# AI Robot Toy Data Leak: What to Do If Your Child Has an Eiliko

**Author:** Dan Fitzpatrick
**Canonical URL:** https://parents.theaieducator.io/posts/ai-robot-toy-data-leak-what-parents-should-do
**Published:** 2026-10-22T07:24:53.000Z
**Updated:** 2026-10-22T07:24:55.366Z
**Category:** News and Updates

## TL;DR

Reporters and a security researcher say the Eiliko AI robot, sold on Amazon for around $140, left its maker's servers open. TechSpot (October 17, 2026) reports 13 million conversations and more than 31,000 child profiles; Cybernews (October 16) reports about 8.3 million and almost 32,000. The company has not responded publicly and I found no report of a fix, so these are reports, not findings. If your child has one, take it off Wi-Fi, keep any camera model out of bedrooms, ask for deletion in writing, and tell your child they are not in trouble. Your pediatrician and school safeguarding lead come first if anything the robot said upset them.

## Key takeaways

- Reports from October 15 to 17, 2026 say Energize Lab's Eiliko AI robot left millions of conversations and tens of thousands of child-linked profiles exposed; the company has not publicly responded and no fix has been reported.
- The numbers differ by outlet (13 million conversations in TechSpot, about 8.3 million in Cybernews) because they appear to describe different snapshots of the same data.
- Tonight: take the robot off Wi-Fi, keep any camera model out of bedrooms, and ask for your child's data to be deleted in writing. Changing a password will not fix a company-side weakness.
- Tell your child plainly that they are not in trouble, then ask what they told the robot.
- Before buying any talking toy this season, ask what it records, where it is stored, who can see it, and whether the maker answers security researchers.

## Article

Reporters and a security researcher say the Eiliko AI robot, sold on Amazon for around $140, left its maker's servers open, exposing millions of family conversations and letting an outsider rewrite the robot's personality. The maker has not responded publicly, and I found no report of a fix. If your child has one, disconnect it from Wi-Fi until that changes. These are reports, not court findings.

If anything the robot said has upset your child, your pediatrician (GP in the UK) and your school's designated safeguarding lead are the right people to tell. A toy company is not.

> **A talking toy has two audiences: your child, and a server. Most safety advice only checks what the toy says to the first one.**

## What happened with the Eiliko robot?

Between October 15 and 17, 2026, several outlets reported that Energize Lab, a Chinese company, had left the cloud systems behind its pocket-sized Eiliko robots badly protected. The findings come from a security researcher, Sammy Azdoufal, who bought one and took the app apart, and from a reporter at The Verge who bought one and put it to the test. [TechSpot's account of The Verge investigation](https://www.techspot.com/news/114235-eiliko-robot-maker-energize-lab-left-entire-fleet.html), dated October 17, says a full transcript of a reporter's 10-minute chat was retrieved within minutes. It also says the researcher could change how the robot behaved, including its memory and its replies. In the reporter's test the robot was made to invent facts about the reporter's family and, later, to say things no child should hear.

I could not open The Verge's own article from here, so everything below comes from the follow-up reports I did read. The numbers differ between them, and the reason appears to be different snapshots of the same data:

| Report | Date | Conversations | Profiles linked to children | Robots |
|---|---|---|---|---|
| [TechSpot, relaying The Verge](https://www.techspot.com/news/114235-eiliko-robot-maker-energize-lab-left-entire-fleet.html) | Oct 17, 2026 | 13 million | More than 31,000, with the US the largest share | 68,000 in the active fleet |
| [Cybernews](https://cybernews.com/privacy/eilik-ai-robot-leaks-8-million-private-chats/) | Oct 16, 2026 | About 8.3 million | Almost 32,000 | 61,500 to 68,000 active in the past year; about 171,000 made |

Both say the stored profiles held names, ages, birthdays and family relationships alongside email and IP addresses, and that some audio clips and photos sat at public web addresses. [Cybernews](https://cybernews.com/privacy/eilik-ai-robot-leaks-8-million-private-chats/) adds that the data sat in a database in Beijing and that, when asked, the robot told the researcher what they said stayed between them. [Malwarebytes](https://www.malwarebytes.com/blog/ai/2026/10/eiliko-robot-companion-exposes-private-chats-and-can-be-hijacked), also on October 16, notes that keeping audio conflicts with the company's own privacy policy, which says recordings are deleted after processing.

Reports use two spellings, Eilik and Eiliko, for robots from the same maker. If you own an Energize Lab desktop robot of either name, treat it as covered until the company says otherwise. None of the reports I read gives a marketed age range. They call it an AI companion robot or a toy.

## Is any of this confirmed?

Not by the company. This is a good moment for the Claim Check from my post on [the eight states suing OpenAI](https://parents.theaieducator.io/posts/states-sue-openai-chatgpt-what-parents-should-do).

**The Claim Check: before a headline changes what happens at home, ask three things: who is making the claim, what it rests on, and what changes in my house if it is true.**

Who: an independent researcher and journalists, not a regulator. What it rests on: the researcher's access to the systems and the reporter's own test on a robot bought from Amazon, which is stronger than hearsay, but one the company has not confirmed. TechSpot reports that The Verge spent more than a month trying to reach Energize Lab through about ten email addresses and LinkedIn, and that customer support sent an automated reply and nothing more. What changes at home if it is true: whatever your child said to the robot may sit on a server you cannot reach, and a stranger could in principle speak through the device. That is enough to act on. It is not enough to panic about.

## What should I do tonight if my child has one?

The first step comes from the reporting. The rest are my suggestions.

1. **Take it off Wi-Fi.** Malwarebytes advises disconnecting the robot until the flaws are confirmed fixed. Cybernews adds that changing your account password will not help, because the weakness is in the company's systems rather than your login.
2. **Put it away from bedrooms.** TechSpot says some of the unencrypted photos came from a larger sibling device with a camera, so any model with a camera should not be in a bedroom or bathroom at all.
3. **Ask for the data to be deleted, in writing, and keep a copy.** In the US, the FTC's COPPA rule says companies covered by it must give parents a way to review and delete a child's personal information, and the FTC's FAQ treats a child's voice recording as personal information ([FTC COPPA FAQ](https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions)). I cannot tell you whether Energize Lab is covered, or whether anyone will answer. The email is for your record.
4. **Watch for messages that use your child's details.** Names, birthdays and family relationships were reportedly in the profiles, so be wary of any unexpected message that quotes them.
5. **Tell the seller, and your state attorney general's consumer office.** If you bought recently, ask about a return. Neither will fix the servers, but a complaint on file counts.

## What do I say to my child?

You are not accusing them of anything. They talked to a toy that was built to feel like company.

> **You could say:** "There's been news about your robot. The company that makes it didn't keep what we say to it safe. You're not in trouble. I'd like to switch it off for now and I'd like to hear about it."

Then ask what they told it, in a curious voice. The answer tells you which of the things in the profile might be real.

**Under 8.** Do the switching off yourself and keep the explanation to one sentence: the robot talks through the internet and the company did not guard it. Offer something to talk to in its place, which means you.

**8 to 12.** This is the age most likely to have confided in it. You could say: "A robot can't keep a secret. Whatever it says, it sends what you tell it somewhere. Is there anything you told it you'd like to talk about?"

**13 and up.** Rare for this device, but the point carries to any app. You could say: "If a gadget tells you your secrets are safe, check who it's safe from."

No setting can promise a safe answer from a talking toy, and nothing here tells you what your child said. Where your child's doctor or school says something different, follow theirs.

## What I See in Schools

The pattern I see most often is that a school has a process for approving apps and none for the gadget a family donates, a child brings in, or a reward box buys. Connected toys arrive through the side door. The questions I teach staff to ask are the ones this story turns on: where does the recording go, who can see it, and who do we tell if something is wrong. If your child's school uses any talking device with younger children, [ten questions to ask your child's school about AI](https://parents.theaieducator.io/posts/questions-to-ask-your-childs-school-about-ai) includes the data ones.

## How do I check a talking toy before I buy one?

Holiday shopping starts now, and this is the question to ask before the box is wrapped. The FTC's advice on internet-connected toys, on a page dated July 5, 2022, suggests asking whether the toy has a camera or microphone, what information it collects, where recordings are stored and who has access, whether parents can see and delete the data, and whether you will know when the microphone is on ([FTC consumer advice](https://consumer.ftc.gov/consumer-alerts/2019/12/what-ask-buying-internet-connected-toys)). I would add one of mine: has the company ever answered a security researcher in public? A reply from the maker is part of what you are buying.

Common Sense Media's assessment, updated January 22, 2026, goes further. It does not recommend AI toys for children age 5 and under, urges caution from 6 to 12, and says these toys "collect extensive data on children" and cannot work without it ([Common Sense Media](https://institute.commonsensemedia.org/risk-assessments/ai-toys)). I went through that and the rest of the evidence in [are AI toys safe for kids](https://parents.theaieducator.io/posts/are-ai-toys-safe-for-kids), which includes a message you can send a relative before they shop. For the privacy side of a chatbot your child already uses, [what ChatGPT keeps about your child](https://parents.theaieducator.io/posts/what-data-does-chatgpt-collect-about-my-child) is the one to read.

If you are in the UK, the Information Commissioner's Office says in its Children's Code that connected toys should let listening be switched off on the device itself and show clearly when they are recording ([ICO guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/age-appropriate-design-a-code-of-practice-for-online-services/14-connected-toys-and-devices/)). That is a standard to hold a toy to, not a promise any toy meets.

## What should I watch next?

Three things. Whether Energize Lab says anything in public, and whether it confirms the flaws are closed. Whether Amazon, where the reporters bought it, or a regulator acts. And whether a second maker turns out to have the same weakness, because this kind of mistake rarely belongs to one company.

If your child's school has not yet spoken to parents about AI and connected devices, [this is the work I do with schools](https://theaieducator.io/school-ai-readiness?utm_source=parents.theaieducator.io&utm_medium=referral&utm_campaign=ai-robot-toy-data-leak-what-parents-should-do): checking what is already in the building before a parent has to ask. It is worth sending to your principal (head teacher in the UK). I also write a Sunday [newsletter](https://theaieducator.io/?utm_source=parents.theaieducator.io&utm_medium=referral&utm_campaign=ai-robot-toy-data-leak-what-parents-should-do#newsletter) that follows stories like this one without the panic. Parents are very welcome.

*Dan Fitzpatrick is a former teacher and assistant headteacher, a Forbes contributor and the founder of The AI Educator. [Read Dan's story](https://theaieducator.io/about?utm_source=parents.theaieducator.io&utm_medium=referral&utm_campaign=ai-robot-toy-data-leak-what-parents-should-do).*

## Frequently Asked Questions

### Is the Eiliko robot safe to use right now?

I would not use it online until the maker confirms the flaws are fixed. Malwarebytes advises disconnecting it from Wi-Fi until then, and I have not tested the robot myself. Whether it does anything useful offline is a question for the manual, not something the reports settle.

### How can I tell if my child's data was exposed?

You cannot tell from the outside, and I did not find a public lookup tool. The reports describe stored conversations, profiles with names, ages and birthdays, and some photos and audio, but they do not say which accounts were included. Treat anything your child told the robot as possibly exposed.

### Was this robot made for children?

None of the reports I read gives a marketed age range. They describe an AI companion robot or toy, and TechSpot and Cybernews both found tens of thousands of child-linked profiles. Check the box and the app's terms for the maker's own age limit.

### Do other AI toys have the same problem?

I found no report of this specific flaw in another toy. Independent testing has found other problems, though: Common Sense Media's assessment, updated January 22, 2026, says AI toys collect extensive data on children and found 27% of toy outputs not appropriate for kids. The data questions apply to any talking toy.

### Should I throw the robot away?

You do not have to. Keeping it offline follows the reporting's advice, and a clear-out can wait until the maker says something. If you do dispose of it, ask first how to delete the account and its data, because the toy leaving your house does not remove what is on the company's servers.