{
 "public_id": "AIR-2026-0276",
 "incident_id": "2026-10-energize-lab-eiliko-conversation-exposure-memory-hijack",
 "date_disclosed": "2026-10-15",
 "date_occurred": "2026-08-30",
 "title": "Eiliko cloud service exposed private conversations and allowed remote memory and personality changes",
 "class": "responsible_disclosure",
 "attack_surface": "consumer_chatbot",
 "initial_vector": "exposed_cloud_conversation_and_memory_service",
 "agent_capability_abused": [
  "conversation_storage",
  "profile_generation",
  "persistent_memory",
  "remote_personality_configuration"
 ],
 "target_product": "Eiliko AI companion and shared Energize Lab cloud service",
 "target_vendor": "Energize Lab",
 "autonomy_level": "assistant",
 "impact_realized": true,
 "impact_type": [
  "data_exposure",
  "memory_poisoning",
  "agent_hijack"
 ],
 "blast_radius": "The reporter's toy was tested directly; researcher-reported exposure extended to 13 million conversations and a fleet of 68,000 toys, not confirmed compromise totals",
 "cve": [],
 "taxonomy": {
  "mitre_atlas": [],
  "labels": [
   "ai_as_target",
   "cloud_conversation_exposure",
   "remote_memory_write",
   "researcher_disclosure",
   "firsthand_reporter_test",
   "exposure_counts_not_victim_counts"
  ],
  "owasp_asi": [
   "ASI06",
   "ASI02",
   "ASI08"
  ]
 },
 "defense_present": "The reporter describes weak administrative passwords and unspecified LLM guardrails that still blocked some questions after the memory changes",
 "defense_bypassed": null,
 "fix_shipped": null,
 "primary_sources": [
  "https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab"
 ],
 "verified_quote": "Just when I thought I was done being dumbfounded, Azdoufal made my jaw drop again when he remotely hacked my toy’s memory, and hijacked its LLM, from the other side of the globe.",
 "confidence": "medium",
 "notes": "The Verge's Sean Hollister watched Sammy Azdoufal retrieve his complete August 30 conversation, then tested remote memory and personality changes on his own toy. August 30 dates that observed conversation exposure, not the initial discovery or later hijacks. AI-specific retention and writable memory put the service in scope, with the AI as target rather than an autonomous intruder. Real private conversations were readable and the reporter's device was altered; a fleet-wide malicious compromise, child harm and downstream misuse are not established. The 13 million conversations and 68,000 toys describe the researcher's reported reach, not independently verified victims. Confidence is medium under the contract's conservative treatment of news-only sourcing, despite the reporter's firsthand tests. The linked researcher/advisory pages were not fetched, so no CVE numbers or model identity are inferred. Energize Lab gave no substantive response or confirmed fix in the article.",
 "risk_category": "privacy",
 "risk_secondary": [],
 "risk_subcategory": "PII Leakage",
 "risk_sub_secondary": [],
 "risk_override_reason": "The reporter's private conversation was readable from outside the toy's account. Conversation exposure is the documented privacy consequence; remote memory changes remain an additional mechanism, not an inferred fleet-wide attack.",
 "ai_entity": "generative",
 "agency": "ai_as_target",
 "agency_debatable": false,
 "agency_reason": "A researcher accessed the companion's stored conversations and changed its memory and personality remotely; AI-specific retention and configuration were the target, not evidence that an AI conducted the intrusion",
 "vector_family": "conventional_vulnerability",
 "vector_detail": "exposed_cloud_conversation_and_memory_service",
 "guardrail_kind": [
  "authentication",
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI06",
 "agent_framework": "unknown",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "sensitive_data_exposure",
 "eai_domain": "privacy",
 "eai_secondary": [
  "data_and_memory_poisoning"
 ],
 "eai_reason": "subcategory: PII Leakage",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI06 (signal=memory); ASI02 (impact=tool_misuse); ASI08 (text=cascade)",
 "submitted_by": "EAI Internal"
}