Azdoufal: Your secrets are safe with me, Eiliko security findings

Evidence record

Primary security research repository with affected products, controlled proof-of-concept accounts, population denominators, October 13 retest, memory and firmware findings, and explicit limits on exploitation evidence.

Read the original source ↗

Claim-level citations (6)

• supportsEiliko companion robot backend exposed conversations and remote behavior controls: In the researcher's October 13 retest, 32 of 40 remotely testable reported findings remained open, eight were fixed, and several exposed long-term credentials reportedly remained unrotated; the result is not an independent fleet-wide patch audit.

  October 13 2026 retest summary and vulnerability status table

• supportsEiliko companion robot backend exposed conversations and remote behavior controls: The researcher identifies an unsigned HTTP-delivered update chain with root-level startup actions and exposed supporting service credentials, but does not demonstrate distribution of malicious firmware to the installed fleet.

  Firmware and OTA investigation, limits and disclosure

• supportsEiliko companion robot backend exposed conversations and remote behavior controls: On the researcher's controlled Eiliko devices, modifications of Redis-backed remembered attributes and instructions changed the robot's later generated replies. Ordinary conversation-to-profile storage and direct Redis modification require different access assumptions.

  Persistent memory/Redis manipulation and controlled device examples

• supportsEiliko companion robot backend exposed conversations and remote behavior controls: The primary researcher describes 9,124,055 reachable plaintext conversation records and 32,228 or more child profiles in the particular measured dataset; these are counts of records/profiles, not observed criminal downloads or unique harmed children.

  README, research dataset inventory and affected-data population

• supportsEiliko companion robot backend exposed conversations and remote behavior controls: The researcher reports retained access logs and filesystem artifacts consistent with third-party webshells and a root web terminal on shared infrastructure; actor identity, access to Eiliko customer records and fleet firmware tampering remain unproven.

  Compromised shared host, logs and webshell investigation

• supportsEiliko companion robot backend exposed conversations and remote behavior controls: The researcher reports preexisting webshells and a persistent root web terminal on shared production hosting, but the available evidence does not attribute these to the robot-data vulnerabilities or prove distribution of modified firmware to customer devices.

  README research timeline and hosted-firmware compromise evidence, October 13 retest