The AI Toy That Kept Your Secrets on an Open Server
Security researcher Sammy Azdoufal bought an Eilik, a palm-sized AI companion robot made by Energize Lab and sold on Amazon for about $140, and took it apart. What he found: roughly 8.3 million conversations stored as readable text in an Alibaba database in Beijing, with about 32,000 of the profiles tied to children.
---
What happened
The robot doesn't think for itself. Every word you say is sent to Energize Lab's servers, transcribed, run through Alibaba's Qwen AI, and sent back as speech. Azdoufal found those servers wide open: the backend ran over plain http with no encryption, and some systems had no login check at all. One flaw, CVE-2026-105038, rated 9.8 out of 10, let an unauthenticated stranger swap the robot's AI model and rewrite its personality at runtime. He made one insist the Earth is flat. The system also built nightly household profiles across 24 categories, including names, ages, and addresses.
---
Why it matters
This is the whole category, not one bad toy. A device that needs the cloud to talk keeps your words on a company's server, and you inherit that company's security. Here, that meant plain text, no passwords, and about 32,000 children's profiles exposed. Asked if the chats were private, the robot answered, "Your secrets are safe with me." They were readable to anyone who found the server. Energize Lab has not publicly responded; The Verge says it contacted 10 company addresses with no substantive reply.
---
What to do
If you own one, stop sharing anything sensitive with it and turn off cloud chat if the app allows. Changing your password won't help, the problem is the company's servers, not your account. Thinking of buying a talking gadget? Look it up first. Wednesday's issue has the free reviews to check before you buy; Friday's has a 10-minute pass to lock down a device you already own.
---
Up next · Wednesday
The free, no-signup reviews that tell you which connected gadgets and toys protect your data, and which ones don't, before you spend a dime.