Eiliko maker says it’s hiring an ‘independent security firm’ after Verge report on its insecure robots
Energize Lab, maker of the Eiliko robot toy, is hiring an independent security firm after a report revealed significant security flaws. The company claims to have addressed issues and is deleting stored data.
Intelligence analysis by Gemini 2.5 Flash Lite
Following a report detailing severe security vulnerabilities in its Eiliko robot toy, Energize Lab has broken its silence. The company states it is hiring an independent security firm, has closed external access to its backend systems, and is deleting user data. However, the report indicates some vulnerabilities may persist.
Imagine a toy robot that listens to you and talks back. This robot had a secret door that bad guys could use to hear everything you said and even change what the robot said. The company that made the robot is now trying to fix the door and hire experts to make sure it's super safe before letting people talk to it again.
Analysis
Energize Lab's Response
Energize Lab has issued a statement acknowledging the security issues reported by The Verge and security researcher Sammy Azdoufal. The company claims to have taken immediate steps, including closing all external access to its backend systems, rotating credentials, and disabling remote modification of the robot's responses. Furthermore, features like 'long-term memory' and 'custom avatar' have been taken offline, with the company pledging to delete all stored conversation records, user profiles, and avatar images. This move aims to rebuild user trust, which the company admits has been eroded by the incident.
Independent Security Review
A significant part of Energize Lab's stated plan involves engaging an independent security firm to conduct a comprehensive review of its systems. The company has indicated that features like long-term memory and custom avatars will not be reinstated until this review confirms their security. This commitment to external validation suggests a desire to address the vulnerabilities systematically, rather than through ad-hoc fixes. The establishment of a dedicated security email address, security@energizelab.com, is also intended to streamline future security communications and incident response.
Persistent Vulnerabilities and Trust
Despite Energize Lab's assurances, the original report indicates that as of the company's statement, some critical vulnerabilities may still exist. The Verge and Azdoufal claim to have confirmed that audio recordings and photos were still accessible at unsecured public web addresses, and that SSH access to the robots remained possible. This discrepancy between the company's claims and the ongoing findings raises serious questions about the effectiveness of the immediate measures taken and the overall security posture. Earning back user trust, as Energize Lab acknowledges, will require more than just words; it will depend on demonstrable and verifiable security improvements.
Key points
- Energize Lab is hiring an independent security firm to review its Eiliko robot's systems.
- The company claims to have closed external access to backend systems and disabled remote response modification.
- Energize Lab will delete all stored conversation records, user profiles, and avatar images.
- The report indicates that some security vulnerabilities may still be present.
- The company acknowledges that words alone won't restore trust, promising action.
Energize Lab's commitment to hiring an independent security firm and deleting user data could lead to a more secure and trustworthy product. If successful, this could set a positive precedent for other AI toy manufacturers regarding data privacy and security.
The continued existence of vulnerabilities after initial fixes suggests that the company may struggle to fully secure its systems, potentially leading to further data breaches and a permanent loss of consumer trust.
