Hacker Allegedly Read 13 Million Conversations with the AI Toy Eiliko
A large trove of data from the robot toy Eiliko — including conversation transcripts and detailed personality profiles, with findings indicating accounts belonging to more than 31,000 children in the US — was allegedly accessible to outsiders. The story is based on a report from The Verge published on October 15, 2026.
On October 15, 2026, The Verge reported that the hacker Sammy Azdoufal allegedly gained unauthorized access to data from the Eiliko robot toy, produced by Energize Labs. According to the article, written by Sean Hollister, Azdoufal was able to read 13 million conversations from tens of thousands of users and gain access to what appeared to be the entire active fleet of 68,000 toys worldwide. The figures come from Azdoufal's findings and have not been independently verified. According to the data Azdoufal allegedly accessed, the US is the largest market, with more than 31,000 child accounts.
The story is presented as an ongoing exposure rather than a closed breach: the fleet was said to still be accessible when The Verge published. Energize Labs has not commented in the material available for this coverage.
The Verge writer checked the claim himself
Hollister ran his own test: he bought an Eiliko on Amazon on August 29 and had a ten-minute conversation with the toy on August 30, during which he asked it, among other things, "Do you ever tell anyone else what I say?" According to the article, within a short time a remote person had a complete transcript of the conversation.
What the toy stores — and how the profiles are built
Eiliko is a so-called AI companion that talks over Wi-Fi. According to The Verge, the toy sends conversations back to servers in China, where everything the user says can be stored. The article claims hackers there can gain easy access — or even hijack the toy's personality.
It is not only the raw transcripts that are the problem. Azdoufal allegedly discovered that the service reads the conversations and builds a profile of the user, including name, age, birthday, occupation, family, friends, pets, and "what kind of person you seem to be."
The Verge gives a concrete example from the exposed data: the service is said to have logged that a 52-year-old customer service employee named Lucy is "kind, empathetic, hardworking, values friendship and trust," but also "has difficulty trusting family members" and "currently feels isolated." Descriptions like these show that the system does not merely store what people say — it interprets them, including their emotional state.
The scale — with caveats
The central figures in this story come from a single source via a single secondary source. It is Azdoufal who, according to The Verge, stated the 13 million conversations, the 68,000 active toys, and the more than 31,000 child accounts in the US. The Verge itself uses the word "apparently" about Azdoufal reaching the entire global fleet, and the figures have not been independently verified. But if they hold, it means a single actor could read private conversations and AI-generated profiles from nearly the toy's entire user base — with the US as the largest market and child accounts making up a large share.
Who is Sammy Azdoufal?
The Verge describes Azdoufal as an "accidental hacker." He has previously shown that one could remotely control a fleet of DJI robot vacuum cleaners, look into countless baby monitors and security cameras from Meari, and find nearly a million ID photos left unprotected on the public internet — the latter using AI tools. The pattern in his findings is the same: cloud-connected consumer products with weak access control around highly private data.
Open questions
Several key questions remain unanswered in the available basis:
- Energize Labs' response: The company has not commented in the material underlying this coverage.
- Whether the fleet is still exposed: The Verge presents the exposure as ongoing as of publication, but there is no confirmation of remediation.
- The technical vulnerability: How the access was possible, and whether it has been closed, is not documented.
- The timeline: Azdoufal's discovery is said to have happened "this summer," but the precise chronology up to publication on October 15, 2026 is unclear.
What this means for parents and consumers
The story illustrates a data decision most consumers never see: when a toy connects to Wi-Fi, it moves conversations — often children's — to cloud servers far from the kitchen. In the Eiliko case, they allegedly ended up on servers in China, together with AI-generated profiles that consolidate identity, relationships, and personality traits into a single artifact. Such a profile can be more revealing than the transcripts alone, because it distills what the system believes about a human being — including vulnerable judgments like that someone "currently feels isolated."
For anyone considering connected AI toys, the findings point to concrete questions to ask: Where are the conversations stored? For how long? What are they used for beyond the conversation in the moment? And who can access them? So far, none of these questions has been answered by Energize Labs in the public record for this story.