The Pulse
Energize Lab Lists Eiliko Security Fixes; Independent Review Pending
Energize Lab says it closed external access to its backend systems and took Eiliko’s long-term memory and custom-avatar features offline. The Verge reported that customer media remained exposed and that researcher Sammy Azdoufal said he sti
AI.info Team · Written with AI · fact-checked ·
Energize Lab says it has shut outside access to the systems behind its Eiliko robot and disabled remote changes to the toy’s responses. But on October 22, The Verge reported that audio recordings and photos remained available at unsecured public web addresses; security researcher Sammy Azdoufal told the outlet he still had SSH access.
The company’s assurances and the reported access do not line up. Energize Lab says it confirmed the core issues in The Verge’s earlier investigation. The follow-up reported exposed customer media and attributed the claim of continued SSH access to Azdoufal; it did not say The Verge tested that access.
Energize Lab’s promised fixes
In an unsigned statement to The Verge, Energize Lab apologized for failing to respond promptly to the researcher and the publication. The company said it had closed external access to its backend systems, rotated access credentials and disabled the interface that let someone modify a robot’s responses remotely.
Energize Lab also said it had taken long-term memory and custom avatars offline. It said it no longer stores conversation records or profiles generated from them, and that it plans to delete stored transcripts, profiles, avatar images and related content. The company said the memory and custom-avatar features will stay offline until an independent security firm’s review confirms they are secure.
“The long-term memory and custom avatar features will not return until that review confirms they are secure.”
Energize Lab, in an unsigned statement to The Verge
The company also set up a security contact email and said it would share an update after the review. It did not give a date for the review’s completion or for deleting the stored records.
The Verge reports access persisted
The Verge’s follow-up points to a gap between the company’s account and what the outlet reported. The publication said recordings and photos remained available at unsecured public web addresses when the company sent its statement. Azdoufal told the outlet he still had full SSH access and could theoretically read transcripts and change the robot’s behavior.
“With Azdoufal’s help, I can confirm that as of the company’s email, it was still storing audio recordings and photos of its customers at unsecured public web addresses with no protection whatsoever.”
Sean Hollister, senior editor at The Verge
Those findings do not establish that criminals stole or used the records. They do show that the researcher said his access had not ended when Energize Lab said it had closed outside access, leaving the company’s remediation claims unverified by the reporting described in the follow-up.
Millions of conversations in the earlier report
The dispute follows The Verge’s October 15 investigation, which described how Azdoufal accessed the service connected to Eiliko, a small AI robot designed to be carried as a charm. The report said he could search about 13 million conversations and access what appeared to be 68,000 active robots. The publication also reported more than 31,000 profiles belonging to children in the United States.
The exposed material went beyond chat transcripts. The Verge said the service created profiles containing information such as names, ages, birthdays, family relationships and assessments of personality, alongside email addresses and IP addresses. It also reported that some photos and short audio clips were accessible at public web addresses.
A security review is still ahead
Energize Lab has acknowledged the core issues identified in the reporting and pledged to remove stored conversation records and profiles. Yet the reported access to media and Azdoufal’s statement that he still had SSH access complicate the company’s claim that outside access is closed. The company said the independent security firm’s review must confirm the features are secure before they return.
For now, the company’s statement describes actions it says it has taken, while The Verge’s account records exposed media and relays Azdoufal’s claim of continued access. Energize Lab said the memory and custom-avatar features will not return until the review confirms they are secure.