GoKawiilEnergize Lab moves to fix security flaws in Eiliko robot after Verge investigation
Energize Lab, maker of the Eiliko companion robot, says it has closed external access to its backend systems, rotated credentials, and disabled a remote interface that allowed robot responses to be altered after a Verge report exposed security flaws. The company has also disabled the robots' long-term memory and custom avatar features, saying it will delete stored conversation records, user profiles and avatar images, and will hire an independent security firm to review its systems before restoring those features.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident highlights how consumer AI companion devices can expose intimate data—conversation logs, user profiles, images—through poorly secured backend systems, raising broader questions about oversight in a fast-growing product category. Energize Lab's month-long delay in responding to researchers suggests gaps in its vulnerability-disclosure process, which could affect user trust even as it pledges reforms. The promised independent audit may set a precedent for how small hardware startups handle security failures.
- Energize Lab disabled remote access, credential vulnerabilities, long-term memory, and custom avatars on its Eiliko robots.
- The company apologized for a month-long delay in responding to a security researcher's disclosure.
- An independent security firm will review the systems before memory and avatar features return.
Source: theverge.com — Sean Hollister, 2026-10-22
Published there as: “Eiliko maker says it’s hiring an ‘independent security firm’ after Verge report on its insecure robots”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.