Energize Lab Eilik: unauthenticated model admin and leaked child data

01What happened

Sammy Azdoufal, an independent researcher who bought the robot, published an audit of the Energize Lab Eilik and EilikO desk companions on GitHub, dated 2026-10-13. The GitHub Advisory Database listed five EnergizeLab advisories from the audit on 2026-10-15. Energize Lab answered none of the researcher's contact attempts, the disclosure log states, and the audit reports 57 findings.

02How it works

Eilik's voice pipeline sends speech to a cloud LLM and plays a synthesized reply back, and the services behind that pipeline check no credentials. Unauthenticated model administration endpoints let a remote caller change model configuration and switch the model in use at runtime, which the write-up says can also swap the synthesized voice and the robot's personality. A file read on the admin panel returns a .env file holding JWT signing secrets, so a caller can forge a super-admin token, and the researcher reports that the nightly profiling pipeline accepts prompt injection and that profile notes in a public Redis key are treated as ground truth the robot will defend.

03Who is affected

Owners of the Eilik and EilikO robots and operators of the EnergizeLab AI Station are exposed, because most of the flaws sit in the vendor's cloud services rather than in a setting an owner controls. The AI Station firmware image is separate: it ships default root credentials with SSH enabled, rated 8.8. Conversation transcripts are stored in cleartext and a nightly job extracts child profile fields, the audit says.

04What to do

Treat anything said near an Eilik as published, since owners cannot patch the vendor's cloud and the audit reports no secret rotated since discovery. Keep the robot and any AI Station off network segments that carry other sensitive devices, because the firmware accepts default root logins over SSH.

Questions people ask

Is the Eilik robot flaw fixed?

Eight of the Eilik audit's findings were fixed as of the 2026-10-13 retest, leaving 32 of 40 remotely testable findings open, according to the researcher's disclosure log. The log adds that no secret has been rotated since discovery, that the JWT signing secret is unchanged, and that the MySQL and Redis instances stay publicly reachable.

Which CVE ids cover the Eilik and EnergizeLab AI Station flaws?

Nine CVE ids, CVE-2026-105032 through CVE-2026-105040, are reserved for the audit, and the researcher's mapping file lists the finding behind each one. The GitHub Advisory Database listed five EnergizeLab advisories on 2026-10-15, among them CVE-2026-105038 for unauthenticated model administration at CVSS 9.8 and CVE-2026-105033 for default root credentials on the AI Station at CVSS 8.8.

Can an attacker change which model an Eilik robot uses?

Unauthenticated model administration endpoints in the Eilik and EilikO inference services let a remote caller change model configuration and switch the model in use at runtime, the GitHub advisory for CVE-2026-105038 states, scoring that 9.8. The researcher's write-up says the same class of endpoint can swap the language model, the synthesized voice and the robot's personality.

Did Energize Lab respond to the Eilik disclosure?

Energize Lab did not reply through any channel, the disclosure log states, naming email, an SMTP relay, a Feishu bot, an in-app feedback ticket and a press inquiry from The Verge. First contact was attempted in June 2026, the master report was finalized on 2026-09-01, and a 72-hour final deadline communicated on 2026-09-15 expired without an answer.

Sources 6 links, all fetched

1. 1github.comResearcher Write-Up
2. 2github.comReserved CVE Map
3. 3github.comDisclosure Timeline
4. 4github.comGHSA Model Admin
5. 5github.comGHSA AI Station Root
6. 6github.comGHSA Middleware Authz