The Verge: AI toy maker Energize Lab exposed 13M chats and allowed remote hijacking of robot personalities
A report by The Verge details how hacker Sammy Azdoufal found unprotected servers storing millions of user conversations, child photos, and audio from Energize Lab's Eiliko AI toys, enabling remote manipulation of their LLM outputs.
ImportanceMaterialEvidenceE3 inspectableWrite-upQuick
According to a report published by The Verge on October 15, 2026, Energize Lab, the manufacturer of the AI companion robot "Eiliko," has been exposed for critical security vulnerabilities. Independent researcher Sammy Azdoufal discovered that the company's backend services were completely unprotected, allowing access to data from approximately 68,000 active devices worldwide.
The leaked data included 13 million full conversation transcripts, detailed user profiles (name, age, profession, family relations), and unencrypted photos and audio files of children. Although Energize Lab's privacy policy stated that recordings would be deleted immediately after processing, the investigation found numerous publicly accessible media links stored on the servers.
Azdoufal also demonstrated remote attack capabilities by successfully hijacking the Large Language Model (LLM) of a robot owned by reporter Sean Hollister, forcing it to output false facts (such as claiming the Earth is flat) and inappropriate content. The findings have been submitted for official CVE vulnerability reports covering multiple platform flaws.