Eiliko maker says it’s hiring an ‘’independent security firm’ after Verge report on its insecure robots

Eiliko, the maker of a small AI‑powered robot charm that can be attached to a bag or keyring, has announced that it will engage an independent security firm to review the product after a detailed investigation by The Verge revealed significant vulnerabilities. The toy, which markets itself as a conversational companion capable of answering questions and holding brief chats, had been promoted with the claim that “your s are safe with me.” The investigative report, authored by journalist Sean Hollister and security researcher Sammy Azdoufal, described how the device’s communications could be intercepted, allowing anyone with modest technical skill to read full transcripts of user interactions and potentially gain access to further data stored on associated cloud services.The Verge’s analysis began after several owners reported unusual behaviour, prompting the researchers to examine the device’s network traffic and firmware. Their findings indicated that the robot transmitted audio recordings and text exchanges over an unencrypted HTTP connection to servers operated by the company’s parent, Energise Lab..

Because the data were not protected by encryption, a passive eavesdropper on the same Wi‑Fi network could capture the entire conversation in real time. In addition, the researchers discovered that the device’s firmware could be altered through a simple over‑the‑air update process that lacked signature verification, opening the door to malicious code injection.Eiliko’s response to the report was initially silent. Over the course of a month, The Verge attempted to contact the company’s chief executive, Shaw Yeung, and other senior staff via email and social media, but received no replies..

The lack of comment was noted in the article, which highlighted the difficulty consumers face when seeking accountability from small tech firms. It was only after the story went live that Eiliko issued a brief statement acknowledging the “core issues” identified by the researchers and confirming that it had engaged a third‑party security firm to conduct a comprehensive audit of the product and its backend infrastructure.In its statement, Eiliko said the independent firm would assess the device’s firmware, network protocols and cloud services, and that any findings would be addressed through software patches and updated security practices. The company added that it remained committed to user privacy and would “take appropriate steps to ensure that data is protected in accordance with industry standards.” No name was given for the security firm, and the timeline for the review was not disclosed, leaving analysts to wonder whether the audit would be completed before further sales or updates are rolled out.Industry experts say that the move to bring in an external security auditor is a standard remediation step when a product is found to have systemic flaws..

“Independent verification can restore some confidence, but it is crucial that the findings and any remedial actions be made public,” noted Dr Anita Patel, a cyber‑security lecturer at the University of Manchester. “Transparency is essential for consumers to understand the risks they face and for the market to hold manufacturers accountable.” Patel added that the company’s prior lack of communication could undermine trust, even if the technical issues are eventually resolved.Consumer advocacy groups have called for a broader review of AI‑enabled toys, arguing that the rapid proliferation of such devices has outpaced regulatory frameworks. The UK’s Office for Product Safety and Standards (OPSS) has previously warned that many smart toys on the market do not meet basic data‑protection requirements under the UK General Data Protection Regulation (GDPR)..

In a recent briefing, the OPSS highlighted that manufacturers must conduct “privacy‑by‑design” assessments before launching products that collect or process personal data, a principle that appears to have been overlooked in the case of Eiliko’s robot charm.The Verge’s investigation also raised questions about the broader ecosystem that supports the toy. The researchers identified that the device’s companion app, available for both iOS and Android, stored user identifiers and conversation logs on a cloud database that was accessible through a poorly protected API endpoint. While the company claimed that the data were anonymised, the lack of encryption and authentication meant that a determined attacker could potentially link logs to individual users, contravening the promises made in the product’s marketing materials.Eiliko’s parent company, Energise Lab, has not released detailed financial data, but market analysts estimate that the robot charm has generated several million dollars in revenue since its launch earlier this year..

The device’s popularity was buoyed by its low price point and the novelty of having an always‑ready conversational partner, a niche that other manufacturers have begun to explore. The recent security concerns could therefore have ripple effects across the emerging sector of AI‑driven consumer accessories, prompting rivals to reassess their own security postures.Legal observers suggest that the company could face regulatory scrutiny if the audit confirms that user data were mishandled. Under the UK GDPR, organisations are required to report personal data breaches to the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of them, and may be subject to fines of up to 4 percent of global turnover..

Should the ICO deem that Eiliko failed to implement appropriate technical and organisational measures, the firm could be compelled to provide compensation to affected users in addition to any monetary penalties.As of the latest update, the independent security firm has not yet published its findings, and Eiliko has not announced a timeline for releasing patches to existing devices. Users who have purchased the robot charm are advised to disconnect it from Wi‑Fi networks until further notice, and to delete any conversation histories stored in the companion app if they are concerned about privacy. The incident underscores the challenges faced by emerging AI products that blend affordability with advanced features, and highlights the need for robust security practices to keep pace with consumer expectations..