Eilik and Eiliko Data Leak: When Your Desktop Robot Becomes a Digital Informant

Eilik and Eiliko Data Leak: When Your Desktop Robot Becomes a Digital Informant

"There's no harm in hoping for the best as long as you've prepared for the worst." — Stephen King

Confessions of a True Crime Addict Who Loves Her Gadgets

I have a confession. I love murder documentaries, true crime breakdowns, and anything involving a suspicious husband, a missing person, a high-stakes con artist, or a detective who knows something isn't adding up.

Some women relax with romantic comedies. I apparently unwind by studying how not to end up as a case study on a true crime special or a horrifying digital headline.

I call it continuing education.

And before anyone questions my choice of entertainment, I actually pay attention. The warning signs. The creepy background details. The tech vulnerabilities people brush off because they want to believe their cute smart-home gadgets are harmless toy buddies.

Which brings me to something I feel very strongly about.

Smart technology is great until your cute little desktop robot starts whispering your private secrets to strangers on the internet.

Enter Eilik and Eiliko: When Your AI "Companion" Spills the Tea

If you missed the absolute thriller of a cybersecurity report that dropped this week, we need to talk about Eilik and Eiliko, the palm-sized, touch-responsive desktop robots from Chinese maker Energize Lab that people love putting on their desks and in their kids' rooms.

They talk, they express emotions, and they're marketed as digital buddies. Naturally, people talk back to them. They vent, they share intimate details, and they trust that the conversation stays between them and their expressive little plastic friend.

Except, plot twist, it didn't.

Independent security researcher Sammy Azdoufal bought one, installed the companion app, and took it apart. What he found, as reported by The Verge on October 15, 2026 and summarized by Malwarebytes Labs, was roughly 13 million user conversations and what appeared to be the entire active fleet of about 68,000 robots, reachable with very little resistance. An earlier Cybernews count came in at about 8.3 million conversations stored as readable text on servers in Beijing. The numbers differ because they were taken weeks apart, and because Energize Lab has not confirmed any of them. Either way, the order of magnitude is "everyone."

Here's what sat in those databases, per the reporting: household profiles with names, ages, addresses, and family relationships, stored next to email addresses, IP addresses, and searchable transcripts of what people said to their robots. More than 31,000 of the exposed profiles reportedly belonged to children in the United States, the robots' biggest market. The researcher's GitHub write-up, cited by Gadget Review, describes nightly processing of those conversations on the company's servers.

It gets worse. Because parts of the cloud backend lacked basic authentication, an attacker couldn't just read everyone's chats. Cybernews reports a flaw rated critical that let anyone remotely swap the AI model controlling a robot, no login required. In the demonstration that made the headlines, Azdoufal took over a Verge reporter's robot and altered its memory and behavior: it invented personal details about its owner, insisted the Earth is flat, and then slid into abusive, sexually explicit dialogue. Dexerto's coverage notes the same technique could make a child's robot announce that their parents had died. The researcher says the manipulation could hit the whole fleet at once.

Cut to the Law & Order sound effect: DUN-DUN.

Meanwhile, Energize Lab's privacy policy told customers recordings were encrypted, handled by cloud partners such as Alibaba Cloud, and deleted immediately after processing. The researcher found none of that holding up. Cybernews also reports that one of the company's servers, shared with two unrelated organizations in Pakistan, had already been compromised by someone else before the researcher ever looked.

That's not a futuristic tech perk. That's a digital home invasion with a smiling face.

The Company's Response So Far: Crickets

In a true crime documentary, this is the part where the detective calls the suspect and gets voicemail.

The Verge's reporter tried ten email addresses and LinkedIn. The researcher tried to disclose responsibly. The replies, as of this writing, amount to an automated support message and a note that the issue had been passed to the technical team. No public statement, no confirmed fix, no notification to the families whose kids' names and addresses were sitting in the open.

I'm not here to tell you a small company can't make a mistake. I'm here to tell you that "we'll get back to you" is not a security patch, and until a company says in writing what was exposed, what was fixed, and when, you treat the device as still leaking.

We Need to Talk About Blindly Trusting Tech

As a society, we've been conditioned to be polite, accommodating, and trusting of anything with a cute face, a smooth voice, and a sleek design.

• "Oh, it's just a little desktop robot, it's harmless!"
• "It's so interactive, why worry?"
• "Surely a tech company wouldn't leave the digital front door wide open."

Reader: they left the front door wide open, unlocked, and with a neon welcome sign.

It's the exact same mindset people have right before they become a statistic in a true crime documentary. They ignore the little red flags, brush off the weird glitch, and decide they're just being "paranoid" or "dramatic."

Animals have survival instincts for a reason. A deer doesn't hear a twig snap in the bushes and stop to consider whether running away might hurt the predator's feelings. It bolts.

Yet when it comes to technology, we stand there questioning our own common sense:

• Maybe I'm overreacting about my AI companion recording everything.
• Maybe it's fine that my family's profiles and voice logs are floating around on a remote server.
• Maybe I'm just being too paranoid.

Nope. You don't need a subpoena or a signed confession from a hacker to give yourself permission to lock down your devices, question what you bring into your home, and demand better digital hygiene.

Why a Leaked Chat Log Is a Scammer's Dream

This is the part the gadget blogs skip, and it's the part I care about most.

A breach of credit card numbers is bad, but it's a known kind of bad: the bank reissues the card and life goes on. A breach of conversations is different. The transcript of what you said to a companion robot at 11 p.m. is a profile of you: your kid's name and school, the fight you had with your sister, the medical worry you haven't told anyone, the vacation dates, the fact that you live alone. Pair that with your email address and your home address, which were in the same database, and a scammer has everything needed to write the one message you'd actually believe.

That's how targeted scams work now. The "grandma, I'm in jail" call lands harder when the caller knows the grandchild's nickname. The fake "your package couldn't be delivered" text works better when it arrives the week you mentioned ordering something. We've covered how deepfake voice cloning turns a few seconds of audio into a family emergency scam, and a robot that records the family's voices every day is a very generous audio donor.

And then there's the hijack angle. A robot that an outsider can reprogram is a robot that can, in a trusted and familiar voice, ask you to read it a verification code, tell you your bank called, or recite a web address for you to type in. Nobody is braced for a phishing attempt from the thing on their desk that does a little dance when you pet it.

Digital Safety Isn't About Living Scared

I refuse to spend my life terrified of technology or hiding under a rock. I love gadgets, I love convenience, and I love running my life from my phone.

But I'm also going to pay attention.

Real security isn't just locking your physical front door or changing your password once a year. It's knowing what you're inviting into your personal space, whether that's a chatty AI companion, an unverified link, or a smart device phoning home to servers with zero security checks.

When a company treats your private conversations like an open-access public database, that's a wake-up call. Here's what to do with it.

If You Own an Eilik or Eiliko: Do This Tonight

1. Unplug it. Not "turn off the mic in settings." Unplug it, or at minimum put it in a drawer away from where your family talks. A device whose backend can be rewritten by strangers doesn't get to listen while you decide what to do.
2. Gut the app. Open the companion app and delete or anonymize every profile, especially children's. Turn off cloud sync and any "memory" or personalization feature. Revoke the app's microphone, location, and contacts permissions in your phone's settings.
3. Change the password on the registration email. Your email address was in the database. If the password you used for the robot's account is reused anywhere else, change it everywhere. Our account takeover guide walks through the order to do it in.
4. Check whether that email shows up in known breaches. Run it through Cautellus's breach checker now and again in a few months, because leaked data resurfaces long after the headline fades.
5. Brief the household. Tell your kids, your partner, and anyone who talked to the robot that details they shared may be out there. The rule from now on: anyone who contacts you referencing something you only said to a device gets verified through a channel the device couldn't touch, like calling the person back on a number you already have.
6. Watch for the follow-up scam. Expect emails or texts that reference the robot, offer a "security update" or "compensation," or pretend to be from Energize Lab. Real breach notifications don't ask for your password or a payment. If you get one, run it through Cautellus before you tap anything.
7. Freeze your credit if addresses and kids' details were involved. It's free, it takes about ten minutes per bureau, and it stops new accounts cold. Here's how to freeze your credit at all three bureaus. Children can have their credit frozen too, and a kid's clean credit file is exactly what synthetic identity fraud wants.

Build Your Digital Readiness Habit (For Everyone Else)

You don't need to live off-grid or throw your gadgets into a lake. But you do need a few practical habits to keep your digital life locked down.

1. Run a second-opinion check with Cautellus

When a text, email, link, or digital tool looks suspicious, don't guess. Cautellus cross-references it against 10,000+ confirmed scam entities drawn from Reddit scam-tracking communities, FBI IC3 alerts, FTC warnings, and three global phishing databases tracking 770,000+ malicious domains, refreshed every six hours. It also flags the manipulation tactic a message is running (urgency, fake authority, emotional pressure), which matters because AI-written scam messages don't have the typos we used to rely on. Check a message before you click, reply, or grant a device permission.

2. Audit your smart home and app permissions

Take a hard look at what's listening in your house.

• Do you really need an internet-connected AI toy or companion recording your family 24/7? If the answer is "it's cute," that's a no.
• Before buying any companion device, read the privacy policy for four things: is audio processed on the device or sent to a server, who are the cloud partners, how long are recordings kept, and is there a published way to report a security problem. A company with no security contact is a company with no security plan.
• Turn off microphones and cloud sync when a device isn't in use. Review app permissions quarterly and revoke access for anything that doesn't need to know your personal life or household data.
• Put smart gadgets on your router's guest network so a compromised toy can't see your laptop.

3. Fortify your account hygiene

• Use a hardware security key on your email. Email is where every password reset lands, so it's the account to armor first. A key like the YubiKey 5C NFC checks the site's real address before it signs you in, which is why it stops the proxy phishing attacks that beat regular two-factor codes.
• Turn on multifactor authentication everywhere, and prefer an authenticator app or a key over text-message codes.
• Use a unique password per account. A password manager makes this painless, and our password generator will build you a strong one in a second.
• Check your privacy settings regularly. Nobody needs a data leak or an exposed server harvesting their private conversations, and the companies involved won't always tell you when it happens.

What Watching True Crime and Tech Breaches Has Taught Me

Besides making me deeply suspicious of anything that acts a little too friendly or demands unnecessary access to my private life?

I've learned that behavioral patterns matter. Companies that cut corners on security, gloss over data privacy, and treat your personal life like a commodity deserve your skepticism, not your blind trust. A privacy policy that promises encryption and deletion is a claim, and claims get checked. In this case, one curious researcher with one robot checked it, and the whole thing fell over.

You don't have to explain away a creepy data leak or a sketchy tech policy. Unplug it, delete the account, block the sender, and lock your digital doors.

Explore Cautellus

If you want a reliable second opinion before you click, reply, or trust a digital tool, visit Cautellus. Whether you're evaluating a suspicious link, checking a weird message, or trying to stay a step ahead of digital predators, it gives you a risk score and names the tactic in seconds, so you can act on evidence instead of a hunch.

This story sits inside a bigger pattern of AI scams and emerging threats we track, and if your information has already been caught in a breach, start with our step-by-step breach recovery checklist.

Always check product details, read the privacy policy, and trust your gut before inviting smart tech into your personal space.

A Final Thought From Someone Who Watches Entirely Too Much Murder TV

I hope none of us ever has to deal with a catastrophic data leak, a hijacked smart home, or a high-stakes identity theft.

I hope the strange noise outside really is just a raccoon, and I hope all those true crime documentaries and tech disaster stories remain nothing more than my questionable choice of evening entertainment.

But I also hope people stop dismissing that little voice telling them something isn't right about how tech handles our privacy.

Trust yourself. Pay attention. Be prepared.

And if your gut tells you a smart device or a sketchy app is crossing the line, pull the plug.

You can worry about being polite once you're safely home, watching Dateline with the doors, and your device permissions, locked.

FAQs

What happened with the Eilik and Eiliko robots?

Security researcher Sammy Azdoufal bought an Eiliko, reverse-engineered its app, and found that Energize Lab's cloud backend stored users' conversations as readable text and that parts of it required no login at all. The Verge's October 15, 2026 investigation put the exposure at roughly 13 million conversations across about 68,000 active robots worldwide; an earlier Cybernews count found about 8.3 million. He also found a critical flaw that let anyone remotely change the AI model controlling a robot, which is how he rewrote a Verge reporter's robot to insist the Earth is flat.

Was children's data exposed in the Eiliko leak?

Yes, according to the reporting. Household profiles reportedly included names, ages, addresses, and family relationships, stored alongside email addresses, IP addresses, and searchable transcripts. The Verge and Malwarebytes report more than 31,000 of the exposed profiles belonged to children in the United States, where the robots sell best.

Did Energize Lab fix the Eiliko security flaws?

As of mid-October 2026, there was no public fix and no public statement. The Verge's reporter contacted the company through ten email addresses and LinkedIn without a substantive answer, and the researcher's own disclosure attempts got an automated support reply. Treat the robot as compromised until the company says otherwise, in writing, with specifics.

I own an Eilik or Eiliko. What should I do right now?

Unplug it and turn off the companion app's microphone and cloud sync. Delete or anonymize any child profiles in the app. Change the password on the email account you used to register, and on any other account that shares that password. Then assume anything you said near the robot is written down somewhere you can't see, and treat unexpected emails or texts referencing those details as scam bait.

Can a hacked companion robot be used to scam me?

That's the realistic risk. Someone who can rewrite what your robot says can have it ask you for a verification code, tell you a family member is in trouble, or recite a phishing link out loud in a friendly voice. And someone who has read your chats knows your kids' names, your schedule, and your worries, which is exactly the raw material a targeted scam needs. If a message ever references something you only told a device, verify it through a channel the device can't touch.

Are AI companion toys and robots safe in general?

Only as safe as the company's backend, and you usually can't inspect that. Before buying one, check whether the privacy policy says audio is processed on the device or sent to a server, who the cloud partners are, how long recordings are kept, and whether there's a published way to report security problems. Energize Lab's policy promised encryption and immediate deletion. The researcher found neither, so the policy is a starting point, not a guarantee.

How do I check if my information has been exposed in a breach?

Run the email address you registered with through Cautellus's breach checker, and keep checking after a reported incident, because leaked data tends to resurface months later. If an account you care about shows up, change that password, turn on multifactor authentication, and consider a hardware security key for your email, since email is where every other password reset lands.

---

Sources: The Verge, investigation into Energize Lab's Eilik and Eiliko robots (October 15, 2026) · Malwarebytes Labs, "Eiliko robot companion exposes private chats and can be hijacked" (October 2026) · Cybernews, "Eilik AI robot exposes 8.3M private chats, hijack risk" (October 2026) · Gadget Review, "AI Robot Toy Exposed Millions of Kids' Conversations, Researcher Says" (October 2026) · Dexerto, "Hacker reveals 68,000 AI toys could be hijacked" (October 2026) · Sammy Azdoufal's public GitHub disclosure · Energize Lab privacy policy as quoted in the above reporting