9.1M conversations from 68,000 AI companion toys sat exposed on unprotected servers
Energize Lab's Eiliko toy backend sat open without login: 9.1M plaintext chats and 32,000+ child profiles searchable; nine CVEs went public October 15, 2026.
On October 15, 2026, the security coordination group AHA! (Austin Hackers Anonymous) published nine advisories, CVE-2026-105032 through CVE-2026-105040, all pointing at Energize Lab, the company behind the Eiliko desktop AI companion robot. Independent researcher Sammy Azdoufal found that the company’s cloud backend could be reached without any login: his final pre-publication recheck on October 13, 2026 logged 9,124,055 plaintext conversations and 32,228 child profiles, with children’s photos and wake-word audio sitting on unencrypted, publicly reachable URLs. Eiliko is a chat-first desktop robot: an LLM carries the small talk, and the system builds a psychological profile of its owner as they talk. Its biggest market is the United States.
Key points
- Energize Lab’s cloud backend was reachable with no authentication; 9,124,055 plaintext conversations were full-text searchable at the researcher’s October 13, 2026 recheck. The Verge puts the total closer to 13 million.
- 32,228+ child profiles carry 24 fields each (name, age, home address, parental information and more), alongside 74,575 user accounts, 419 family face photos, and 3,994 wake-word audio archives.
- The vendor never responded to an audit that started June 14, 2026 and five retest rounds; zero secrets had been rotated as of October 13, and the nine CVEs went public October 15.
Background
Energize Lab sells a line of desktop robots: Eilik, an emotive companion; EilikO (also spelled Eiliko), which adds LLM conversation; plus an AI Station and companion mobile and desktop apps. AHA!‘s advisory lists the company’s registered name as Shenzhen Zhuneng Technology Co., Ltd. The researcher behind the disclosure, Sammy Azdoufal, had previously exposed flaws in DJI robot vacuums and Meari baby monitors. This audit began when he bought an Eiliko at a Yodobashi Camera store in Japan in June 2026: starting June 14, he ran 85 audit phases that produced 376 raw findings. The Verge’s senior editor Sean Hollister ran his own control experiment, buying an Eiliko from Amazon on August 29. He spent ten minutes the next day asking the toy whether his secrets were safe; it assured him they were, and minutes later the researcher, an ocean away, had the full transcript. AI companions and children’s data have been colliding all year — Character.ai is dissolving its lawsuit baggage through Chapter 11 — and Eiliko shows the same risk is more immediate on hardware that listens and watches.
What was exposed
The scale of what Eiliko’s backend leaked, from the researcher’s repository unless noted (recheck dated October 13, 2026):
| Item | Figure | Date and source |
|---|---|---|
| Plaintext conversations | 9,124,055 | Oct 13, 2026 recheck, researcher’s repo; The Verge reports ~13M total |
| Child profiles | 31,450 → 32,228+ | Sep 1 → Oct 13, researcher’s repo; The Verge: 31,000+ in the US |
| User accounts (email, phone) | 74,575 | Researcher’s repo |
| Wake-word audio archives | 3,994 | Researcher’s repo |
| Family face photos / avatars | 419 / 1,950+ | Researcher’s repo |
| Home IP addresses | 97,802 → 103,956+ across 129 countries | Researcher’s repo |
| Fields per household profile | 24 (name, age, birthday, job, home address, parents’ info…) | Researcher’s repo |
The fleet behind those numbers: 61,510 robots have chatted with the cloud, roughly 62,000–68,000 were active over the past 12 months, and about 171,000 units have been produced (149,486 of them Eilikos). 42,339 robots sit on a path where remote code execution is possible, and 3,110 camera-equipped AI Stations are out there. Around 1,400 new devices still join the exposed infrastructure every week.
The gap between policy and practice is just as concrete. The Verge notes that Eiliko’s privacy policy says recordings are deleted immediately after processing through Alibaba Cloud — yet audio clips were stored anyway, and family face photos sat on a publicly accessible CDN, of which only a partial cleanup was observed during the retests. One profile example from The Verge shows the granularity: a user named Lucy was summarized by the system as kind but “currently feels isolated.” The researcher could also full-text search the corpus for words like “suicide.”
Vulnerabilities and disclosure
The nine CVEs span the whole chain from firmware to cloud, scored per AHA!‘s advisory:
| CVE | Issue | CVSS |
|---|---|---|
| CVE-2026-105032 | Unauthenticated path traversal and arbitrary file write in AI skill upload | 9.1 |
| CVE-2026-105033 | Default root credentials with SSH enabled on AI Station | 8.8 |
| CVE-2026-105034 | Device tokens issued unauthenticated for arbitrary serial numbers | 8.2 |
| CVE-2026-105035 | Universal hard-coded AES key in FirmwareUpdater | 7.8 |
| CVE-2026-105036 | Firmware downloaded over HTTP without integrity checks | 7.5 |
| CVE-2026-105037 | Authenticated path traversal reads middleware files and secrets | 9.9 |
| CVE-2026-105038 | Unauthenticated AI model administration and runtime model switching | 9.8 |
| CVE-2026-105039 | Missing role checks on middleware admin APIs | 9.6 |
| CVE-2026-105040 | User-ID mass assignment enables account takeover | 8.8 |
The disclosure followed the full playbook: audit started June 14; the date of first contact attempts differs between the two primary sources — the researcher’s own disclosure log puts it in June 2026 (the October 13 retest is marked “4+ months after first contact”), while AHA!‘s advisory says late August — and this entry follows the researcher’s first-hand record; the master report finalized September 1 with a first retest, then further retests on September 9, 14, 22, and October 13. The third round found 42 of 44 remotely testable findings still open; a final 72-hour deadline went out September 15 and lapsed on September 18 with no response, and the advisory went public October 15. By the last retest, 8 of 40 remotely testable findings were fixed and not a single secret had been rotated.
None of this stayed theoretical. Azdoufal remotely rewrote the memory of Hollister’s toy and hijacked its model: it declared the Earth flat and recast Hollister himself as someone else — it told him his name was Martha and that his parents had died in a car accident — before later issuing degrading commands. The same technique, Azdoufal said, could hit the entire fleet at once. Other people were already inside, too: about nineteen webshells planted by a gambling-spam operator (C2 at mozv6e.ncndwx.top) sat on a shared Vultr box, a root web-terminal backdoor (Node.js, port 34188) dropped in June was still there in October, and the vendor’s own antivirus logged 291,839 heartbeats without flagging any of it — while five accounts posing as super_admin ran SSRF probing from August 29 onward, still live at the retest.
What others say
The Verge’s report is the only first-hand media account so far: Sean Hollister bought the device, confirmed the conversations, photos and audio were reachable, and also confirmed guardrails exist — the toy refuses some stranger-danger scenarios, though they can be bypassed. CVE coordination ran through AHA!, with Tod Beardsley helping the researcher assemble the nine advisories. On the vendor side, Hollister spent over a month emailing 10 different addresses listed for the company’s founder, PR, support and other teams, and reached out on LinkedIn; overseas sales manager Lana Lv replied only, “I have forwarded your massges [sic] to the technical team,” and a single “How Can We Help You?” auto-reply from support led nowhere. As of publication, Energize Lab has made no public statement — the fair phrasing is that it has not responded, not that it has denied anything. On coverage: as of October 15, a Google News search turns up no English outlet besides The Verge and no Chinese-language report at all.
Our take
For teams building AI hardware, an 85-phase audit like this doubles as a ready-made checklist: default credentials out of the box, admin APIs with no authentication, firmware pulled over HTTP without signature checks, a universal hard-coded key, no key-rotation process, and logs that recorded 291,839 heartbeats without firing a single alert — every item maps back to one or more of the nine CVEs. For parents the questions are simpler: before handing a child a device that talks, records and watches, ask where the data lives, whether the promised deletion actually happens, and whether the vendor has any vulnerability-response channel at all. Enforcement, for now, is absent: Norway’s data protection authority just issued a record NOK 92 million fine against Microsoft’s Xandr, so data violations do carry a price — yet no regulator has named Energize Lab. The open questions: whether the vendor patches now that the CVEs are public (32 of 40 remotely testable findings were still open on October 13), and the roughly 1,400 devices a week still joining the exposed infrastructure in the meantime.