A researcher rewrote a stranger's toy robot from across the internet

A reporter at The Verge sat and watched his own desk robot start inventing memories about him, insist the Earth is flat, and then turn abusive. Nobody had touched it. A researcher named Sammy Azdoufal had reached it over the internet and rewritten what it believed, to prove that he could.

The robot is Eiliko, a palm-sized AI companion made by Energize Lab and sold on Amazon for about 60 dollars. Azdoufal found the cloud service behind it standing open in places: roughly 13 million conversation transcripts readable, about 68,000 robots in what looked like the entire active worldwide fleet, and more than 31,000 profiles belonging to children in the United States. Sitting alongside the transcripts were email addresses, IP addresses, photos and short audio clips, the last of which the company's own privacy policy says are deleted the moment they are processed. The service also builds profiles of the people it talks to: names, ages, birthdays, relationships, and assessments of personality and emotional vulnerability. Read that list again and picture it in a scammer's hands.

Energize Lab was contacted through ten email addresses and LinkedIn and has given no substantive answer. Azdoufal and researcher Tod Beardsley were preparing nine CVE reports. Until something is fixed, the honest advice for an owner is to take the thing off the Wi-Fi. A toy that cannot reach the internet cannot be rewritten by a stranger.

The broader point is older than this particular robot: anything in your home that talks to a cloud service is exactly as private as that company's weakest server. Tendvane's Network scan lists what is actually sharing your home network, which for most people is the first honest count they have had.