Energize Lab Locks Down Eiliko Robot Companion Following Privacy Report
Energize Lab says it has engaged an independent security firm to conduct a full review of its systems, and it has confirmed the core issues identified in The Verge's reporting on its Eiliko robot. The company's statement, dated 22 October 2026, describes a set of immediate containment steps and a plan to restore two features only after the review is complete.
The problems were first laid out by The Verge on 15 October, which reported that Eiliko sends everything users tell it to insecure Chinese servers. A Malwarebytes write-up published the following day said the device's security flaws expose users' private conversations and allow remote changes to what the robot says. Eiliko is a robot toy charm with a built-in AI companion. It responds to offline commands with cute animations, and when online it functions as an AI chat companion.
Energize Lab says it has closed all external access to its backend systems, meaning the server-side software that users never see, and rotated all access credentials, replacing passwords and keys so the old ones no longer work. It has also disabled the interface that allowed a robot's responses to be modified remotely, which addresses the second flaw class Malwarebytes described.
The company has also taken two features offline. The long-term memory feature is down, and Energize Lab says it no longer stores conversation records or the user profiles generated from them. The custom avatar feature is also offline, and the app now offers built-in avatars only. Energize Lab says it will delete stored conversation records, user profiles, avatar images, and related content.
Energize Lab says long-term memory and custom avatars will not return until the security review confirms they are secure. Users with questions or findings can write to security@energizelab.com, a dedicated inbox the company has set up.
Energize Lab, which its website says was funded in 2019, states that it has been developing robot toys and robot servos, the small motors that drive a robot's moving parts, over the years. Its product line, as listed on its online store, includes the Eilik, Eiliko and Panxer robots. The company describes Eilik as an open-source desk companion, and its Eilik desktop software supports Windows 8.1 or later. Eiliko is the product at the center of the current issue.
The broader context here is the architecture of companion devices like this one. Much of the perceived intelligence in a product such as Eiliko lives in a remote service rather than on the hardware, so the security boundary sits in the backend. The offline command set, the animations and the servo-driven motion are largely local behavior. The conversational layer, the memory and the personalization depend on the server side. That is why the steps Energize Lab has listed concentrate on backend access control, credential rotation and the response-modification interface, along with the removal of stored data.
In my view, the sequence of measures is the right order for a consumer device with this profile: cut external access, rotate secrets, remove the remote-edit path, and purge retained personal data before reintroducing features. The harder question for the category is structural. A product that markets private, personal conversation to a child or a desk-bound adult creates a data store that most owners never think of as a database. Every retained conversation record and generated profile is a liability until it is deleted, and deletion is only as good as the retention policy behind it.
The optimistic reading is also worth stating. Small hardware companies with open-source roots can move quickly when a problem is put in front of them, and an independent review with a public commitment to restore features only once they pass is a defensible way to rebuild trust. Whether Eiliko's memory and avatar features return, and in what form, will depend on what the review finds and on what Energize Lab publishes when it reports back.
