{"slug": "eiliko-maker-says-its-hiring-an-independent-security-firm-after-verge-report-on", "title": "Eiliko maker says it’s hiring an ‘’independent security firm’ after Verge report on its insecure robots", "summary": "Energize Lab, maker of the Eiliko AI robot charm, told The Verge in an unsigned statement that it has hired an independent security firm to review all of its systems and, as of Wednesday, closed all external access to its backend systems, rotated all access credentials, disabled the interface that allowed a robot's responses to be modified remotely, and taken its long-term memory and custom avatar features offline. The company also pledged to delete stored conversation records, user profiles and avatar images, but security researcher Sammy Azdoufal told The Verge he still had full SSH access to the robots and could still theoretically read transcripts and modify the toy's behavior, and The Verge confirmed Energize Lab was still storing audio recordings and photos of customers at unsecured public web addresses at the time of the statement. Energize Lab said \"we know that words alone will not earn that trust back\" and set up a dedicated security@energizelab.com contact after more than a month of unanswered questions.", "body_md": "Eiliko, a cute robot charm you can hang on your bag with built-in AI conversations, [turned out to be a security nightmare](https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab). It told owners that “your secrets are safe with me,” but hackers could easily read complete transcripts of everything we told the toy, and that was [just the beginning](https://bsky.app/profile/seanhollister.bsky.social/post/3mxwa5qmcos2q). *The Verge* and security researcher Sammy Azdoufal spent over a month trying to get in contact with the company, including emails to Energize Lab CEO and founder Shaw Yeung. Nobody would answer our questions.\n\n# Eiliko maker says it’s hiring an “independent security firm’ after Verge report on its insecure robots\n\n“We know that words alone will not earn that trust back.”\n\nNow, the company is finally breaking its silence, though its response leaves something to be desired.\n\n“We have confirmed the core issues identified in your reporting and are addressing each of them,” Energize Lab told *The Verge* in an unsigned statement from a generic email address. The company says it will hire an independent security firm to fully review all of its systems, and has set up a dedicated security@energizelab.com contact email.\n\nThe company also claims that as of Wednesday, it has “closed all external access to our backend systems” and “disabled the interface that allowed a robot’s responses to be modified remotely.”\n\nEnergize Labs is also pledging to “no longer store conversation records or the user profiles generated from them,” and says it will delete the conversation records, user profiles, and “avatar images” it has already stored.\n\nNotably, the company isn’t promising to get rid of data collection for good. “The long-term memory and custom avatar features will not return until that review confirms they are secure,” it writes, suggesting that Energize Lab *does* plan to store some personal information once its systems are hardened.\n\nEven more notably, Energize Labs’ systems are **not yet secure.** With Azdoufal’s help, I can confirm that as of the company’s email, it was *still* storing audio recordings and photos of its customers at unsecured public web addresses with no protection whatsoever. If I gave you a link (which I won’t) you could click and immediately be looking at an owner’s face.\n\nAzdoufal also tells me he still has full SSH access to these robots, and that he can still theoretically read transcripts and modify the toy’s behavior. So when Energize Lab says it has “closed all external access,” that doesn’t seem to be accurate.\n\n“We know that words alone will not earn that trust back,” Energize Lab tells *The Verge*. “We intend to earn it through what we do in the coming weeks, and we will keep you informed as we go.” That sounds like a good plan, because some of today’s words still don’t ring true.\n\nHere is Energize Lab’s full unsigned statement to *The Verge*:\n\nDear Sean,\n\nWe sincerely apologize to you and to Mr. Azdoufal for not responding over the past month. This was our failure: After receiving the relevant information, we failed to sync with the technical team in a timely manner, and the subsequent troubleshooting also took some time. We have now set up a dedicated security inbox, [security@energizelab.com](mailto:security@energizelab.com), which is staffed and monitored.\n\nWe thank you and Mr. Azdoufal for bringing these issues to our attention. We have confirmed the core issues identified in your reporting and are addressing each of them.\n\nAs of today, we have:\n\nClosed all external access to our backend systems and rotated all access credentials;\n\nDisabled the interface that allowed a robot’s responses to be modified remotely;\n\nTaken the long-term memory feature offline. We no longer store conversation records or the user profiles generated from them;\n\nTaken the custom avatar feature offline. The app now offers built-in avatars only.\n\nWe will delete stored conversation records, user profiles, avatar images, and related content.\n\nWe are engaging an independent security firm to conduct a full review of our systems. The long-term memory and custom avatar features will not return until that review confirms they are secure. We will share an update on our progress once the review is completed.\n\nWe started Energize Lab because we wanted to build small robots that bring a little joy into people’s lives. That idea only works if people can trust what is inside them, and we let them down. We know that words alone will not earn that trust back. We intend to earn it through what we do in the coming weeks, and we will keep you informed as we go.\n\nSincerely,\n\nEnergize Lab Team\n\n**Follow topics and authors** from this story to see more like this in your personalized homepage feed and to receive email updates.", "url": "https://wpnews.pro/news/eiliko-maker-says-its-hiring-an-independent-security-firm-after-verge-report-on", "canonical_source": "https://www.theverge.com/news/1015824/eiliko-energize-lab-statement-on-robot-hack-breach", "published_at": "2026-10-22 11:00:00+00:00", "updated_at": "2026-10-22 11:12:22.080725+00:00", "lang": "en", "topics": ["ai-safety", "ai-products", "artificial-intelligence"], "entities": ["Energize Lab", "Eiliko", "The Verge", "Sammy Azdoufal", "Shaw Yeung"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/eiliko-maker-says-its-hiring-an-independent-security-firm-after-verge-report-on", "markdown": "https://wpnews.pro/news/eiliko-maker-says-its-hiring-an-independent-security-firm-after-verge-report-on.md", "text": "https://wpnews.pro/news/eiliko-maker-says-its-hiring-an-independent-security-firm-after-verge-report-on.txt", "jsonld": "https://wpnews.pro/news/eiliko-maker-says-its-hiring-an-independent-security-firm-after-verge-report-on.jsonld"}}