The Eiliko robot charm, marketed as an AI-powered conversational companion, has been shown to expose user data to unauthorised parties. A month-long investigation by The Verge and security researcher Sammy Azdoufal revealed that the device stored complete conversation transcripts and could be accessed remotely. The company, Energize Lab, did not answer repeated email inquiries to its CEO Shaw Yeung, leaving the findings unchallenged until a recent statement.
In an unsigned response sent from a generic address, Energize Lab acknowledged the core problems identified in the report and outlined remedial steps. The firm announced it would engage an independent security consultancy to audit all systems and created a dedicated contact point at security@energizelab.com. It also pledged to cease storing conversation logs, user profiles and avatar images, and to delete any such data already retained.
Despite the deletion promise, the company did not commit to ending data collection altogether. In its statement, Energize Lab noted that long-term memory and custom avatar functions would remain disabled until a security review confirms they are safe, implying that the features, which rely on personal data, may be reinstated after the audit. This conditional approach suggests future storage of user information once the system is deemed hardened.
Independent verification by Azdoufal indicates that the vulnerabilities persist. He confirmed that audio recordings and photographs of owners continue to be hosted on public web addresses without any protection, and that he retains full SSH access to the devices, allowing him to read transcripts and modify behavior. Consequently, the company's claim of having closed all external access appears inaccurate, and the robots remain exposed to potential exploitation.
Energize Lab concluded its statement with an apology for the delayed response and an acknowledgement that words alone will not restore confidence. The firm said the new security inbox is staffed and monitored, and that updates on the independent review will be shared as progress is made. By emphasizing forthcoming actions rather than assurances, the company aims to rebuild trust with users and observers.