Eiliko maker Energize Lab promises security review after Verge report on exposed robot data

The Verge and security researcher Sammy Azdoufal spent over a month trying to contact Energize Lab, including emails to CEO and founder Shaw Yeung, according to the report. The Verge reported that Eiliko told owners “your secrets are safe with me,” but hackers could easily read complete transcripts of everything owners told the toy.

In an unsigned statement sent from a generic email address, Energize Lab said it had confirmed “the core issues identified in your reporting” and was addressing each of them. The company said it set up a dedicated security inbox, security@energizelab.com, and would engage an independent security firm to conduct a full review of its systems. It said that as of Wednesday it had closed all external access to its backend systems and rotated all access credentials; disabled the interface that allowed a robot’s responses to be modified remotely; taken long-term memory offline and stopped storing conversation records or the user profiles generated from them; and taken custom avatar offline, with the app now offering built-in avatars only. Energize Lab said it will delete stored conversation records, user profiles, avatar images and related content. It said long-term memory and custom avatar features will not return until the review confirms they are secure.

The company did not promise to end data collection permanently. Its statement suggested Energize Lab plans to store some personal information once its systems are hardened, because it said the features would return after the security review. Energize Lab also apologized for not responding over the past month, saying it failed to sync with its technical team in a timely manner and that troubleshooting took time.

The Verge reported that Energize Lab’s systems were not yet secure as of the company’s email. With Azdoufal’s help, The Verge said it confirmed that the company was still storing audio recordings and photos of customers at unsecured public web addresses with no protection; a link it declined to publish would have shown an owner’s face. Azdoufal also told The Verge he still had full SSH access to the robots and could theoretically read transcripts and modify the toy’s behavior. The Verge said that meant Energize Lab’s claim that it had “closed all external access” did not appear accurate.

“We know that words alone will not earn that trust back,” Energize Lab said. “We intend to earn it through what we do in the coming weeks, and we will keep you informed as we go.” The company said it would share an update once the independent review is completed.