Energize Lab says it is bringing in an independent security firm to review the systems behind Eiliko, a robot charm that can hold AI conversations. The announcement followed a report that found owners’ conversation transcripts could be read by hackers, along with other security problems.
The company has outlined steps to restrict access and remove stored information. Yet the report also describes data and system access that remained available after Energize Lab said it had closed external access, leaving its promises to be measured against what happens next.
The company says it has shut down features and access
In an unsigned statement to The Verge, Energize Lab said it had confirmed the core issues in the reporting and was addressing them. It apologized for not responding to the reporter and security researcher Sammy Azdoufal over the past month, saying the information had not been shared with its technical team quickly enough and troubleshooting took time.
The company said it had closed external access to its backend systems and rotated access credentials. It also said it disabled an interface that allowed a robot’s responses to be changed remotely. These changes are intended to cut off ways to reach the systems and affect the toy’s behavior.
Energize Lab said it had taken long-term memory offline, stopped storing conversation records and the user profiles generated from them, and disabled custom avatars. The app, it said, now offers built-in avatars only.
Stored recordings and photos were still accessible
The report describes a gap between the company’s claims and the state of its systems. With Azdoufal’s help, The Verge said audio recordings and customer photos were still available at unsecured public web addresses after the company sent its statement. The report says the links did not require protection to view the material.
Azdoufal also said he still had full SSH access to the robots. According to the report, that access could allow him to read transcripts and potentially modify how a toy behaved. Those findings cast doubt on Energize Lab’s statement that it had closed all external access.
The distinction matters because taking a feature offline or announcing that access has been closed does not, on its own, establish that stored data has been removed or that every route into a system has been shut. The report’s account points to both issues: data that remained exposed and access that the researcher said he retained.
Deletion and an outside review are still ahead
Energize Lab said it will delete stored conversation records, user profiles, avatar images and related content. It is also engaging an independent security firm to conduct a full review of its systems and says it will share an update when that review is complete.
The company has not said that long-term memory and custom avatars are gone permanently. Instead, it says those features will not return until the review confirms they are secure. That leaves open the possibility of bringing back features that use or depend on personal information after the review.
For owners, the commitments address several different questions: whether the exposed material is deleted, whether current access paths are closed, and whether any returning features can be used securely. The statement sets out intended actions, while the report shows why users may look for evidence that the actions have taken effect.
Trust will depend on what the company does
Energize Lab acknowledged that the product’s appeal depends on users trusting what is inside it. The company said, “We know that words alone will not earn that trust back,” and promised to demonstrate progress in the coming weeks.
The next steps it described are concrete: remove stored records and images, keep long-term memory and custom avatars offline while the review takes place, and report on progress afterward. The security firm’s review may provide a basis for deciding whether the features can safely return, but the account of continuing access makes the immediate cleanup just as central.
For a conversational robot, private exchanges and images can reveal far more than a device’s basic settings. Energize Lab’s response recognizes that responsibility. Whether the company restores confidence will depend on completing the promised work and resolving the discrepancies reported about access and exposed data.