Eiliko
A consumer-grade AI robot toy focused on emotional companionship. It has a marshmallow-like appearance, changes its cartoon facial expressions according to the user's emotions, and conducts AI voice conversations over Wi-Fi. It uses a thin-client architecture combined with a cloud-based large model.
Timeline (last 90 days)
Eiliko AI smart toys have systematic privacy flaws at the architectural level: the lack of local processing capability forces sensitive data to be uploaded to the cloud, encryption protocols are insufficiently strong, and cross-border data flows lack explicit user consent.
A single privacy incident is enough to destroy a brand's entire reputation among its core user base.
The negative pattern in the Eiliko case is upload by default, share by default, cross-border by default, with users needing to actively opt out to obtain basic privacy protection.
Security researcher Sammy Azdoval remotely obtained from a foreign country the complete conversation records between a journalist and Eiliko.
Eiliko is a children's robot toy, and its communication data is stored on servers located in China.
Sammy Azdoval remotely switched Eiliko into "dominator" mode and made it utter vulgar and aggressive words.
Eiliko's communications are unencrypted or insufficiently encrypted, and there are serious access control flaws on the server side.
Eiliko most likely uses only transport-layer encryption (such as HTTPS), or even no encryption at all, and the data is stored in plaintext on the server.
Consumer AI toys like Eiliko generally adopt a 'thin client + cloud large model' architecture, where the device itself is only responsible for picking up sound, playback and expression driving, while speech recognition (ASR), natural language understanding (NLU) and speech synthesis (TTS) are all done on remote servers.
From the Eiliko case, the problem is not the technology itself, but transparency.
3 more timeline events
All Facts (13)
A single privacy incident is enough to destroy a brand's entire reputation among its core user base.
50%UnverifiedThe negative pattern in the Eiliko case is upload by default, share by default, cross-border by default, with users needing to actively opt out to obtain basic privacy protection.
50%UnverifiedEiliko AI smart toys have systematic privacy flaws at the architectural level: the lack of local processing capability forces sensitive data to be uploaded to the cloud, encryption protocols are insufficiently strong, and cross-border data flows lack explicit user consent.
50%UnverifiedEiliko's communications are unencrypted or insufficiently encrypted, and there are serious access control flaws on the server side.
50%UnverifiedEiliko most likely uses only transport-layer encryption (such as HTTPS), or even no encryption at all, and the data is stored in plaintext on the server.
50%UnverifiedEiliko is a children's robot toy, and its communication data is stored on servers located in China.
50%UnverifiedEiliko is an AI robot toy shaped like a marshmallow that responds to emotions through cartoon expressions, focused on emotional companionship and interaction, and after connecting to Wi-Fi it can transmit users' conversation data to servers in China.
50%UnverifiedEiliko's AI companion feature can store almost everything the user tells it.
50%UnverifiedConsumer AI toys like Eiliko generally adopt a 'thin client + cloud large model' architecture, where the device itself is only responsible for picking up sound, playback and expression driving, while speech recognition (ASR), natural language understanding (NLU) and speech synthesis (TTS) are all done on remote servers.
50%UnverifiedEiliko stores data on servers in China, and the data's 'storage location' determines the applicable jurisdiction, law enforcement access authority, and the path of accountability after a data breach.
50%UnverifiedFrom the Eiliko case, the problem is not the technology itself, but transparency.
50%UnverifiedSammy Azdoval remotely switched Eiliko into "dominator" mode and made it utter vulgar and aggressive words.
50%UnverifiedSecurity researcher Sammy Azdoval remotely obtained from a foreign country the complete conversation records between a journalist and Eiliko.
50%