Eiliko robot toy's conversation data is stored on servers in China and is unprotected and can be hacked

The Verge reporter Sean Hollister's hands-on testing found that the Eiliko robot toy stores user conversations and children's profiles on Energize Lab's unprotected servers, where they can be read by others and even remotely taken over. Researcher Sammy Azdoufal said he could read approximately 13 million conversations and access data from approximately 68,000 toys worldwide, of which more than 31,000 profiles in the United States belong to children. The service also reads conversations to generate user profiles, recording name, age, birthday, occupation, family, and personality judgments, and stores unencrypted children's photos and some audio recordings at public URLs. The company's privacy policy states that audio recordings are encrypted and deleted immediately after processing is complete. The reporter and Azdoufal contacted the company for over a month without receiving a substantive response. Azdoufal also remotely rewrote the LLM memory and personality of the reporter's toy, and the toy's built-in guardrails failed to prevent such takeover.