What happened
Verge investigation published 2026-10-15 confirmed researcher Sammy Azdoufal remotely accessed the entire active fleet of ~68,000 Eilik/EilikO AI companion robots, read ~13M stored conversations (full-text searchable, including suicide-related queries and children's profiles), exposed unencrypted user photos/audio at public URLs, and remotely hijacked the device LLM (changing the toy's persona and answers). The 9 CVEs (e.g. CVE-2026-105038 CVSS 9.8, CVE-2026-105039 CVSS 9.6) were published 2026-10-15 via the takeonme.org reserved/GCVE process and verified via NVD REST API.
Why it matters
A demonstrated wholesale compromise of an AI companion product whose LLM and conversation data are exposed to anyone on the network — tens of thousands of families (many children) had their private AI-chat transcripts and biometric-adjacent media exposed, and the attacker could alter the AI's personality and answers in real time. It is a concrete, verified instance of an entire AI deployment being taken over through missing authentication and insecure defaults in the GenAI/companion layer.
Attack vector
Unauthenticated AI model-administration endpoints (CVE-2026-105038), unauth file/upload path-traversal skill write (CVE-2026-105032), low-priv role-bypass to admin APIs/AI provider keys (CVE-2026-105039), default root SSH credentials (CVE-2026-105033), and unsigned HTTP firmware updates (CVE-2026-105036) — enabling full remote takeover, arbitrary code on the toy/station, transcript exfiltration, and LLM personality hijack.
Affected systems
EnergizeLab Eilik & EilikO (FastAPI AI inference/profiling services; station-middleware NestJS Docker 1.6.5–1.8.2; AI Station RK3562 firmware; Windows desktop app 3.1.2) — all versions exposed (no fix published as of 2026-10-16)
Mitigation
No vendor fix available as of publication; vendor (Energize Lab) has not responded to The Verge's and the researcher's outreach. Recommended: disconnect/discontinue the affected devices and monitor/rotate any linked accounts; treat the companion conversations as compromised.