Energize Lab to hire security firm after Eiliko toy exposed owners' voice transcripts

Energize Lab, the maker of the Eiliko AI companion — a small robot charm designed to hang from a bag and hold conversations — says it will bring in an outside security firm to audit its systems after The Verge reported that attackers could easily read complete transcripts of everything owners said to the device. The company has also pledged to delete stored conversation data, though The Verge reports that serious exposures remain live.

What Energize Lab has promised

According to The Verge, the company ended more than a month of silence with an unsigned statement sent from a generic email address. In it, Energize Lab acknowledged the central problems raised in the reporting and said it is working through each of them. The company claims that, as of the day the statement was sent, it had shut off outside access to its backend systems, rotated its credentials, and disabled an interface that allowed a robot's responses to be changed remotely.

The statement also says the long-term memory feature — which stored conversation records and the user profiles built from them — has been taken offline, along with the custom avatar feature; the companion app now offers only built-in avatars. Stored conversation records, user profiles, avatar images and related content will be deleted, and the company has opened a monitored security contact address.

What is still exposed

The remediation claims do not fully hold up, according to The Verge. Working with security researcher Sammy Azdoufal, the publication confirmed that when the statement arrived, audio recordings and photos of customers were still hosted at public, unprotected web addresses. Anyone holding a link — which The Verge declined to share — could immediately see an owner's face.

Azdoufal also told The Verge that he retains full SSH access to the robots and could still, in theory, read transcripts and change how a toy behaves. That directly undercuts the company's claim that outsiders can no longer reach its systems.

Data collection could return

The statement leaves the door open to resuming collection of personal information. Energize Lab says the long-term memory and custom avatar features will stay offline only until the independent review confirms they are safe — wording that suggests the company intends to reintroduce storage of conversations and profile data once its infrastructure is hardened.

A month of unanswered emails

The Verge and Azdoufal had spent over a month trying to reach Energize Lab before the response, including emails to CEO and founder Shaw Yeung, and nobody answered their questions. In its statement, the company apologized for the silence, blaming a failure to pass the researchers' findings to its technical team promptly, along with the time the follow-up investigation required. The statement closes by conceding that words alone will not rebuild trust and promising updates as the review progresses.

Why it matters

Eiliko's whole premise is intimate, always-available conversation, and as The Verge noted, the toy itself reassured owners that their secrets were protected. When full transcripts, recordings and photos can be pulled by anyone who stumbles on the right URL, that promise collapses — and the weak backend patterns on display here, from unprotected public storage to remotely modifiable behavior and standing SSH access, recur across the connected-device industry rather than in one product alone.

The episode is also a case study in verifying remediation rather than assuming it. Energize Lab's statement claimed external access had been closed, yet the researcher who found the flaws demonstrated otherwise within the same news cycle. For buyers of AI companions — and for the journalists and researchers who cover them — independent confirmation remains the only reliable signal that a fix is real. The company's move to stop storing transcripts and profiles, even if only pending review, also highlights the core trade-off in these products: features like long-term memory depend on keeping sensitive data, and every byte retained is a liability.