On 16 October 2026 The Verge published a test, run with hacker Sammy Azdoufal, on Eiliko — the companion robot from Energize Lab. User conversations, user profiles, children’s photos and audio sat on an unprotected server. Roughly 68,000 devices were reachable, along with about 13 million conversations; more than 31,000 of the child profiles came from the United States, and remote hijack of a device was demonstrated.

My conclusion up front: this is not a security lapse bolted onto one toy. It is the default architecture of consumer robotics — always-on microphone and camera, convenience-first backend, and nothing in the reporting that describes a patch or revocation path — shipped at fleet scale before the category agreed on what “deployed” means. Automotive got a monitored, patchable, revocable trust boundary as a condition of sale because type approval forced it. Consumer robots have no such forcing function, so the discipline has to come from product choice. Until it does, companion-robot unit economics are borrowing against a liability nobody has booked.

What I concluded

A working definition: a fleet is deployed when every unit is inventoried (you can enumerate it and know who owns it), authenticated when reached (reachability without identity is exposure, not deployment), patchable (a fix reaches the whole installed base inside a stated window), revocable (you can cut a device or a credential off in minutes), and owned (a named human is accountable at 3am, with the authority to switch things off).

Score Eiliko against it on reported facts alone. Inventoried: partly — the fleet existed as database rows with profiles attached, but access required no identity, so inventory and access were the same thing, which is the failure. Authenticated: no. Patchable: not described. Revocable: not described. Owner: not named publicly. Two properties out of five, and both are the cheap ones.

That is the argument: a product can be charming, sell in volume, and still not be deployed. The industry treats “shipped” and “deployed” as synonyms because the gap only shows up on the worst day.

Constraints

Four constraints decide this; only one is technical.

Cost. $299 — what Apple charges for HomeView — is roughly the ceiling for a mass-market household device. Every dollar of BOM spent on a secure element, a hardware root of trust or per-unit key provisioning comes out of the microphone array or the margin.

Observability. At purchase, a buyer cannot tell whether a backend is authenticated. Security is an unobservable attribute, so the shelf cannot price it, so the cheapest architecture wins. That mechanism, more than malice, explains Eiliko.

Feedback latency. A car’s failure is kinetic, attributable and litigated within weeks. A robot toy’s failure is a privacy breach that surfaces years later, to a customer who never sees the bill. The market signal that would discipline the design arrives after three more generations have shipped.

No forcing function. UN R155 and ISO 21434 gate automotive through type approval: no certificate, no sale. Nothing gates a $200–300 consumer robot. The nearest evidence that connected-device security does not self-organise is October’s attack on European supermarket refrigeration: Reuters named Intermarché with 150 stores targeted, Le Monde reported chains shutting freezers, Claroty’s Team82 had earlier disclosed Danfoss refrigeration-controller vulnerabilities — and the reporting still does not confirm the CVE, the attacker or the losses. A refrigeration controller at least has an operator and a service contract. A toy has a parent.

The options, and what I traded away

The fork is not secure versus insecure; it is where the boundary sits and what capability you give up holding it. HomeView is the useful counter-architecture because it prices into the same band: $299, a 7-inch display, on sale 13 November in the US, UK, Canada and Australia, with A18 Secure Exclaves processing camera and microphone data in an isolation region the OS and Apple cannot read. That is a product-page claim, not an independently verified property — treat it as design intent. It also has no App Store access, which is the same trade seen from the other side.

Evidence

Three data points do the work.

Eiliko’s scale: 68,000 reachable devices, 13 million conversations, 31,000+ US child profiles. The last number is what turns an architecture critique into a regulatory and reputational event — and it is a number a product manager could have put on a slide before shipping.

HomeView: $299, 13 November, four markets, enclave claim unverified. Proof that the trust boundary is affordable at this price, and proof that it costs you the app ecosystem.

Waymo: 400M+ fully autonomous km, a claimed 95% reduction in serious-injury-or-worse crashes versus human drivers, and a Toronto service aiming at first passengers in 2028, preceded by human-driven mapping and expert testing with Element Fleet Management. That is what a safety case with a denominator looks like. A $299 desktop robot cannot make a claim of that shape — and the week’s DIY single-motor drone video, with no productisation and no independent performance data, shows how wide the demo-to-deployment gap still is.

Counter-arguments. “It’s a toy, the threat is low” — the demonstrated hijack and the child-profile count answer it. “Enclaves break the product” — partly true; Apple answers that with services revenue a startup does not have, and the asymmetry is real, not a morality gap. “Regulation will come, so waiting is rational” — only if the liability is capped, and it isn’t. “The car analogy is overreach because cars kill people” — correct, and that is the point: the analogy breaks in the direction that makes robotics harder, because feedback is slow and the victim is not the buyer.

Where this stops being true

The argument holds for sub-$500 consumer robots with always-on sensors, sold through retail in the US and EU, at fleets above roughly ten thousand units where manual handling stops scaling. It weakens for warehouse and field robots, where the operator is the buyer, the site has its own security function and the service contract already carries an SLA; for enterprise fleets with an incident-response owner on day one; for devices whose current generation already ships a hardware root of trust; and at very small fleets — 68,000 units is big enough to hurt and small enough that a determined team could almost inventory and patch by hand. What I am not claiming: that HomeView’s enclave is verified, or that any of this is settled.

What I would do differently

Four demands, all falsifiable.

A retention limit on the spec sheet, with a number: how long conversations and images are kept, where, and whether they leave the device. A vendor who will not write it down has answered.

An OTA and revocation SLA: how fast a fix reaches the installed base, how fast a device or a credential can be cut off. No number, no capability.

An incident disclosure commitment with a named person who has the authority to revoke a SKU — not a security@ inbox. That is the answer to “who do I call at 3am”.

A definition of “deployed” written into the purchase contract or the investor memo — inventoried, authenticated, patchable, revocable, owned — and the vendor scored against it.

My reading is that the category gets there through product choices booked as costs, not through a regime that arrives on its own. Automotive needed type approval plus two standards before a trust boundary became a condition of sale. Consumer robotics has neither, so the only forcing function available now is a buyer who asks and a product manager who writes the answers into the spec. Until then the flywheel is financed with data that, in this case, belonged to more than 31,000 American children.

Anthropic’s usage policy puts autonomous physical operation in a high-risk category that requires a human in the loop, and separately bars using its models to arm drones. My conclusion is that the risk tier is right and the boolean is wrong: what belongs in that sentence is a set of numbers, not a person’s presence. The drone clause is uncontroversial. The human-in-the-loop clause looks like a bright line and is not one, because it carries no engineering content. It does not say how fast the human must respond, how many machines one human may hold, what the robot does when the human is unreachable, or how any of it is verified.

Automotive went through this phase. “The driver is supervising” was both the regulatory and the marketing answer to level-2 assistance, and it satisfied nobody — not the regulator who had to define supervision, not the insurer pricing it, not the engineers implementing a sentence with no threshold in it. What moved the industry was quantification: a declared ODD, a measured takeover time, a published operational number, argued inside a taxonomy everyone had agreed on.

The timing is the interesting part. The same week, Anthropic published research showing a 9B model running inference on eight of the nine hardware classes it tested, with 30B-and-below models completing most individual steps of autonomous replication; Epic Games moved to an AI-first pipeline where Claude writes all the code and directs all the art on a project tied to a $1.5bn Disney partnership; and QGIS merged QEP428 on 2026-10-07 declaring AI-assisted contributions NOT ALLOWED. Three policy postures toward machine autonomy in one week — and only one concerns a domain where a wrong action can be undone.

What I concluded

Naming physical action as its own risk surface is correct and overdue. Expressing the control as a boolean is the mistake. The line that matters is not human versus no human; it is reversible versus irreversible error. A software agent that leaves a background daemon running after you close the terminal — Codex CLI 0.157.0 does exactly this by default, with codex app-server --managed-daemon — is an annoyance you end with a process kill. An arm moving through a shared aisle is not undoable, and “the operator was watching” does not reverse the outcome.

What should be written instead is a quantified human-in-the-loop specification with four numbers: teleoperation ratio (share of runtime or task attempts that genuinely needs a remote human), takeover latency as a distribution with a stated P95, operator concurrency (robots per trained operator per shift), and the minimum risk state the robot enters when the human link fails. A fifth, if allowed: the authority model — what the robot may do when it cannot reach a human and stopping is the worse option.

That reframes the question. “A human must be in the loop” asks whether someone is watching. “Disclose your teleop ratio and your takeover P95” asks whether the deployment is actually supervised. Only the second is auditable.

Constraints

Four constraints decide how far this gets.

Vocabulary. ADAS inherited a coarse but shared taxonomy of levels and a shared concept of ODD. Mobile manipulators and humanoids have no equivalent: no agreed definition of a task, no ODD language for mixed-traffic warehouses, no rule for when a model version change makes it a different deployment. Without that, a teleop ratio is not comparable across vendors.

Measurement culture. Automotive has a reporting habit for disengagements and mileage. Robotics has demos. There is no public benchmark for takeover latency in manipulation and no cross-vendor reporting of operator concurrency, so the numbers I am asking for have to be built by each deployer rather than compared against a norm.

Split incentives. Model providers inherit the compliance obligation, integrators carry the deployment cost, the site carries the physical risk. Nobody in that chain is naturally funded to measure.

The constraint that decides the outcome: auditability asymmetry. A boolean is cheap to check, and therefore attractive to a regulator with no robotics headcount. A P95 requires telemetry, definitions and a competent auditor. Policy gets written at the level of what can be verified — which is exactly why the boolean survives unless deployers bring the numbers first.

The options, and what I traded away

I would deliberately run the second option during data collection and contract to reach the third. What I traded away is the comfort of pretending the checkbox was sufficient.

Evidence

The reversibility asymmetry is directly observable. Codex CLI 0.157.0 opening a persistent managed daemon when an interactive session starts is a real agent-containment failure, recoverable in seconds. QGIS can declare AI-assisted contributions NOT ALLOWED (QEP428, merged 2026-10-07) because its worst case is a bad patch in a review queue. Epic’s Claude-driven pipeline can iterate because the artefact is code and art. Those domains can afford blunt policy because a wrong action is reversible. Physical action is the one category where that assumption fails — which is why I accept the risk tier and reject the boolean.

Capability is documented too: Anthropic’s own research shows 9B models running on eight of nine tested hardware classes, with 30B and below completing most single steps of autonomous replication. Read that as a forecast about cheap autonomy attempts, not about robots doing useful work.

What I am not treating as evidence: the automotive record, which I can describe structurally but will not quote as a benchmark here. And no public dataset exists for manipulation takeover latency, so my four numbers are a proposal, not a standard.

Where this stops being true

Inside a fenced cell with hard interlocks and one repeated task, “no human inside the fence while the cell runs” is correct and sufficient, because the fence is the control and the human is not. The boolean is right there.

Fleet size: below a handful of units — order of one to ten — the operator is effectively the integration layer and a takeover P95 is theatre. The argument bites once the operator-to-robot ratio reaches a hiring plan.

Segment: this is about unstructured, multi-task manipulation in spaces shared with people. A fixed-track AGV in a closed aisle is a different problem with a defensible fixed rule. And the numbers themselves move: if a coming VLA generation pushes interventions down to exception handling, the four metrics are still the right specification while their acceptable values shift a long way. Today’s numbers are not the target.

Company size and region: a small team cannot fund the measurement stack, and what a deployer must file differs by jurisdiction. Proportion the spec to the fleet and to who owns the risk. The argument also stops being true in the good way if standards bodies put the numbers into the rule — then a boolean attestation is fine, because the standard carries the engineering content.

What I would do differently

If I were drafting the clause, I would keep the risk tier and replace the condition: disclose teleop ratio, takeover latency with a P95, robots per operator and minimum risk state at deployment, and update the disclosure when the model or the operating domain changes.

If I were buying, I would put those four numbers in the contract with a test procedure and a remedy, and refuse “the operator is in the loop” as an answer to a technical question.

If I were deploying, I would instrument the human link before adding robots — link loss, takeover latency and minimum-risk-state entry as first-class telemetry — and cap concurrency at what is genuinely supervised, raising it only with data.

The wider lesson from ADAS is that the industries which measured got the better regulation. Robotics should start that measurement culture before an incident makes it mandatory, because boolean rules that fail do not get refined. They get replaced with something much blunter.