--- title: "Eiliko's 68,000 reachable robots show consumer robotics has no R155" url: https://www.liamding.com/en/posts/2026-10-21-eiliko-68000-robot-fleet-safety-case/ markdown_url: https://www.liamding.com/en/posts/2026-10-21-eiliko-68000-robot-fleet-safety-case/index.md html_url: https://www.liamding.com/en/posts/2026-10-21-eiliko-68000-robot-fleet-safety-case/ language: en date: 2026-10-21 lastmod: 2026-10-25 description: "Eiliko exposed 68,000 reachable robots. A working definition of a deployed fleet, Apple's enclave counter-design, and why the ADAS analogy breaks where it matters." categories: ["Robotics"] tags: ["consumer robotics", "fleet security", "Eiliko", "UN R155", "Apple HomeView"] professional: true sources: - title: "The Verge tests the Eiliko robot toy: 68,000 devices exposed and remotely hijackable" url: "https://aihot.news/items/pd501xipe38ooxo1t7jn7hphn" - title: "Apple HomeView product page (A18 Secure Exclaves)" url: "https://www.apple.com/apple-homeview/" - title: "Apple launches 7-inch HomeView at $299 with Siri AI" url: "https://aihot.news/items/kjcq4dywmvs5xijl4emac5o40" - title: "Waymo to enter Toronto, targeting first passengers in 2028" url: "https://aihot.news/items/xwgy3mhme6nur9kndswxlu0es" - title: "Hackers trigger automatic defrost in European supermarket freezers" url: "https://www.tomshardware.com/tech-industry/cyber-security/unprecedented-cyberattack-cripples-supermarket-fridges-across-europe-as-hackers-activate-automatic-defrosting-delivery-and-store-prices-also-impacted-by-incident" - title: "Single-motor drone steers rotors with a special hinge (DIY demo)" url: "https://www.youtube.com/watch?v=Ndftcft6XhU" author: "Liam Ding（丁洪）" canonical: https://www.liamding.com/en/posts/2026-10-21-eiliko-68000-robot-fleet-safety-case/ --- ## The problem On 16 October 2026 The Verge published a test, run with hacker Sammy Azdoufal, on Eiliko — the companion robot from Energize Lab. User conversations, user profiles, children's photos and audio sat on an unprotected server. Roughly 68,000 devices were reachable, along with about 13 million conversations; more than 31,000 of the child profiles came from the United States, and remote hijack of a device was demonstrated. My conclusion up front: this is not a security lapse bolted onto one toy. It is the default architecture of consumer robotics — always-on microphone and camera, convenience-first backend, and nothing in the reporting that describes a patch or revocation path — shipped at fleet scale before the category agreed on what "deployed" means. Automotive got a monitored, patchable, revocable trust boundary as a condition of sale because type approval forced it. Consumer robots have no such forcing function, so the discipline has to come from product choice. Until it does, companion-robot unit economics are borrowing against a liability nobody has booked. ## What I concluded A working definition: a fleet is deployed when every unit is inventoried (you can enumerate it and know who owns it), authenticated when reached (reachability without identity is exposure, not deployment), patchable (a fix reaches the whole installed base inside a stated window), revocable (you can cut a device or a credential off in minutes), and owned (a named human is accountable at 3am, with the authority to switch things off). Score Eiliko against it on reported facts alone. Inventoried: partly — the fleet existed as database rows with profiles attached, but access required no identity, so inventory and access were the same thing, which is the failure. Authenticated: no. Patchable: not described. Revocable: not described. Owner: not named publicly. Two properties out of five, and both are the cheap ones. That is the argument: a product can be charming, sell in volume, and still not be deployed. The industry treats "shipped" and "deployed" as synonyms because the gap only shows up on the worst day. ## Constraints Four constraints decide this; only one is technical. Cost. $299 — what Apple charges for HomeView — is roughly the ceiling for a mass-market household device. Every dollar of BOM spent on a secure element, a hardware root of trust or per-unit key provisioning comes out of the microphone array or the margin. Observability. At purchase, a buyer cannot tell whether a backend is authenticated. Security is an unobservable attribute, so the shelf cannot price it, so the cheapest architecture wins. That mechanism, more than malice, explains Eiliko. Feedback latency. A car's failure is kinetic, attributable and litigated within weeks. A robot toy's failure is a privacy breach that surfaces years later, to a customer who never sees the bill. The market signal that would discipline the design arrives after three more generations have shipped. No forcing function. UN R155 and ISO 21434 gate automotive through type approval: no certificate, no sale. Nothing gates a $200–300 consumer robot. The nearest evidence that connected-device security does not self-organise is October's attack on European supermarket refrigeration: Reuters named Intermarché with 150 stores targeted, Le Monde reported chains shutting freezers, Claroty's Team82 had earlier disclosed Danfoss refrigeration-controller vulnerabilities — and the reporting still does not confirm the CVE, the attacker or the losses. A refrigeration controller at least has an operator and a service contract. A toy has a parent. ## The options, and what I traded away The fork is not secure versus insecure; it is where the boundary sits and what capability you give up holding it. HomeView is the useful counter-architecture because it prices into the same band: $299, a 7-inch display, on sale 13 November in the US, UK, Canada and Australia, with A18 Secure Exclaves processing camera and microphone data in an isolation region the OS and Apple cannot read. That is a product-page claim, not an independently verified property — treat it as design intent. It also has no App Store access, which is the same trade seen from the other side. | Option | What it buys | What it costs | Why I did / did not pick it | | --- | --- | --- | --- | | Cloud-first perception with an unauthenticated convenience backend (the architecture the Eiliko reporting is consistent with) | Cheapest BOM, fastest iteration, remote support without per-unit identity | The trust boundary, and any ability to revoke once the fleet is large | Would not pick it. The data flywheel is real, but it is financed with a liability nobody books | | Enclave-first local perception the vendor cannot read (HomeView / A18 Secure Exclaves) | A boundary that survives a breach of your own backend; a claim rivals cannot copy cheaply | The improvement loop, remote diagnostics, some personalisation, higher silicon cost | Would pick it for perception on a device that lives in a bedroom, and accept a thinner cloud feature set | | Per-unit identity, authenticated cloud, OTA and revocation (the R155-shaped answer) | Patchability, enumeration, revocation in minutes, an auditable incident trail | Key provisioning, a standing security-ops function, slower releases, per-SKU re-certification | Would pick it as the floor, not the ceiling: the cheapest option that makes "deployed" true | | Local-only appliance, no cloud, no companion features | Smallest liability surface; nothing to breach at fleet scale | The product's reason to exist — remote viewing, conversation, companionship | Would pick it only if the thing is sold as a camera, not a companion. At $299 it does not survive retail | | Region-gated launch, shipping only where you can staff incident response | Defensible operations; a disclosure norm you can actually meet | TAM, and a slower ramp than the funding plan assumes | Would pick it for a first hardware generation; the only version of moving fast that survives a breach | ## Evidence Three data points do the work. Eiliko's scale: 68,000 reachable devices, 13 million conversations, 31,000+ US child profiles. The last number is what turns an architecture critique into a regulatory and reputational event — and it is a number a product manager could have put on a slide before shipping. HomeView: $299, 13 November, four markets, enclave claim unverified. Proof that the trust boundary is affordable at this price, and proof that it costs you the app ecosystem. Waymo: 400M+ fully autonomous km, a claimed 95% reduction in serious-injury-or-worse crashes versus human drivers, and a Toronto service aiming at first passengers in 2028, preceded by human-driven mapping and expert testing with Element Fleet Management. That is what a safety case with a denominator looks like. A $299 desktop robot cannot make a claim of that shape — and the week's DIY single-motor drone video, with no productisation and no independent performance data, shows how wide the demo-to-deployment gap still is. Counter-arguments. "It's a toy, the threat is low" — the demonstrated hijack and the child-profile count answer it. "Enclaves break the product" — partly true; Apple answers that with services revenue a startup does not have, and the asymmetry is real, not a morality gap. "Regulation will come, so waiting is rational" — only if the liability is capped, and it isn't. "The car analogy is overreach because cars kill people" — correct, and that is the point: the analogy breaks in the direction that makes robotics harder, because feedback is slow and the victim is not the buyer. ## Where this stops being true The argument holds for sub-$500 consumer robots with always-on sensors, sold through retail in the US and EU, at fleets above roughly ten thousand units where manual handling stops scaling. It weakens for warehouse and field robots, where the operator is the buyer, the site has its own security function and the service contract already carries an SLA; for enterprise fleets with an incident-response owner on day one; for devices whose current generation already ships a hardware root of trust; and at very small fleets — 68,000 units is big enough to hurt and small enough that a determined team could almost inventory and patch by hand. What I am not claiming: that HomeView's enclave is verified, or that any of this is settled. ## What I would do differently Four demands, all falsifiable. A retention limit on the spec sheet, with a number: how long conversations and images are kept, where, and whether they leave the device. A vendor who will not write it down has answered. An OTA and revocation SLA: how fast a fix reaches the installed base, how fast a device or a credential can be cut off. No number, no capability. An incident disclosure commitment with a named person who has the authority to revoke a SKU — not a security@ inbox. That is the answer to "who do I call at 3am". A definition of "deployed" written into the purchase contract or the investor memo — inventoried, authenticated, patchable, revocable, owned — and the vendor scored against it. My reading is that the category gets there through product choices booked as costs, not through a regime that arrives on its own. Automotive needed type approval plus two standards before a trust boundary became a condition of sale. Consumer robotics has neither, so the only forcing function available now is a buyer who asks and a product manager who writes the answers into the spec. Until then the flywheel is financed with data that, in this case, belonged to more than 31,000 American children.