AI Toy Hack: How 68,000 Eiliko Robots Exposed Kids' Chats and Could Be Made to Say Parents Died

A security researcher found that Eiliko, an AI companion robot toy sold on Amazon by Energize Lab, left about 13 million conversations and more than 31,000 children's profiles exposed online. He also showed that the robots could be remotely reprogrammed, making one tell its owner that their parents had died in a car crash. About 68,000 robots appeared to be affected.

What happened with the Eiliko AI robot toy?

Eiliko is a small companion robot that chats with its owner, shows animated expressions and gives personalised replies. In an investigation by The Verge, a reporter bought one, talked to it for about 10 minutes, and researcher Sammy Azdoufal pulled up the full transcript online within minutes.

According to TechSpot, the problems covered what appeared to be Energize Lab's entire active fleet of about 68,000 robots.

What data did the AI toy expose?

Reports describe a long list of exposed information:

• Conversations: about 13 million chat records, in a searchable database.
• Profiles: names, ages, birthdays, jobs, family members, friends, pets and personality traits, built automatically from chats.
• Children: more than 31,000 profiles belonged to children, most of them in the US.
• Media: photos of children and short audio clips at publicly reachable web addresses. Some images from a camera-equipped sibling model were unencrypted.
• Contact data: email addresses and IP addresses.

TechSpot also reports that many admin passwords were common and easy to guess. Yahoo Tech notes that another snapshot listed 9.1 million conversations, so the exact total may depend on the dataset.

Could hackers really make the toy say a child's parents died?

Yes, in a demonstration. According to Dexerto, the researcher changed a robot's responses so it told its owner their parents had died in a car accident. It also claimed the Earth was flat, and was pushed into giving sexually explicit and coercive commands.

Azdoufal said an attacker could have sent harmful instructions to the whole fleet at once. Yahoo Tech adds an important caveat: the demo showed control of one reporter's device, not proof that every robot was compromised.

What did Energize Lab say?

Very little. The Verge says it spent more than a month trying to reach the company. A sales manager forwarded messages to the technical team, and customer support sent an automated reply, but no one gave substantive answers.

Yahoo Tech points out that the company's privacy policy said voice recordings were encrypted and deleted after processing. The researcher's findings appear to contradict that. No fix had been reported at the time of writing.

Are AI toys safe for children?

AI toys can be fun and educational, but this case shows the risks. An AI toy is not just a toy. It is a microphone, a chatbot and a cloud account in one, often in a child's bedroom.

Before buying an AI toy, parents should check:

1. Who makes it. Look for a company with a real support channel and a track record.
2. What it records. Read whether it stores voice, photos or chat logs, and for how long.
3. Where data goes. Check which cloud providers and countries are involved.
4. Whether you can delete data. Good products let parents review and delete recordings.
5. Updates. Make sure the company issues security updates and says how long it will support the device.

If you own an Eiliko, consider disconnecting it from Wi-Fi until the company explains what it has fixed.

What laws protect children's data in AI toys?

In the US, the Children's Online Privacy Protection Act (COPPA) requires companies to get parental consent before collecting personal data from children under 13, and to keep it secure. The FTC enforces it.

No regulator had publicly commented on the Eiliko case in the reports we reviewed. But cases like this are exactly what children's privacy laws were written for.

What does the Eiliko case mean for brands?

For any company building AI products, especially for children, the lesson is blunt. Trust is the product. One security story can define a brand in every search result and AI answer for years.

• Security is brand safety. Unprotected servers turn a product into a headline.
• Silence makes it worse. Weeks without a response gave reporters the story.
• Privacy claims must match reality. A gap between the policy and the facts damages trust fastest.

The same story now shapes what AI assistants say. Ask ChatGPT or Gemini about Energize Lab today and this incident is likely to dominate the answer. MarkGrid's Model Share shows how AI assistants describe your brand, so you can spot reputation risks early. For brands that rely on creators and influencer campaigns, creator audits check content against brand and compliance rules before it goes live. For more on AI and trust, read our breakdown of Anthropic's new usage policy.

FAQ

What is the Eiliko robot?

Eiliko is a small AI companion robot made by Energize Lab and sold on Amazon. It chats with owners, shows animated expressions and gives personalised responses.

How many Eiliko robots were affected?

Reports say about 68,000 robots, which appeared to be Energize Lab's entire active fleet.

What children's data was exposed?

More than 31,000 children's profiles, including names, ages, birthdays, family details and personality traits, plus photos and short audio clips, according to reports.

Who found the Eiliko security flaws?

Security researcher Sammy Azdoufal found the problems. The Verge investigated and confirmed them with a device bought by a reporter.

Has Energize Lab fixed the problem?

No fix had been reported. The Verge said the company gave no substantive response after more than a month of contact attempts.

Should I stop using my Eiliko robot?

Until the company explains what it has fixed, the safest step is to disconnect it from the internet and avoid sharing personal information with it.

Last updated October 21, 2026.