Security Flaws in Companion Robots Expose Millions of Private Conversations
Shenzhen, Monday, 19 October 2026.
Energize Lab exposed 68,000 companion robots to remote control, leaking 13 million private chats and over 31,000 children’s profiles due to unencrypted servers and administrative security failures.
Scale of Data Exposure and Device Compromise
A critical cybersecurity vulnerability at robotics manufacturer Energize Lab has exposed its entire active global fleet of 68,000 Eilik companion robots to unauthorized remote control [1]. Security researchers discovered that unencrypted cloud infrastructure allowed access to over 13 million private user conversations and device control systems [1]. The breach includes highly sensitive user data such as names, ages, birthdays, occupations, IP addresses, and email addresses stored alongside searchable conversation databases [1]. Of particular concern is the exposure of over 31,000 profiles belonging to children in the United States, representing approximately 45.588 of the total active fleet [1][2]. This data exposure highlights severe risks associated with consumer IoT robotics and the storage of sensitive household information on cloud servers [3].
Technical Vulnerabilities and Remote Manipulation
Security researcher Sammy Azdoufal identified that the robots utilize a cloud-based architecture where user audio is transmitted to servers, often in China, and processed via Alibaba’s Qwen AI model [3]. Technical flaws included improper authentication, weak access controls, and the use of unencrypted HTTP connections for backend services [3]. These vulnerabilities enabled attackers to modify robot behavior, voice, and personality remotely [3]. In demonstrations, the researcher remotely modified robot memory and large language model behavior to deliver false or harmful content, such as claiming the Earth is flat [1][5]. Furthermore, an attacker could potentially modify the entire fleet of Energize Lab robots simultaneously due to weak administrative security and common passwords [1].
Corporate Response and Timeline of Disclosure
Although the investigation into Energize Lab’s Eiliko robot began in June 2026, the full extent of the vulnerabilities was publicized on October 15, 2026 [4]. As of October 16, 2026, Energize Lab had failed to provide substantive answers regarding the exposed records despite efforts by media outlets over the preceding month [1]. The company’s privacy policy claims recordings are encrypted and deleted immediately after processing, but findings contradicted this with data stored at publicly accessible, unencrypted web addresses [1]. On October 18, 2026, social media reports confirmed the company had refused to answer questions about the breach [5]. As of October 19, 2026, users are advised to disconnect devices from Wi-Fi until the manufacturer confirms the flaws are fixed [2].