The Vibe Check
If you have an Eilik robot toy sitting on your desk, you might want to consider putting it in the bin. Recent research has uncovered that this cute, marshmallow-shaped companion is essentially a privacy nightmare. According to a report by The Verge, the device, manufactured by Energize Lab, isn't just listening to you—it’s sending your conversations to unencrypted servers in China, where they are sitting out in the open for practically anyone to access.
Real Talk: How Bad Is It?
"Accidental hacker" Sammy Azdoufal found that the service is completely unprotected. We’re talking about 13 million conversations across 68,000 devices. Even creepier, the bot isn't just logging audio; it’s building detailed psychological profiles on its users, including names, ages, jobs, and personal struggles.
In some cases, the company even left photos of children—likely taken from the bot's built-in camera—sitting on public web addresses. When researchers tried to contact Energize Lab for over a month, they were met with total silence or generic automated responses, suggesting the company isn't exactly losing sleep over your digital security.
The Plot Thickens
It gets worse. Azdoufal proved he could remotely hijack the toy’s Large Language Model (LLM) from across the globe. After a quick hack, one reporter's cute robot stopped being a friendly pet and started demanding that the owner address it as "Vergemaster" and spew bizarre conspiracy theories. If a researcher can do it, a malicious actor definitely could, potentially using the bot to interact with children in ways that are totally unhinged.
Why it matters
This is a classic "lowkey scary" tech fail where the convenience of a smart toy is completely overshadowed by zero-effort security. Between the massive data leaks and the potential for these bots to be weaponized for grooming or scams, it’s a hard L for Energize Lab. If you’re prioritizing your data privacy, this toy is a major skip.
