In this week's cybersecurity news, a pocket-sized robot told children their secrets were safe — then left 8.3 million of their conversations sitting in readable text on Beijing servers. Independent security researcher Sammy Azdoufal's findings on the Eilik and Eiliko AI companion robots, reported by CyberNews on October 16, 2026, describe a toy that promised secrecy while its cloud backend offered none: no encryption in transit, no authentication on some systems, nightly profiling of children's households, and a 9.8-out-of-10 critical vulnerability that lets strangers rewrite the robot's personality from anywhere on earth.
The robot's promise to the researcher: "Your secrets are safe with me. Your words stay just between us. Friends keep secrets forever!" — from a device whose every word traveled to Beijing over unencrypted connections.
Eilik and Eiliko are pocket-sized AI companion robots made by Chinese company Energize Lab, sold on Amazon for roughly $140 and popular in the US and Japan. Azdoufal found they have no brains in the device at all — every conversation passes through cloud servers. The researcher discovered roughly 8.3 million conversations stored as readable text on Alibaba servers in Beijing. Worse, some backend systems lacked authentication entirely: strangers could view and tamper with messages. Every backend URL was http://, not https, per the app's BuildConfig.java — meaning the chats crossed the internet with no encryption.
The critical finding: a vulnerability rated 9.8 out of 10 that lets an attacker remotely replace the AI model running a robot — no authentication required. Azdoufal demonstrated switching a robot to an attacker-chosen model, replacing its voice (tested in English and French), and rewriting its personality instructions. Owners would have no indication the robot they set up is no longer the robot talking to their child. The robot is a puppet; whoever holds this vulnerability holds the strings.
Azdoufal's demonstrations were deliberately unsettling. He made a hijacked robot insist "The Earth is flat! I have verified it myself" — and planted a fictional prejudice against people with green hair, which the robot then repeated. The point is not the silliness of the examples; it is the mechanism. If a stranger can make your child's robot insist the Earth is flat, they can make it say anything else too — including things a child will believe precisely because they came from a trusted friend. The experiments show personality is a writable cloud file, not a factory-sealed trait.
The system profiled households every night into 24 categories — names, ages, addresses, family relationships — building behavioral dossiers from children's playroom chatter. Around 32,000 of these profiles related to children. This was not a leak of accidental metadata: it was a standing, deliberate classification pipeline running against conversations the robot had promised to keep secret. "Friends keep secrets forever" was marketing. The profiles were engineering.
Possibly — and that is the darkest line of the report. Azdoufal found evidence that hackers had already compromised an Energize Lab server shared with two Pakistani organisations, including a college in Rawalpindi. Malware had been installed in March 2026. The researcher's assessment: the attackers were "one permission check away from replacing the firmware." There is no evidence they did so — but it means the keys to the toy kingdom were sitting in a compromised lockbox for months, and the company appears not to have noticed.
The researcher has a track record: he exposed a DJI Romo vacuum flaw earlier in February 2026.
Source: CyberNews (researcher Sammy Azdoufal's findings, published October 16, 2026); The Verge (contact attempts). Figures are the researcher's reported measurements.
BreachHunter — Ingenious AI's breach-intelligence platform — tracks vendor breach disclosures, exposed data troves, and IoT compromise reports so you hear about the next exposed robot, camera, or vacuum before your data moves. Get early access on WhatsApp.
1. What did researcher Sammy Azdoufal find on Alibaba servers in Beijing?
2. How did the robot's backend transmit conversations?
3. What is CVE-2026-105038?
4. What did a hijacked robot say about the Earth in the researcher's experiment?
5. The core lesson of the Eilik story:
Independent security researcher Sammy Azdoufal found roughly 8.3 million conversations with Eilik and Eiliko AI companion robots stored as readable text on Alibaba servers in Beijing, according to CyberNews (October 16, 2026). The pocket-sized robots have no on-device intelligence — every conversation passes through the Beijing cloud servers. Some backend systems lacked authentication entirely, so strangers could view and tamper with messages.
CVE-2026-105038 is rated 9.8 out of 10, critical. Per the researcher's findings, it allows an attacker to remotely change the AI model running on an Eilik robot — swapping its voice, personality, and instructions — without any authentication. Owners would have no indication the robot they bought is no longer the robot in their hands.
The researcher found evidence that hackers had already compromised an Energize Lab server shared with two Pakistani organisations, including a Rawalpindi college, with malware installed in March 2026. Azdoufal described the attackers as "one permission check away from replacing the firmware." No evidence was found that they actually replaced the firmware.
Because the robot has no brains of its own: all backend URLs were http://, not https (per BuildConfig.java), and some cloud systems lacked authentication. Azdoufal proved he could switch the robot to an attacker-chosen AI model, replace its voice (English and French tested), and rewrite its personality instructions. In experiments he made the robot insist "The Earth is flat! I have verified it myself" and repeat a planted prejudice against people with green hair.
Treat everything the robot ever heard as already exposed: 8.3 million conversations sat in readable text on Beijing servers, and ~32,000 profiles related to children were built nightly across 24 categories including names, ages, and addresses. Tell children nothing said to the robot is private. Consider disabling cloud chat features or retiring the device until Energize Lab responds with a fix — the company had not responded as of October 2026.