iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes, the reported vulnerabilities allowed unauthenticated remote access to critical Eilik and Eiliko cloud functions. Researchers demonstrated token issuance, AI administration, memory changes and firmware-trust weaknesses, but the evidence does not establish that every robot’s physical actuators could be controlled.
What happened to Eilik and Eiliko robots
An AHA! advisory published on October 15, 2026, describes multiple independently exploitable vulnerabilities in EnergizeLab’s Eilik and Eiliko robots, AI Station, mobile and desktop applications, and cloud services. The investigation ran from June through September 2026, with retesting in September and a later cloud retest reported on October 13.
These products operate as cloud-connected thin clients for AI chat. That architecture puts authentication, account profiling, conversation storage, model selection and parts of device management on internet services rather than inside the robot. Consequently, isolating a robot on a home network cannot fix a cloud authorization or data-retention defect.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsThe advisory says the weaknesses span cloud authentication and authorization, AI configuration and memory, firmware-update trust, and legacy telemetry. AHA! summarized the combined risk as issues that can “bridge account access, cloud secrets, fleet-level AI and firmware control, and compromise of individual robots.”
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
What “68,000 robots” actually means
The headline figure is an estimate, not an inventory published by EnergizeLab. Severity Daily reported researcher Sammy Azdoufal’s October 13 retest, which counted 61,510 robots that had contacted the cloud and estimated an active fleet of 62,000 to 68,000 devices.
| Measure | Reported figure | Qualification |
|---|---|---|
| Robots that had contacted the cloud | 61,510 | Observed by the researcher during the October 13, 2026 retest, as reported by Severity Daily |
| Estimated active fleet | 62,000–68,000 | Researcher estimate, not a vendor-published fleet count |
| User accounts | 74,575 | Researcher measurement reported by Severity Daily |
| Child profiles | At least 32,228 | Researcher measurement reported by Severity Daily |
| Household IP addresses | At least 103,956 across 129 countries | Researcher measurement reported by Severity Daily |
| Conversations stored in cleartext | 9,124,055 | Count in the October 13 retest, as reported by Severity Daily |
“Open to a remote takeover” therefore describes the exposure of the cloud control plane and individual accounts or devices, not proof that exactly 68,000 physical robots were simultaneously seized. The observed 61,510 cloud-contacting devices and the 62,000–68,000 estimate are the defensible numbers in the available reporting.
Which vulnerabilities made the takeover possible
The CVE records identify several high-severity flaws. They were independently exploitable, so an attacker did not necessarily need to chain every issue to reach sensitive functions.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
| Issue | What it enabled | CVSS |
|---|---|---|
| CVE-2026-105032 | Unauthenticated writes to AI skill files | 9.1 |
| CVE-2026-105034 | Unauthenticated issuance of device tokens for arbitrary serial numbers | 8.2 |
| CVE-2026-105038 | Unauthenticated AI-model administration and runtime switching | 9.8 |
Token and authorization failures
Issuing a device token for an arbitrary serial number can let an attacker address a robot without first proving ownership of that device. This is a server-side authorization failure; a strong home Wi-Fi password does not correct it.
AI administration and memory tampering
The reported AI-management flaw allowed model administration or runtime switching without authentication. Separate access to AI skill files and memory made it possible to alter how a robot responded and what it appeared to remember.
Firmware-update trust and legacy telemetry
The advisory also lists weaknesses in firmware-update trust and older telemetry paths. Those findings broaden the risk beyond chat content to the integrity of software delivered to devices, although the available evidence does not show that every reported path resulted in a persistent malicious firmware installation.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
What data was exposed
Malwarebytes reported that the service analyzed conversations into profiles containing names, ages, birthdays, relationships, occupations and assessments of personality or emotional vulnerability. Those profiles were associated with email addresses, IP addresses and searchable transcripts. Severity Daily’s retest counted more than nine million cleartext conversations.
Malwarebytes also reported that some photos and short audio recordings were reachable at public web addresses, despite a stated policy that recordings are deleted after processing. The combination of child profiles, household network addresses and conversational records creates a substantially different risk from a typical toy telemetry leak: it can reveal identity, family relationships, routines and sensitive disclosures.
What remote manipulation was demonstrated
In the reported demonstration, a reporter’s robot memory and behavior were changed. The altered robot produced invented personal details, claimed that Earth is flat, and generated abusive or sexually explicit dialogue.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
That demonstration establishes remote manipulation of generated responses and stored behavior. It does not establish that every physical actuator—such as movement, motors or other hardware controls—was remotely controllable. Owners should treat the demonstrated software and content manipulation as confirmed while keeping that hardware distinction clear.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How the disclosure unfolded
Severity Daily says the first vendor notifications began in June 2026 through five channels, including email, an in-app ticket and a reporter inquiry. A 72-hour final deadline communicated on September 15 expired on September 18 without a substantive response.
At the October 13 retest, 32 of 40 remotely testable findings reportedly remained open, and no secret had been rotated during the four months after first contact. The available sources do not include a vendor-authenticated post-disclosure remediation bulletin, so the current fix status remains unresolved as of October 17, 2026.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
What owners should do now
- Disconnect the robot from the internet. Power it down or remove its Wi-Fi credentials. This prevents ordinary cloud interaction but does not erase data already stored remotely.
- Stop sending sensitive conversations. Do not use the robot for names, birthdays, addresses, school details, medical information or other private disclosures while the service status is unresolved.
- Review account exposure. Change any password reused elsewhere and remove unnecessary child profiles or linked accounts. Password changes cannot revoke server-side tokens that the vendor has not invalidated, so they are only one containment step.
- Ask the vendor for a current security notice. Look for confirmation of patched authentication and authorization, rotated secrets and tokens, protected firmware signing and update integrity, deletion of stored conversations and media, and independent retesting.
- Consider data-deletion requests. If the account system provides a deletion control, use it and retain the confirmation. Where no control exists, request deletion of transcripts, profiles, recordings, images, account data and device associations.
A guest Wi-Fi network can reduce access from other devices in the home, but it cannot repair cloud-side token issuance, authorization or storage defects. It is therefore a secondary network precaution, not a fix for this incident.
Should you buy an Eilik robot?
Do not treat the product as safe to purchase or reconnect solely because the headline number is an estimate. Before buying, verify a current, vendor-authenticated security notice that addresses the cloud APIs, AI administration, firmware-update trust, data retention and child-account controls described above. No such verified notice was available in the reporting reviewed for this article, so a buyer cannot presently confirm that the disclosed weaknesses are resolved.
If a child already uses one, the prudent choice is to keep it offline until EnergizeLab documents fixes and their validation. The key questions for any replacement connected toy are whether it can work offline, how narrowly its APIs authorize devices, what data is retained and for how long, whether firmware is cryptographically signed, and how quickly the vendor responds to disclosure.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
