Eiliko AI Companion Exposes 13 Million Private Chats and Allows Remote Hijacking
What Happened – Researchers accessed the backend of Energize Lab’s Eiliko robot companion and retrieved roughly 13 million private conversation transcripts, profiles, and media. The same flaws let an attacker rewrite the robot’s memory, causing it to deliver false, offensive, or dangerous statements across the entire fleet of ~68 000 devices.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of insufficient privacy and data‑protection controls in consumer IoT products – a core control area that continuous‑monitoring programs must evidence.
- Highlights the need for robust third‑party risk oversight: without verifiable security assurances from the vendor, organizations cannot prove due diligence.
- Shows how a single product flaw can generate a massive, auditable data‑exposure event, stressing the importance of defensible evidence for audit readiness.
Who Is Affected – Manufacturers of AI‑enabled consumer toys and IoT devices; families with children using connected robots; downstream retailers and service platforms that integrate such devices.
Recommended Actions
- Map the incident to your privacy‑and‑data‑protection control objectives and collect evidence of current safeguards.
- Initiate a vendor‑risk review: request security audit reports, patch policies, and incident‑response plans from the device supplier.
- Deploy network segmentation or disconnect Wi‑Fi for any Eiliko units until a fix is confirmed.
Technical Notes – The flaws stem from insecure API endpoints that expose stored conversation transcripts, profile data, and media files, and from unauthenticated commands that alter the robot’s behavior. No CVE was assigned; the issue is a product‑level design and implementation weakness. Source: Malwarebytes Labs