Cases › security breach › LR-2026-0807
Eiliko AI robot toy: remote hijack and exposed conversations and child profiles
Preliminary Why: 1 report: Tech Times (UK) · subject to change · 1 independent report
Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.
Status: action reported, no fix
No source states: loss or records, developer and model, agent tool, could do, deployer, industry.
Severity major: Test: many third parties (a stated count of two or more affected parties). Fact: the database held more than 31,000 profiles associated with children in the US, as stated by The Verge.
An Eiliko AI robot toy, made by Energize Lab and sold on Amazon, was designed as a friendly companion for children. A security researcher reported that the company's systems held a database of conversations, personal details and user profiles stored on Chinese servers, and that the toy's administrative passwords were weak. The researcher also remotely altered a reporter's toy, changing its memory and language model, after which it claimed the Earth was flat and that the teacher was wrong. Later, after reconnection to the internet, the reporter found the toy delivering sexually aggressive commands. The Verge reported 13 million conversations and more than 31,000 profiles associated with children in the US. The sources state that the findings do not establish that every device was compromised or that the company deliberately exposed children's information.
What happened
What was done
Risks
Read from the sources; not yet reviewed by a person.
Controls
ApplicationNot effective Encryption of stored data
Infrastructure / targetNot effective Multi-factor sign-in and password policy
Control failure chain
L1 · ModelProvider not namedModel provider
No source mentions a control at this layer.
Model version not linked to a model card.
L2 · HarnessHarness not namedAgent framework vendor
No source mentions a control at this layer.
L3 · ApplicationDeployer not namedDeployer
Other controls for this risk at this layer, not mentioned in the sources: Vulnerability scanning of AI components, Adversarial testing before deployment, Short-lived, scoped credentials, Live behaviour monitoring, AI incident response plan, Segmentation of agent components.
L4 · Infrastructure / targetOrganisation hit
Other controls for this risk at this layer, not mentioned in the sources: Known flaws patched, Intrusion and endpoint detection, Inventory of exposed services.
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
Controls for this risk: result in this incident
| Control | Part of the system | Result |
|---|---|---|
| Encryption of stored data | L3 Application | Not effective |
| Short-lived, scoped credentials | L3 Application | Not stated in sources |
| Segmentation of agent components | L3 Application | Not stated in sources |
| Live behaviour monitoring | L3 Application | Not stated in sources |
| AI incident response plan | L3 Application | Not stated in sources |
| Vulnerability scanning of AI components | L3 Application | Not stated in sources |
| Adversarial testing before deployment | L3 Application | Not stated in sources |
| Multi-factor sign-in and password policy | L4 Infrastructure / target | Not effective |
| Known flaws patched | L4 Infrastructure / target | Not stated in sources |
| Intrusion and endpoint detection | L4 Infrastructure / target | Not stated in sources |
| Inventory of exposed services | L4 Infrastructure / target | Not stated in sources |
Evidence
No source states: what the AI was doing, how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.
Show the full account: 1 items from the primary sources
What happened, in order
Not dated in the sources:
- Researcher remotely changed the toy's memory and language model.
Show every field, with its source and grade
The AI system
What happened
Impact
Context
Notes on gaps
No date of occurrence is stated. The source does not say which safety control produced the stranger-car refusal, so D1 is an inference. The fleet of approximately 68,000 robots is stated but not treated as affected count, since the source says not every device was compromised. Remediation is not reported in the source, so no entries. Reversibility and the number of affected third parties are not stated.
LR-2026-0807 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON