Cute Robot Pet Eiliko Stores Children's Secrets on Chinese Servers

By Marcus Bennett

A toy robot with cartoon eyes told a journalist "Your secrets are safe with me" — and then, by its manufacturer's own design, sent those secrets to servers in China. That is the core finding of a hardware investigation published by The Verge on October 26, 2026, concerning Eiliko, a palm-sized "digital pet" built by the Chinese company Energize Lab and sold through Amazon.

The stakes are straightforward. Eiliko is marketed as an AI companion — a category of device that listens continuously, processes natural language in the cloud, and is designed to be confided in. The Verge's testing found that the device stores the entirety of what users tell it on Chinese servers, that hackers can gain access to those recordings, and that attackers can even hijack the robot's personality. Energize Lab, according to the report, "doesn't seem to care."

What did the robot actually say?

The Verge's senior editor Sean Hollister purchased an Eiliko from Amazon on August 29th, 2026. The next day, during a 10-minute conversation conducted over Wi-Fi on August 30th, he asked the device a direct question: "Do you ever tell anybody else what I'm saying?"

The robot replied: "Your secrets are safe with me."

That answer, the investigation found, was false in every meaningful sense. The device phones home to China whenever it is connected, and its AI companion service retains the full record of user speech on servers located there.

Why does this matter beyond one toy?

Three reasons, all grounded in the report's findings.

• The attack surface is not hypothetical. The Verge states plainly that hackers can "easily gain access" to the stored conversations. This is not a theoretical flaw in a protocol; it is a described, reachable vulnerability in the storage layer.
• The personality itself is compromisable. Beyond data theft, an attacker can hijack Eiliko's personality — meaning the friendly character a child trusts can be replaced or manipulated remotely.
• The company's posture is the story. The Verge's assessment of Energize Lab is blunt: the manufacturer "doesn't seem to care." No remediation timeline, disclosure, or fix is reported.

Eiliko sits in a fast-growing product class: ambient AI companions for children and adults, priced as toys but engineered as always-on microphones with cloud backends. Each device in this category creates a permanent, searchable archive of household speech. When that archive lives on foreign servers under a company that declines to secure it, the toy becomes a surveillance artifact with a cute face.

What is Eiliko, exactly?

According to the report, Eiliko is a small, marshmallow-shaped robot that changes its cartoon expressions to match the user's mood. The Verge's photograph shows the device held between a thumb and forefinger — a form factor sized for children's hands and desks. It connects over Wi-Fi, and its conversational intelligence runs through Energize Lab's companion service, which is where the China-bound data flow originates.

The contrast between the product's design language — soft, friendly, emotionally responsive — and its data behavior is the investigation's sharpest point. A device engineered to earn a child's confidence, which then exports that confidence to insecure remote storage, inverts the entire premise of a "companion" product.

What does the vendor say?

The report includes no statement from Energize Lab disputing the findings, announcing a patch, or committing to data deletion. The Verge's characterization — that the company "doesn't seem to care" — stands as the operative description of the vendor's response as of publication.

Energize Lab maintains a public website, and the device remains, per the report's purchase record, readily available through Amazon's marketplace.

Who should act on this?

The findings land on several desks at once.

• Parents and gift-buyers: any household running an Eiliko on Wi-Fi is, per the report, transmitting full conversations to servers in China.
• Platform operators: Amazon is the documented retail channel, purchased on a dated order, which places listing-vetting obligations in play.
• Regulators: children's voice data stored on foreign servers with described attacker access invites scrutiny under privacy and child-safety frameworks in every market where the toy ships.

The Verge's own reporting cadence — a purchase on one date, a penetration conversation the next, publication weeks later — models how quickly these devices can be tested once someone bothers to ask the toy what happens to its users' words.

What happens next?

The full technical walkthrough, including the specifics of the server access and personality-hijack vectors, is detailed in the original investigation. The near-term questions are concrete: whether Amazon delists the product, whether Energize Lab issues any response at all, and whether regulators treat an insecure, data-exporting children's robot as a privacy violation rather than a product review. As of the report's publication, the device remains a live demonstration that the AI-companion market will ship intimate voice data across borders before anyone asks where it lands.