Eiliko Maker Says It Will Hire Independent Security Firm After Breach Report

Energize Lab says it will hire an independent security firm to review its systems after The Verge reported security flaws in Eiliko, its AI conversation robot charm.

The company confirmed the core issues in the report and said it had closed external access to its backend systems, disabled the interface for remotely changing a robot’s responses, and taken the long-term memory and custom avatar features offline. It also said it would delete stored conversation records, user profiles, avatar images, and related content. A dedicated security email address has been set up.

However, The Verge reports that when the company sent its statement, it was still storing customer audio recordings and photos at unsecured public web addresses. Security researcher Sammy Azdoufal also told the publication he still had full SSH access to the robots and could theoretically read transcripts and change their behavior. These findings call into question the company’s claim that it had closed all external access.

Energize Lab said long-term memory and custom avatars will remain unavailable until the security review confirms they are secure. The company apologized for not responding to the reporter and Azdoufal over the past month, and said it plans to update readers after the review is complete.