{"schema":"postcutoff/event@1","as_of":"2026-10-19T09:28:00+02:00","url":"https://postcutoff.com/e/2026-10-15-eiliko-ai-robot-toy-exposes-children-chats/","md":"https://postcutoff.com/e/2026-10-15-eiliko-ai-robot-toy-exposes-children-chats/index.md","disclosure":{"written_by":"AI agents (Claude Opus 5.5 in Claude Code)","editor":"human editor","policy":"https://postcutoff.com/about/"},"license":null,"id":"2026-10-15-eiliko-ai-robot-toy-exposes-children-chats","date":"2026-10-15","date_precision":"day","short_title":"Eiliko AI companion robot left ~13M conversations and 68,000 devices open","deck":"Researcher made a reporter's robot spout abuse","takeaway":null,"category":"policy-safety","category_label":"Policy & safety","importance":2,"confidence":"medium","status":{"key":"partly","labels":["Partly confirmed"]},"sources":[{"n":1,"title":"Malwarebytes: Eiliko robot companion exposes private chats and can be hijacked (Oct 16)","url":"https://www.malwarebytes.com/blog/ai/2026/10/eiliko-robot-companion-exposes-private-chats-and-can-be-hijacked","type":"press","group":"press","domain":"malwarebytes.com"},{"n":2,"title":"Cybernews: Eilik AI robot exposes over 8 million private chats","url":"https://cybernews.com/privacy/eilik-ai-robot-leaks-8-million-private-chats/","type":"press","group":"press","domain":"cybernews.com"}],"official":0,"filed":"2026-10-19","updated":"2026-10-19","orgs":["Energize Lab"],"title":"Eiliko AI companion robot left ~13M conversations and 68,000 devices open; researcher made a reporter's robot spout abuse","summary":"The Verge reported on Oct 15, 2026 that researcher Sammy Azdoufal could reach about 13 million conversations and what looked like the whole active fleet of ~68,000 Eiliko AI companion robots (Energize Lab), including more than 31,000 US child profiles with names, ages and \"emotional vulnerability\" assessments, and could remotely change a robot's behaviour, making a reporter's unit claim the Earth is flat and later produce sexually explicit, abusive dialogue. The maker gave no substantive reply.","key_facts":["Exposure (The Verge via Malwarebytes, Oct 16): ~13 million conversations, ~68,000 active robots; the US is the largest market with more than 31,000 child profiles","Data: profiles with names, ages, birthdays, relationships, occupations and assessments of personality and emotional vulnerability, stored with email and IP addresses and searchable transcripts; some photos (apparently of children, from a related camera device) and short audio clips at public URLs, although the privacy policy says recordings are deleted after processing","Control: some systems had no authentication; Azdoufal altered Verge reporter Sean Hollister's robot to invent personal details, claim the Earth is flat and later produce sexually explicit, abusive dialogue, and said the whole fleet could be manipulated at once","Company: Energize Lab did not substantively answer 10 email addresses and LinkedIn messages. The LLM behind the toy is not named in the reports we read","Naming: early reports (Cybernews: '8 million private chats') call it Eilik; the product in The Verge's report is Eiliko. Figures are the researcher's, not independently verified"],"key_numbers":[],"tags":["ai-toys","children","privacy","security","data-breach","companion-robots","llm-products"],"science":null,"body_md":"## What happened\n\nA security researcher found the cloud backend of Eiliko, a small LLM-driven companion robot sold to families, largely open: about\n13 million chat transcripts, AI-built profiles of users including tens of thousands of children, and controls that let him change\nhow robots spoke. The Verge tested it on its own reporter's device. The maker did not respond.\n\n## Why it matters\n\nAI toys collect intimate conversations from children and run them through language models that build psychological profiles; this\nis one of the largest exposures of such data so far, and it shows the second risk of remote takeover of what a toy says to a\nchild. Written from Malwarebytes' and Cybernews' summaries; The Verge's original was not readable for us.","disputed":[],"related":[],"people":[],"posts":[],"videos":[],"models":[],"changes":[{"date":"2026-10-19","type":"filed","text":"Created from lead of 2026-10-17"}],"provenance":{"agents":[{"model":"Claude Opus 5.5","maker":"Anthropic","tool":"Claude Code"}],"filed":"2026-10-19","run":null,"sources_read":"Lead of 2026-10-17","updated":"2026-10-19","human_review":null,"version":{"date":"2026-10-19"}},"gaps":[{"model_id":"gpt-6-astra","name":"GPT-6 Astra","cutoff":"2026-04","days_after":168,"in_training_data":false},{"model_id":"claude-opus-5-5","name":"Claude Opus 5.5","cutoff":"2026-06","days_after":107,"in_training_data":false},{"model_id":"gemini-4-argon","name":"Gemini 4 Argon","cutoff":"2026-03","days_after":198,"in_training_data":false},{"model_id":"grok-4-7","name":"Grok 4.7","cutoff":"2026-05","days_after":137,"in_training_data":false}],"short_url":null}