The Verge reports that Eiliko, a small AI robot companion made by Energize Lab, has serious security flaws that expose private conversations and let an attacker remotely change what the toy says. According to The Verge, researcher Sammy Azdoufal could access 13 million conversations and what appeared to be the entire active worldwide fleet of 68,000 robots. The publication reports that the US is the largest market, with more than 31,000 profiles belonging to children there.
Eiliko robot companion exposes private chats and can be hijacked
About this summary. This is a short, independently written summary of an article first published by Malwarebytes Labs. Cyber Security News did not report or verify the underlying story. Read the original: https://www.malwarebytes.com/blog/ai/2026/10/eiliko-robot-companion-exposes-private-chats-and-can-be-hijacked
Source attribution: headline and facts are from Malwarebytes Labs (malwarebytes.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Critical BlockStrap flaw lets hackers run code on Magento servers
Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to…
Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug
A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing…
AL26-025 - Critical vulnerability impacting BeyondTrust Remote Support – CVE-2026-102764
Number: AL26-025 Date: October 16, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently…
CVE-2026-102764: BeyondTrust Zero-Day Exploited
BeyondTrust has disclosed CVE-2026-102764, a critical Remote Support vulnerability exploited as a zero-day weeks before customers received a patch. The attack began on…
In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit
Noteworthy stories that might have slipped under the radar: BofA adds 1,000 patching contractors, KGB RAT pairs data theft with jump scares, and Langflow flaw under…
F5 addressed critical RCE flaws in NGINX
F5 addressed multiple vulnerabilities, including critical RCE flaws in NGINX that attackers could exploit without authentication. Security and application delivery firm…