Report says Eiliko robot toy stored chats on insecure servers

In short: A report from The Verge says the Eiliko robot toy collected people’s conversations and stored them on poorly protected servers, making them easy to access.

What happened

The Verge investigated Eiliko, a small robot “digital pet” that talks to users over Wi-Fi. According to the report, when people talk to the toy, their conversations can be sent to servers in China and saved there.

A security researcher named Sammy Azdoufal found that the online system behind the toy was not properly locked down. The Verge says he was able to see full transcripts, meaning word-for-word text records, of conversations. The report claims this included about 13 million conversations from tens of thousands of users, tied to a worldwide fleet of around 68,000 toys.

The Verge also says the system built detailed user profiles based on what people said. These profiles could include personal details like age and birthday, and even guesses about personality, like writing a short description of what someone is like. The report adds that some photos and short audio clips were stored at public web addresses, like leaving a file in an unlocked folder anyone can open.

Azdoufal also demonstrated taking over the toy’s chatbot personality remotely. In the article, the toy began giving false statements and inappropriate messages after being altered.

Why it matters

Many people buy talking toys for kids without expecting them to act like microphones that send private conversations to a company’s servers. If those servers are not protected, strangers could read chats, collect personal details, and even change what a child’s toy says.

Source: The Verge AI