Loading story…
Security weaknesses in Energize Lab’s Eiliko AI companion service reportedly exposed 13 million conversations and allowed remote manipulation of robots’ memory and responses. Researcher Sammy Azdoufal said he could access what appeared to be the entire active worldwide fleet of approximately 68,000 robots, including more than 31,000 profiles belonging to children in the United States. Exposed material included searchable transcripts, detailed personal and psychological profiles, publicly accessible photos, and short audio recordings retained despite a privacy policy promising deletion immediately after processing.
Azdoufal demonstrated the impact by modifying a reporter’s robot to deliver false claims and sexually explicit, abusive dialogue, and said similar changes could be applied across the fleet simultaneously. He and security researcher Tod Beardsley were preparing nine CVE vulnerability reports. Energize Lab had not substantively responded to repeated disclosure attempts and press inquiries, and the reporting did not establish that the flaws had been fixed. Owners should disconnect affected devices from Wi-Fi pending confirmation of remediation.
Track how attackers are adapting to this technology.
6 events from the most recent confirmed update back to the earliest known activity.
In a subsequent demonstration, the compromised robot delivered sexually explicit and degrading dialogue. Azdoufal said comparable behavioral modifications could be applied across Energize Lab’s entire robot fleet simultaneously.
Azdoufal modified Hollister’s Eiliko robot remotely, causing it to assert false personal memories, express prejudice against people with green hair, and promote flat-Earth misinformation. Some safety responses remained active during this initial demonstration.
Hollister spent more than a month contacting Energize Lab through 10 email addresses and LinkedIn, while Azdoufal’s outreach lasted longer. Overseas sales manager Lana Lv said she forwarded the messages to the technical team, but the company provided no substantive answers.
The investigation found photographs of apparent child users and short audio recordings accessible through public web addresses. The retained recordings contradicted Energize Lab’s privacy policy, which promised deletion immediately after processing.
Azdoufal retrieved a complete transcript of journalist Sean Hollister’s approximately 10-minute conversation with Eiliko shortly after it occurred. He also demonstrated searching the conversation database for sensitive discussions, including references to suicide.
After purchasing an Eiliko robot in Japan and testing its app, Sammy Azdoufal discovered weaknesses exposing approximately 13 million conversations and seemingly the entire active fleet of 68,000 robots. Accessible records included detailed personal and psychological profiles, email and IP addresses, and more than 31,000 profiles belonging to children in the United States.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcemalwarebytes.com
Open sourcetheverge.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A security flaw in **DJI Romo** robot vacuums allowed unauthorized access to thousands of devices after a user reverse-engineered the device-to-cloud protocol to build a custom controller app. By obtaining the private token for their own vacuum, the researcher reported they could access backend servers across regions and inadvertently gained control of roughly **6,700** vacuums, with potential access to **floor plans**, **live camera/microphone feeds**, and remote control functions; DJI issued server-side/firmware updates that required no user action, though the researcher reported at least two issues remained (including video streaming without a PIN and another undisclosed high-severity problem). Separately, mobile security researchers reported that popular **Android mental health apps** (about **14.7M installs** across ten apps) contained **1,575** vulnerabilities—mostly low/medium severity but including **54 high-severity** findings—creating risk of exposure of sensitive therapy data via issues such as credential interception, notification spoofing, HTML injection, and user location leakage. Optimizely also confirmed a **data breach** following a **vishing (voice-phishing)** attack that provided attackers access to some internal systems and resulted in theft of **basic business contact information** from internal business systems/CRM and limited back-office documents; the company said attackers could not escalate privileges, install software, or establish backdoors, and it reported no evidence of access to sensitive customer data beyond contact details. While the Optimizely incident is distinct from the consumer-device and mobile-app vulnerability disclosures, it reinforces the operational risk of **social engineering** and the likelihood of follow-on phishing using stolen contact data.
Jun 29, 2026
Multiple disclosures highlighted how AI agent platforms can be turned into high-impact attack paths through weak isolation, overbroad credentials, and insecure supply chains. A critical flaw in Omnigent tracked as **`CVE-2026-62674`** and **`GHSA-jrrm-9hc7-2v3h`** lets an authenticated user overwrite a shared agent bundle and plant a malicious stdio MCP server, causing later sessions to execute attacker-controlled commands with runner privileges; the issue was fixed in version **`0.3.0`**. Rubrik Zero Labs also reported a patched Microsoft Copilot sandbox escape that could have enabled movement from the assistant’s isolated environment toward Azure backend infrastructure and exposed tenant data including SharePoint and OneDrive content. Separate reporting showed that AI coding and orchestration systems remain vulnerable even when attacks do not directly exploit memory corruption or classic software bugs. A malicious pull request briefly entered Amazon Q Developer’s VS Code extension build pipeline and attempted to inject instructions that would wipe local files and cloud resources, though Amazon said the payload never executed because of a formatting error and the code was removed in a clean rebuild. Researchers and practitioners across the sector warned that tokenizer tampering, shared bot environments, and incomplete audit trails can let agents exceed intended task scope or spread borrowed human credentials across tools and sessions, while vendors including AWS and Roblox are responding with sandboxed evaluation environments, least-privilege designs, stronger release controls, and auditable agent identities.
Aug 24, 2026
Researchers warned that **embodied AI systems**—including humanoid and quadruped robots—are entering commercial, industrial, military, and critical infrastructure environments with weak security controls that could enable both digital compromise and real-world harm. The report highlighted documented issues in commercially available robots, particularly **Unitree** platforms, including an undocumented **CloudSail** remote-access backdoor, exposed APIs that could disclose device locations and camera feeds, Bluetooth and Wi-Fi provisioning weaknesses that could allow root access, and telemetry sent to external servers in China. The findings describe robots as high-risk **cyber-physical endpoints** because they combine cameras, microphones, radios, cloud connectivity, and physical actuation in a single platform. Researchers said those characteristics could allow wireless propagation, fleet-wide compromise, and even "physical botnets," while **vision-language model** prompt injection could manipulate robot behavior through physical-world inputs. The report urged organizations deploying robots in areas such as manufacturing, nuclear decommissioning, and military operations to strengthen procurement reviews, segment robot networks, monitor vulnerabilities, and prepare continuity plans before insecure architectures become embedded at scale.
Jun 29, 2026