The Eiliko Robot Just Lost Its Memory. Here Is What Happened.
Energize Lab, the company behind the Eiliko robot, has hired an outside security firm to check its systems from top to bottom. It has also confirmed the main problems that The Verge reported about the robot.
Eiliko is a small robot toy with a built-in AI companion. When it is offline, it answers simple commands with cute animations. When it is online, it chats with you the way an AI assistant does.
On 15 October, The Verge reported that Eiliko sends everything users say to insecure servers in China. The next day, a Malwarebytes write-up said the flaws could expose private conversations. It also said someone could change what the robot says.
Energize Lab says it has shut off outside access to its backend. The backend is the hidden part of the system, like the kitchen behind a restaurant. The company has also changed all of its access passwords and keys, so the old ones no longer work. It has turned off the feature that let someone edit the robot's replies remotely.
Two features are now offline. Long-term memory is down, and the company says it no longer keeps conversation records or the profiles built from them. Custom avatars are also off, so the app only offers built-in ones. Energize Lab says it will delete stored conversation records, profiles, avatar images and related content.
Those two features will stay off until the security review says they are safe. Anyone with questions or security findings can email security@energizelab.com.
Energize Lab says its website shows it was funded in 2019. It has spent years making robot toys and servos, the small motors that move a robot's parts. Its lineup, listed on its online store, includes the Eilik, Eiliko and Panxer. The Eilik is described as an open-source desk companion, and its desktop software runs on Windows 8.1 or later. Eiliko is the product at the center of this problem.
The broader context here is how devices like this are built. Much of what makes Eiliko seem smart happens on a remote server, not inside the robot. That is where the security protection has to be. The animations and movements happen on the robot itself. The conversations, memory and personal touches depend on the server. That explains why the company's steps focus on the server, its passwords and its stored data.
In my view, the company is taking the right steps in the right order. It closed the doors, changed the locks, removed the remote editing and deleted stored personal data before turning anything back on. The harder issue is bigger than one toy. A robot that people talk to privately, whether children or adults, quietly keeps a pile of personal information. Every saved conversation is a risk until it is deleted.
The hopeful side is also worth noting. Small hardware makers can act fast when a problem is raised. An independent review, with a public promise to bring features back only after they pass, is a sensible way to earn trust again. Whether the memory and avatar features return, and how, will depend on what the review finds and what the company publishes afterward.
