Energize Lab, the maker of the Eiliko AI robot charm, said it will hire an independent security firm after reporting showed that hackers could read what owners told the toy.
Eiliko is a small robot you hang on a bag, with built-in AI conversation. It told owners "your secrets are safe with me." According to the reporters who investigated it, attackers could easily pull complete transcripts of everything said to the toy, and they described that as just the beginning of the problems.
The company's silence is part of the story. The reporters and security researcher Sammy Azdoufal spent more than a month trying to reach Energize Lab, including emails to CEO and founder Shaw Yeung. Nobody answered their questions. The company has now broken that silence with a statement, which said "We have confirmed the core issues" before turning to the outside review. The reporters judged the response lacking.
Hiring an outside firm is the standard first move after a disclosure like this, and it costs little to announce. It also says nothing yet about what was exposed, who was affected, or when the holes get closed.
The pattern is familiar. In 2017, the CloudPets connected toys exposed customer recordings, and the researchers who found the problem described struggling to get the company's attention. Toys that talk back raise the stakes, because the data is a child's or an adult's unguarded chatter, collected by a product marketed on trust.
The measure of this response will be whether Energize Lab publishes what the review finds and tells owners what was readable.