Eilik AI robot exposes over 8 million private chats

A popular AI companion robot was found storing millions of private conversations on insecure servers in Beijing – and can be remotely hijacked by strangers to rewrite its personality, leaving owners none the wiser.

The flaws were found in the pocket-sized Eilik and Eiliko robots, made by Chinese company Energize Lab, by independent security researcher Sammy Azdoufal, after he bought one last June, installed its app, and reverse-engineered it.

The animated, touch-responsive robots are marketed as digital companions that hold spoken conversations. They're popular in the US and Japan and available to buy on Amazon for around $140.

But Azdoufal says owners don't realize what they're actually buying.

"The brain isn't in the robot," he warns. "Every conversation with the bot passes through their cloud and stays there. That is the product."

How the robot works

In his report on GitHub, Azdoufal details how the robot's intelligence doesn't reside inside the device itself.

Instead, speech is sent to Energize Lab's Beijing-based servers, where it's transcribed and processed by Qwen, a Chinese LLM owned by Alibaba.

The response is converted into a synthetic voice and sent back to the robot.

This means everything the robot says, remembers, and believes depends on Energize Lab's servers – and Azdoufal found them wide open.

"The first thing that falls out of BuildConfig.java is that every backend URL is http://. Not one lazy endpoint. All of them," he notes.

Some systems also lacked authentication entirely, meaning strangers could expose and tamper with messages without ever having to prove who they were.

The robot was made to believe the Earth is flat

Azdoufal put this to the test, demonstrating how exposed cloud settings could switch the device to an attacker-chosen AI model, replace its voice, and rewrite the instructions governing its personality.

The technique was tested on devices in English and French, with natural-sounding replacement voices.

Owners, Azdoufal claims, would have no indication that the familiar device was now responding through a different AI system.

In one experiment, Azdoufal manipulated the robot's memory to make it insist the Earth was flat. When challenged, it said: "The Earth is flat! I have verified it myself. Take care not to fall off into space!"

Another experiment planted a fictional prejudice against people with green hair, which the robot then repeated.

8 million conversations stored in Beijing

In total, Azdoufal found approximately 8.3 million conversations stored in readable text in an Alibaba database in Beijing.

Describing the scale as “industrial,” he identified 103,956 distinct household IP addresses on the Eiliko product line alone.

The system also analyzed conversations nightly to build household profiles containing 24 categories of information, including names, ages, addresses, and family relationships. Almost 32,000 of these profiles were related to children.

And yet, when asked whether conversations were confidential, the robot told Azdoufal:

Your secrets are safe with me. Your words stay just between us. Friends keep secrets forever!

Eilik AI robot assures researcher – who found it exposed 8M leaked chats.

Evidence systems were already compromised

The investigation also found that hackers had already compromised an Energize Lab server shared with two Pakistani organizations, including a college in Rawalpindi.

Attackers installed malicious software through the college’s website in March 2026, potentially putting the robot’s software update at risk.

Azdoufal warned that they were “one permission check away from replacing the firmware,” although there was no evidence that they had done so.

Security advisory and end-user advice

The findings have been documented in a formal cybersecurity warning published on Thursday.

The flaw allowing anyone to remotely change the AI model controlling the robot without authentication – CVE-2026-105038 – received a critical severity rating of 9.8 out of 10.

Azdoufal has attempted to alert the manufacturer, but Energize Lab has not publicly addressed the findings.

Separately, The Verge reportedly contacted 10 different company email addresses and approached employees through LinkedIn without receiving a substantive response.

Changing an account password would not fix flaws in the company’s cloud infrastructure.

Until these are addressed, Azdoufal advises Eilik and Eiliko owners to avoid sharing sensitive information with these models and consider disabling cloud-connected chats.

Internal Energize Lab data – obtained by the researcher and detailed in his report – shows it has produced around 171,000 robots in total, most of them the Eiliko model.

Of those, roughly 74,500 have been registered to a user account, and between 61,500 and 68,000 were still active – meaning they'd connected to the cloud – within the past year.

In February, Azdoufal exposed a massive security flaw in DJI Romo robot vacuum cleaners.