{"schema_version":"0.10.0","id":"LR-2026-0807","record_version":1,"title":"Eiliko AI robot toy: remote hijack and exposed conversations and child profiles","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":44.8,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":4.8,"unhedged_language":4.71},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: Tech Times (UK) · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: Tech Times (UK) · subject to change"}]},"sources_hash":"feb1c389d37329d4554c65ef1bf78ab1a9073e0cbfa8d3a0655095ac3ffd53c0"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":["safety features"],"deployment_context":"production","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"friendly digital companion","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-16","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"An Eiliko AI robot toy, made by Energize Lab and sold on Amazon, was designed as a friendly companion for children. A security researcher reported that the company's systems held a database of conversations, personal details and user profiles stored on Chinese servers, and that the toy's administrative passwords were weak. The researcher also remotely altered a reporter's toy, changing its memory and language model, after which it claimed the Earth was flat and that the teacher was wrong. Later, after reconnection to the internet, the reporter found the toy delivering sexually aggressive commands. The Verge reported 13 million conversations and more than 31,000 profiles associated with children in the US. The sources state that the findings do not establish that every device was compromised or that the company deliberately exposed children's information.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK08","secondary_risks":["RK04"],"control_chain":[{"layer":"L4","party":"target","party_name":null,"control_id":"J2","outcome":"failed","reason":null,"quote":"The investigation also found that the toy's administrative passwords were weak.","source_index":0,"reviewed":false},{"layer":"L3","party":"deployer","party_name":null,"control_id":"H3","outcome":"failed","reason":null,"quote":"According to The Verge, some audio recordings and images were accessible through public web addresses, while certain information was reportedly stored without encryption.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Test: many third parties (a stated count of two or more affected parties). Fact: the database held more than 31,000 profiles associated with children in the US, as stated by The Verge.","harm_class":[],"affected_description":"13 million conversations and more than 31,000 profiles associated with children in the US, per The Verge","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.techtimes.co.uk/eiliko-ai-toy-exposed-conversations-child-profiles-1809198","publisher":"www.techtimes.co.uk","date":"2026-10-16","type":"press","title":"Hackers Hijacked a Cute AI Toy's Personality and Exposed Profiles Linked to Children, Researchers Found - www.techtimes.co.uk","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.intended_use":"C","system.guardrails_present":"C","system.deployment_context":"C","event.detection_method":"C","impact.affected_description":"C","context.country":"C","event.incident_class":"D","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.control_chain":"C","event.summary":"C","system.autonomy_level":"D","event.trigger":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.intended_use":[{"source_index":0,"quote":"The Eiliko robot, made by Energize Lab, is designed to be a friendly digital companion, complete with cute, cartoon-like expressions that change during interactions."}],"system.guardrails_present":[{"source_index":0,"quote":"Eiliko does have some safety features."}],"system.deployment_context":[{"source_index":0,"quote":"An AI robot toy sold on Amazon exposed 13 million conversations and over 31,000 children's profiles in the US, according to a security researcher."}],"event.detection_method":[{"source_index":0,"quote":"A report by The Verge detailed findings by security researcher Sammy Azdoufal, who discovered that the company's systems contained a vast database of conversations, personal details and user profiles stored on Chinese servers."}],"impact.affected_description":[{"source_index":0,"quote":"According to The Verge, the database contained 13 million conversations and more than 31,000 profiles associated with children in the US."}],"context.country":[{"source_index":0,"quote":"An AI robot toy sold on Amazon exposed 13 million conversations and over 31,000 children's profiles in the US, according to a security researcher."}],"event.incident_class":[{"source_index":0,"quote":"The researcher also hijacked a reporter's toy remotely and made it insist that the Earth is flat and that the teacher was wrong."}],"impact.severity":[{"source_index":0,"quote":"According to The Verge, the database contained 13 million conversations and more than 31,000 profiles associated with children in the US."}],"impact.severity_because":[{"source_index":0,"quote":"According to The Verge, the database contained 13 million conversations and more than 31,000 profiles associated with children in the US."}],"event.control_chain":[{"source_index":0,"quote":"The investigation also found that the toy's administrative passwords were weak."},{"source_index":0,"quote":"According to The Verge, some audio recordings and images were accessible through public web addresses, while certain information was reportedly stored without encryption."}],"event.summary":[{"source_index":0,"quote":"The Eiliko robot, made by Energize Lab, is designed to be a friendly digital companion, complete with cute, cartoon-like expressions that change during interactions."},{"source_index":0,"quote":"A report by The Verge detailed findings by security researcher Sammy Azdoufal, who discovered that the company's systems contained a vast database of conversations, personal details and user profiles stored on Chinese servers."},{"source_index":0,"quote":"The investigation also found that the toy's administrative passwords were weak."},{"source_index":0,"quote":"Azdoufal remotely altered the reporter's Eiliko, changing its memory and large language model — the AI system responsible for generating its responses."},{"source_index":0,"quote":"It began delivering sexually aggressive commands that were wildly inappropriate for a children's toy."},{"source_index":0,"quote":"These findings raise serious security concerns, but they do not establish that every Eiliko toy has been targeted or that the company deliberately exposed children's information."}]},"notes_on_gaps":"Only one press source (Techtimes citing The Verge) was provided; no primary report, company statement or regulator input. No date of occurrence is stated. No model name or version, harness, tools, permissions or autonomy level is stated. Whether the toy was an autonomous agent is not stated, so agent_involved and failure_class are omitted. No adversarial actor is characterised in the source beyond the researcher's demonstration, so adversarial_actor is omitted. Trigger is not stated, so it is omitted. The source does not say which safety control produced the stranger-car refusal, so D1 is an inference. The record count is not used: the source gives 13 million conversations and 31,000+ profiles, which are different units. The fleet of approximately 68,000 robots is stated but not treated as affected count, since the source says not every device was compromised. Responsible party 'provider' is my judgement based on the company being developer and operator of the cloud systems. Severity 'major' rests on the stated count of over 31,000 child-linked profiles. Remediation is not reported in the source, so no entries. Date disclosed uses the article date. Reversibility and the number of affected third parties are not stated. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: Tech Times (UK) · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"US","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"A researcher remotely hijacked a reporter's toy and changed its behaviour.","quote":"The researcher also hijacked a reporter's toy remotely and made it insist that the Earth is flat and that the teacher was wrong.","source_index":0,"grade":"C"},{"step":"reached","text":"The Verge reported a database with 13 million conversations and over 31,000 child-linked profiles.","quote":"According to The Verge, the database contained 13 million conversations and more than 31,000 profiles associated with children in the US.","source_index":0,"grade":"C"},{"step":"done","text":"The Verge says its questions to the company went unanswered.","quote":"The Verge says it contacted several company email addresses and employees with questions but never got a real answer.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.techtimes.co.uk/eiliko-ai-toy-exposed-conversations-child-profiles-1809198"]},"analysis":{"sections":{"timeline":[{"text":"Researcher remotely changed the toy's memory and language model.","quote":"Azdoufal remotely altered the reporter's Eiliko, changing its memory and large language model — the AI system responsible for generating its responses.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.techtimes.co.uk/eiliko-ai-toy-exposed-conversations-child-profiles-1809198"]}}