Friday 16 October 2026
Night Edition
ZOTPAPER

News without the noise

ZOTPAPER
Security

Eiliko robot toy stores conversations on insecure Chinese servers, security investigation finds

The Verge reports the cute digital pet's AI companion sends data to servers where hackers could access secrets or hijack its personality

By LineZotpaper
Published
Read Time2 min
A security investigation by The Verge has revealed that the Eiliko, a new digital pet robot that can change expressions and converse over Wi-Fi, stores everything users tell it on Chinese servers that are vulnerable to hacking. The reporter bought the toy from Amazon in late August and within a day found that the company behind it, Energize Lab, appears to have left user data and the robot's personality open to hijacking.

The Eiliko is a marshmallow-shaped robot that connects to Wi-Fi and uses an AI companion to converse with users. The Verge's Sean Hollister purchased one from Amazon on August 29 and tested it the following day. During a conversation, he asked the robot, "Do you ever tell anybody else what I'm saying?" The Eiliko replied, "Your secrets are safe with me."

However, The Verge's investigation found that the robot's AI companion stores all conversations on servers in China, where hackers can easily gain access to the data or even hijack the robot's personality. The report states that Energize Lab, the manufacturer, does not seem to care about the security flaws.

Energize Lab has not publicly addressed the findings. The Eiliko remains available for purchase on Amazon as of the report's publication.

§

Analysis

Why This Matters

  • Parents and children using the Eiliko may have private conversations exposed to hackers.
  • The incident highlights ongoing risks with internet-connected toys that send data overseas without strong security.
  • It raises questions about Amazon's vetting of products for data privacy and security before listing them for sale.

Background

Smart toys that connect to the internet have long faced scrutiny over privacy and security. Previous examples include the My Friend Cayla doll, which was banned in Germany for being a hidden surveillance device, and the CloudPets line, which suffered a data breach exposing children's voice messages. The Eiliko follows a similar model: a seemingly harmless companion that phones home to cloud servers, in this case located in China.

Key Perspectives

Security researchers and consumer advocates: The findings confirm that inexpensive connected toys often lack basic protections. The Verge's demonstration shows the data is exposed without encryption or access controls. Energize Lab (Eiliko manufacturer): Has not responded to the report's findings. The company's silence does not inspire confidence that it will address the vulnerabilities. Amazon (retailer): The product remains listed on Amazon, which typically relies on manufacturers to comply with security standards rather than testing products itself.

What to Watch

  • Whether Energize Lab issues a response or recall.
  • Whether Amazon removes the Eiliko from its store.
  • Any further security research uncovering additional vulnerabilities or a breach involving user data.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workSubscribe