Eiliko security report: guest Wi-Fi cannot repair cloud access controls

Newly disclosed research into EnergizeLab's Eiliko companion robot describes weaknesses in the cloud services that store conversations and influence the robot's replies. For owners, the practical implication reaches beyond home Wi-Fi: separating a toy from other local devices cannot repair access controls at its remote provider.

The Verge reported the story on October 15, 2026. The underlying research by Sammy Azdoufal is dated October 13 and describes work beginning in June. These are disclosure and testing dates, not evidence that every reported condition has been freshly checked today.

The report concerns both records and replies

Azdoufal describes ways to reach conversation records without the intended account-ownership restrictions, and to change AI configuration or persistent memory that affects what a robot says. Those are distinct risks: confidentiality concerns who can read an exchange; integrity concerns whether the response still reflects the intended service.

The disclosure timeline says model and persona changes were demonstrated on the researcher's own robots in September and restored. The broader report distinguishes separately tested component weaknesses from an end-to-end deployment of compromised firmware to customers. It does not claim that such a fleet-wide firmware deployment was performed.

These are the researcher's findings. TechKili has not reproduced the attacks, accessed user records or independently established the service's current state. The AHA! advisory published October 15 itself notes that its status reflects September retests; the research repository includes a later October 13 retest.

A home network boundary stops at the cloud connection

EnergizeLab's Eiliko FAQ says AI chat needs Wi-Fi and distinguishes it from built-in offline voice commands. Its setup instructions also allow a mobile hotspot. Changing the route to the internet therefore does not make the cloud portion disappear.

TechKili's assessment is that a guest network, configured for isolation, may limit access to other home devices. It does not change how a remote server checks which account may read a transcript or alter stored information. A cloud-connected toy can still send information to that server from an isolated network. Network segmentation is consequently a limited local measure, not a remedy for the backend flaws described here.

Pause connected use while the remediation is established

For a household concerned by the report, a cautious response is to pause connected AI chat and keep sensitive conversations away from the device. Power it off if its disconnected state cannot be established. Stopping new interactions does not erase records already held by the provider.

Before resuming or buying, seek a model-specific notice identifying the affected software and cloud services, the changes deployed, and a dated verification of those changes. A new firmware number alone would not demonstrate a repaired cloud authorization rule. The reviewed sources do not establish a verified current remediation for every reported path.

Our Bee privacy and audit analysis explains why the scope and date of a security assessment matter. The same reading discipline applies here: distinguish what was tested, when it was tested and what remains unconfirmed.

Sources

• Azdoufal's primary research report

• Research and disclosure chronology

• AHA! October 15 advisory

• Eiliko product FAQ and network setup

• The Verge's October 15 coverage