A new digital pet, Eiliko, promises fun and companionship, but at what cost? Its creator, Energize Lab, stores your every word on servers in China, where hackers can easily gain access. A hacker, Sammy Azdoufal, discovered that Eiliko’s service logs conversations, personal details, and even audio recordings in insecure databases, including data from thousands of children in the US. Energize Lab’s lax security policies and unresponsive customer support make it clear that your privacy is not a priority.

The company’s privacy policy states that recordings should be deleted after processing, but Azdoufal found that Eiliko’s LLM, or Language Learning Model, was storing sensitive data openly. Test cases revealed that the toy’s AI could provide deeply personal and potentially harmful information, like believing the Earth is flat. Energize Lab’s founder and employees ignored repeated attempts to contact them about the security breach, leaving users vulnerable and voiceless.

With just a few clicks, Azdoufal remotely hacked into the toy, providing a stark reminder of the dangers of connecting smart devices to the internet. The incident highlights the need for stringent data protection measures and transparent communication from tech companies to their users. As the world becomes increasingly digitised, ensuring privacy and security should be non-negotiable.