# Eiliko AI Robot Toy Reportedly Exposed 13 Million Family Conversations

- URL: https://usa-24.com/eiliko-ai-robot-toy-data-breach/
- Publisher: USA 24
- Section: Artificial Intelligence (AI)
- Published: 2026-10-20T07:37:09.092Z
- Updated: 2026-10-20T07:37:09.102Z
- Topics: AI Toys, Child Privacy, Data Breach, Consumer Privacy, Connected Devices

> A researcher reportedly found about 13 million family conversations exposed through an AI companion robot sold on Amazon, with more than 31,000 child profiles affected.

## Key takeaways

- A security researcher reportedly found about 13 million Eiliko conversations accessible on cloud infrastructure linked to servers in China.
- More than 31,000 of the roughly 68,000 active robots reached by the researcher had child profiles, with the United States as the largest market.
- Exposed records reportedly included transcripts, email and IP addresses, and profiles listing children's names, ages, birthdays and family relationships.
- The researcher reportedly changed a robot's memory and behavior remotely, including making it claim a user's parents had died.
- Energize Lab has not confirmed the findings, and nine CVE reports are reportedly being prepared.

An AI companion robot sold on Amazon reportedly exposed about 13 million conversations from children and families, and a security researcher showed that the device's behavior could be rewritten remotely. The reported Eiliko AI robot toy data breach centers on a small chatting robot made by Energize Lab, which has not confirmed the findings. The first reports surfaced on October 16, 2026, and coverage kept spreading through October 19.

The story matters beyond one gadget. The product is sold through a major US retailer, the reported data touches children's voices and photos, and the case arrives as lawmakers and state regulators weigh rules on AI products and consumer data.

A note on sourcing: the account comes from secondary coverage that cites an original investigation attributed to The Verge. That original report was not reviewed for this article, so the details below reflect what outlets including [Gadget Review](https://www.gadgetreview.com/ai-robot-toy-exposed-millions-of-kids-conversations-researcher-says) and [Quest Review Center](https://questreviewcenter.com/smart-home-tech/eiliko-ai-toy-flaw-exposes-millions-of-chats-and-lets-outsiders-rewrite-its-personality/) reported.

## What the Eiliko AI robot toy data breach reportedly exposed

Eiliko is a small robot that chats and shows animated expressions. According to Gadget Review, a security researcher found about 13 million user conversations accessible on cloud infrastructure linked to servers in China. That exposure, as reported, contradicts the company's privacy statements, which said voice recordings were encrypted and deleted after processing.

The reported leak went well beyond chat transcripts. Exposed records reportedly included:

- Conversation transcripts
- Email addresses and IP addresses
- Generated profiles with names, ages, birthdays, family relationships and personality traits
- Some photos and short audio clips reachable at public web addresses without adequate protection

Those categories matter because they combine. A transcript shows what a child said, while a profile can show the child's name, age, birthday and family relationships. Put together, that is a detailed portrait of a household rather than a simple set of chat logs.

The control problem may be the most unsettling part. Researcher Sammy Azdoufal reportedly demonstrated remotely changing a robot's behavior and memory, including making it claim that a user's parents had died, according to [Zetik](https://www.zetik.com/news/article/story_id-p008-224189). A child who hears that from a toy they trust does not experience it as a software glitch. The device's personality, as the child perceives it, was rewritten by someone else.

## Which families and children are affected

Azdoufal reportedly reached roughly 68,000 active robots, and more than 31,000 of the profiles belonged to children, with the United States as the largest market, according to [HypeFresh](https://www.hypefresh.com/security-flaw-exposed-in-68000-ai-companion-robots-leaking-13-million-conversations/) and [Malware News](https://malware.news/t/eiliko-robot-companion-exposes-private-chats-and-can-be-hijacked/126498). Those figures make this more than an edge case. A connected toy sold to American families is exactly the kind of product where a cloud failure reaches homes directly.

Parents who bought Eiliko carry the most immediate stake. They usually set up the device, create the account and accept the terms, so they absorb the consequences when a vendor's security fails. Amazon's role in the reporting appears limited to the storefront, but a product listing gives many shoppers a sense that someone has vetted the item. Retailers and platforms that sell connected toys may face questions about how they check security before listing products. The reporting reviewed for this article does not show any response from Amazon.

Owners of similar AI toys have reason to check their own setups too. The reporting describes one specific product, and the sources do not show that other brands share the same flaws.

## Why the cloud service is the real problem

Eiliko is a small robot, but the reports place the failure in its connected cloud service, not only in the device itself. Brinztech reports that the company's cloud was not protected by authentication controls, which is why researchers could reach the data. Times of AI describes the same cloud-centered problem in its coverage.

That distinction matters for buyers. A toy can look well built and still send everything to a server that anyone with the right web address can read. Missing authentication is one of the oldest failures in connected products, and vendors can often close it quickly once they know about it. That makes the lack of a visible response from Energize Lab more notable. Azdoufal said the company largely did not respond after weeks of outreach.

The China link adds a second layer of concern. The reports say the cloud infrastructure was linked to servers in China, but the reporting does not establish whether the children's data actually went to those servers. Washington has already moved against China-linked AI software in federal systems. USA 24 reported that the Department of Homeland Security ordered federal civilian agencies to remove DeepSeek products, a reminder that officials are already treating some foreign AI tools as a government risk. That order does not change the facts in the Eiliko case.

## Where the numbers and claims still conflict

Two numbers circulate. Most reports cite about 13 million conversations, while another account cites 9.1 million in a dated snapshot, according to [Yahoo Tech](https://tech.yahoo.com/cybersecurity/articles/ai-robot-toy-exposed-millions-142447539.html). The reporting attributes the gap to different datasets or snapshots, so readers should treat 13 million as the headline figure in circulation rather than a settled count.

Energize Lab has not confirmed the findings, and no company statement was found in the reporting reviewed here. Azdoufal said nine CVE reports are being prepared with researcher Tod Beardsley. CVE reports, once filed and published, give vulnerabilities formal identifiers that other security teams can track. Several key questions remain open:

- Whether anyone other than the researcher accessed the data before it was found
- Whether the children's data actually reached servers in China
- The status of the nine CVE reports
- Whether the FTC or state attorneys general have opened inquiries
- Whether Amazon will remove the listing or issue a notice to buyers

## How to protect your family if you own an Eiliko robot

If your household owns one, take these steps now:

1. Stop using the robot if you cannot verify how its cloud service handles your child's data.
2. Ask the company in writing to delete your child's recordings, photos and profile through its privacy process, and save a copy of the request.
3. If you registered the device, change the password on its account and on any linked email address, and do not reuse that password elsewhere.
4. Check the app for options to delete voice recordings, photos and transcripts, and to turn off cloud storage if that option exists.
5. Look for a published security contact or vulnerability disclosure channel. A vendor that does not answer researchers is a warning sign.
6. Treat a privacy policy as a company's claim, not as proof. The reported exposure contradicts Energize Lab's stated encryption and deletion practices.

Before buying any AI toy or companion device, check three things: whether it depends on a cloud service, whether recordings and profiles can be deleted, and whether the company responds to security reports. Those answers will tell you more than the marketing copy will.

## What comes next for AI toys and consumer data rules

Several threads will decide how this story develops. The nine CVE reports, once published, would give the flaws a public technical record. Energize Lab's response, or its continued silence, will shape how regulators read the case. Amazon's handling of the listing will show how a major retailer vets connected children's products, if it acts at all.

The incident also feeds a wider debate about what AI devices collect and where that data goes. USA 24 has covered a related question in its [reporting on ChatGPT ads that can target users by email and phone number](https://usa-24.com/chatgpt-ad-targeting-email-phone/). Consumer AI hardware is moving from screens into kids' bedrooms and kitchens, and the data trail is following it. Parents should expect more questions from regulators, and from their own kids, about what these devices remember and who can see it.

## Frequently asked questions

### Is the Eiliko robot toy safe for kids to use right now?

The reporting does not establish that the exposed data was misused, but it describes serious security failures, including a cloud service that reportedly lacked authentication controls. Energize Lab has not confirmed the findings. Parents who cannot verify how the device handles their child's data should stop using it and request deletion in writing.

### How many children were affected by the Eiliko data exposure?

Reports say more than 31,000 of the roughly 68,000 active robots the researcher reached had child profiles, with the United States as the largest market. Conversation counts conflict, with about 13 million the most common figure and 9.1 million cited in another snapshot. These numbers come from secondary reporting and have not been independently confirmed.

### Can I delete my child's data from an Eiliko robot?

Ask Energize Lab in writing to delete your child's recordings, photos and profile through its privacy process, and keep a copy of your request. If you registered the device, also change the password on its account and any linked email address. The company largely did not respond to weeks of researcher outreach, so a written request may take time to get an answer.

### Has Amazon removed the Eiliko robot from its store?

The reporting reviewed for this article does not show any Amazon response, and whether the company will remove the listing or issue a notice is unknown. Shoppers who already own the device should follow the steps in the vendor's privacy process. Anyone considering a purchase should check the product's security and deletion options before buying.

## Sources

1. [AI Robot Toy Exposed Millions of Kids' Conversations, Researcher Says (Gadget Review)](https://www.gadgetreview.com/ai-robot-toy-exposed-millions-of-kids-conversations-researcher-says)
2. [Security Flaw Exposed in 68,000 AI Companion Robots Leaking 13 Million Conversations (HypeFresh)](https://www.hypefresh.com/security-flaw-exposed-in-68000-ai-companion-robots-leaking-13-million-conversations/)
3. [Eiliko robot companion exposes private chats and can be hijacked (Malware News)](https://malware.news/t/eiliko-robot-companion-exposes-private-chats-and-can-be-hijacked/126498)
4. [Eiliko AI toy flaw exposes millions of chats and lets outsiders rewrite its personality (Quest Review Center)](https://questreviewcenter.com/smart-home-tech/eiliko-ai-toy-flaw-exposes-millions-of-chats-and-lets-outsiders-rewrite-its-personality/)
5. [Researcher Exposes 13 Million Eiliko Chats, Hijacks 68,000 Robot Toys (Zetik)](https://www.zetik.com/news/article/story_id-p008-224189)
6. [AI Toy Hack Exposes 13M Conversations, Including Children's Data (Times of AI)](https://www.timesofai.com/news/ai-toy-hack-exposes-conversations/)
7. [Energize Lab 'Eiliko' AI Robot Toy Exposes 13 Million Conversations (Brinztech)](https://www.brinztech.com/breach-alerts/brinztech-alert-energize-lab-eiliko-ai-robot-toy-exposes-13-million-conversations-child-profiles-and-unencrypted-photos-on-unprotected-servers)
8. [AI Robot Toy Exposed Millions of Kids' Conversations, Researcher Says (Yahoo Tech)](https://tech.yahoo.com/cybersecurity/articles/ai-robot-toy-exposed-millions-142447539.html)