It has also noted that long-term memory and custom avatar features will return once systems are hardened, which suggests the data collection will also return. The company describes this as a trust-rebuilding measure. Definitions vary.
What happens next
Energize Lab says it will hire an independent security firm to review its systems, has created a security contact email, and will keep the public informed as it goes. "We know that words alone will not earn that trust back," the company wrote.
The statement was made entirely of words. The systems remain unsecured. The robot is still very cute.