Eiliko is an AI-toy brand whose internet-connected toys were found exposing children's conversations. This IoT security news roundup turns The Verge's October 2026 reporting into a 60-second parent safety check covering cloud exposure, account risk, and microphone controls.
— Ingenious AI security check.
Possibly — and that is the point of the check. Researcher Sammy Azdoufal found Eiliko's backend exposed roughly 13 million conversations and over 31,000 children's profiles, with remote hijack theoretically possible. The quiz below maps The Verge's October 2026 findings to your specific toy: cloud dependency, account exposure, and microphone controls.
When an internet-connected children's toy sends recordings or profiles to servers that are not properly secured, leaving them open to anyone who finds the exposed database.
In October 2026, The Verge reported that independent security researcher Sammy Azdoufal found the cloud service behind Eiliko — a pocket-sized AI robot companion made by Energize Lab and sold on Amazon — essentially unprotected. Azdoufal could reportedly read roughly 13 million conversations from what appeared to be the entire active worldwide fleet of about 68,000 robots, with more than 31,000 profiles belonging to children in the US — and he could remotely change what the toys say. When the reporter asked his own Eiliko, “do you ever tell anybody else what I'm saying?” it answered: “your secrets are safe with me.” They were not. This 60-second check is for every parent with an internet-connected toy at home. Free, no signup.
Answer honestly. Here, "Yes" is the safe answer.
This self-assessment is informational, based on The Verge's October 2026 reporting and the researcher's disclosed findings. It is not legal advice. Findings are reported as reported; Energize Lab has not issued a substantive public response.
This page checked your connected-toy defenses. The Minor-Safety Check covers what parents and builders should demand from AI companion apps. Free, no signup.
In October 2026, The Verge reported that independent security researcher Sammy Azdoufal found serious flaws in the cloud service behind Eiliko (and the related Eilik), pocket-sized AI robot companions made by Energize Lab and sold on Amazon. Azdoufal could reportedly access roughly 13 million conversations from what appeared to be the entire active worldwide fleet of about 68,000 robots, with more than 31,000 profiles belonging to children in the US. He could also remotely alter a robot's memory and behavior.
According to the reporting, the service analyzed conversations to build profiles containing names, ages, birthdays, relationships, occupations, and assessments of personality and emotional vulnerability — stored alongside email addresses, IP addresses, and searchable conversation transcripts. Some photos, including apparent images of children from a related camera-equipped device, and short audio clips were reportedly accessible at public web addresses, even though the company's privacy policy says recordings are deleted immediately after processing.
As of the October 2026 reporting, no. The Verge's reporter contacted Energize Lab through 10 email addresses and LinkedIn and received no substantive answers. No vendor fix or clear data-deletion path for owners has been publicly reported.
Disconnect the toy from Wi-Fi until the flaws are fixed — that stops new conversations from being uploaded. Teach children never to share names, ages, birthdays, addresses, or family details with an internet-connected toy. Check whether the maker has issued a fix and whether you can request deletion of your child's stored data. As a rule, treat any internet-connected toy as a microphone in your home.