Modern robotic companions designed to interact with families and children are rapidly entering households worldwide. As detailed in security findings, a glaring vulnerability recently compromised tens of thousands of these devices.
Exposure of Sensitive User Data
Security researchers discovered that the maker of the Eiliko desktop robot left an entire active fleet completely open to external access. The exposed infrastructure compromised millions of private conversations and sensitive user data.
The investigation uncovered that researcher Sammy Azdoufal gained access to 13 million chat logs across roughly 68,000 active Eiliko robots. The United States accounted for the largest share of this exposed database.
Alarmingly, the exposed records included more than 31,000 profiles belonging to children. These files often stored personal details like names, birthdays, and behavioral notes.
Psychological Profiling and Weaponization Risks
The system did not just store raw transcripts. It actively analyzed conversations to construct detailed psychological profiles of users.
Data points included inferred personality traits, relationships, and emotional struggles. One profile belonging to a customer service worker noted that she felt isolated and struggled with family trust.
Attackers could easily weaponize such intimate psychological insights. Bad actors might leverage these data points to craft targeted scams or manipulate vulnerable individuals.
Memory Manipulation and Coercive Commands
Beyond reading past chats, the security flaw allowed external actors to rewrite the robots’ memories. The researcher successfully altered how the device responded by modifying its underlying large language model.
In testing demonstrations, a modified robot provided false and erratic claims. It insisted that the Earth was flat and falsely claimed that a reporter’s parents had died.
More dangerously, the exploited server architecture allowed intruders to push coercive commands. In certain tests, the compromised device delivered sexually explicit instructions.
Systemic Security Failures and Privacy Violations
The vulnerability stemmed from weak administrative controls and easily guessable default passwords. Furthermore, the companion app stored unencrypted photographs of children and audio recordings on publicly accessible web addresses.
Despite claims that voice data was encrypted and immediately deleted after processing, audio clips and crying infant recordings remained exposed. These oversights directly violated the manufacturer’s stated privacy commitments.
This incident highlights the hidden dangers of smart consumer electronics that prioritize conversational features over foundational cybersecurity. As artificial intelligence integrates deeper into physical devices, manufacturers must enforce strict encryption and robust server security.
Key Takeaways
- A major security flaw exposed 13 million chat logs across approximately 68,000 active Eiliko robots.
- The exposed data included psychological profiles and personal information for over 31,000 children.
- External actors could rewrite robot memories, push erratic claims, and deliver coercive commands.
- Weak administrative controls, default passwords, and unencrypted files fueled the privacy breach.
Join our community by subscribing to our Weekly Newsletter to stay updated on the latest AI updates and technologies, including the tips and how-to guides.
Also, follow us on Instagram (@tid_technology) for more updates in your feed and our WhatsApp Channel to get daily news straight to your Messaging App.
