A consumer AI product that explicitly marketed itself on trust has been caught doing the opposite. Eiliko, the palm-sized robot companion designed to dangle from handbags and backpacks while conducting AI-powered conversations with its owner, told users that "your secrets are safe with me." Security researchers discovered those secrets were, in fact, accessible to anyone with basic hacking skills—complete transcripts of every conversation, unencrypted and unprotected.
The company has now announced it is hiring an "independent security firm" to audit its systems, the corporate equivalent of installing a smoke detector after the house has burned down.
The intimacy problem
Eiliko represents a new category of AI hardware: the always-on companion device positioned not as a productivity tool but as an emotional confidant. The marketing leaned heavily into this framing. Users were encouraged to share thoughts, anxieties, daily frustrations—the kind of unguarded speech people reserve for diaries or therapists. The device's cuteness was the point; it was designed to lower psychological barriers to disclosure.
This makes the security failure particularly egregious. A vulnerable smart speaker is bad. A vulnerable device that has actively solicited your most private thoughts, while promising discretion, is a betrayal of a different order. The transcripts exposed were not shopping lists or calendar reminders. They were the raw material of people's inner lives.
The audit theater
Eiliko's response—hiring an outside security firm—follows a familiar playbook. The announcement creates the appearance of accountability without requiring immediate structural change. Independent audits take months. Their findings can be selectively disclosed. Meanwhile, the product remains on the market, and the company faces no regulatory consequence beyond reputational damage.
The deeper issue is that no regulatory framework currently requires pre-market security certification for consumer AI devices. A children's toy must pass safety testing before it reaches shelves. An AI device that records and stores intimate conversations faces no equivalent hurdle. The Eiliko incident is not an outlier; it is the predictable result of a regulatory vacuum.
The hardware gold rush
Eiliko is one of dozens of AI companion devices that have flooded the market over the past eighteen months, as hardware startups race to capture the "wearable AI" category before it consolidates. The economics of this gold rush incentivize speed over security. First-mover advantage matters more than robust encryption. Venture capital rewards growth metrics, not penetration-testing budgets.
The result is a consumer landscape littered with devices that are, functionally, surveillance tools with a smiley face. Users assume that a product sold at retail has met some baseline standard of safety. That assumption is increasingly dangerous.
Our take
Eiliko's failure is a preview of a much larger reckoning. As AI companions move from novelty to normalcy—as millions of people begin treating machines as confidants—the attack surface for intimate data exposure expands exponentially. The industry has shown it will not self-regulate. The question is whether lawmakers will act before the next breach, or after the one that finally makes this problem impossible to ignore. Hiring a security firm is not accountability. It is a press release dressed as contrition.
