On 16 October 2026 The Verge published a test, run with hacker Sammy Azdoufal, on Eiliko — the companion robot from Energize Lab. User conversations, user profiles, children’s photos and audio sat on an unprotected server. Roughly 68,000 devices were reachable, along with about 13 million conversations; more than 31,000 of the child profiles came from the United States, and remote hijack of a device was demonstrated.

My conclusion up front: this is not a security lapse bolted onto one toy. It is the default architecture of consumer robotics — always-on microphone and camera, convenience-first backend, and nothing in the reporting that describes a patch or revocation path — shipped at fleet scale before the category agreed on what “deployed” means. Automotive got a monitored, patchable, revocable trust boundary as a condition of sale because type approval forced it. Consumer robots have no such forcing function, so the discipline has to come from product choice. Until it does, companion-robot unit economics are borrowing against a liability nobody has booked.

What I concluded

A working definition: a fleet is deployed when every unit is inventoried (you can enumerate it and know who owns it), authenticated when reached (reachability without identity is exposure, not deployment), patchable (a fix reaches the whole installed base inside a stated window), revocable (you can cut a device or a credential off in minutes), and owned (a named human is accountable at 3am, with the authority to switch things off).

Score Eiliko against it on reported facts alone. Inventoried: partly — the fleet existed as database rows with profiles attached, but access required no identity, so inventory and access were the same thing, which is the failure. Authenticated: no. Patchable: not described. Revocable: not described. Owner: not named publicly. Two properties out of five, and both are the cheap ones.

That is the argument: a product can be charming, sell in volume, and still not be deployed. The industry treats “shipped” and “deployed” as synonyms because the gap only shows up on the worst day.

Constraints

Four constraints decide this; only one is technical.

Cost. $299 — what Apple charges for HomeView — is roughly the ceiling for a mass-market household device. Every dollar of BOM spent on a secure element, a hardware root of trust or per-unit key provisioning comes out of the microphone array or the margin.

Observability. At purchase, a buyer cannot tell whether a backend is authenticated. Security is an unobservable attribute, so the shelf cannot price it, so the cheapest architecture wins. That mechanism, more than malice, explains Eiliko.

Feedback latency. A car’s failure is kinetic, attributable and litigated within weeks. A robot toy’s failure is a privacy breach that surfaces years later, to a customer who never sees the bill. The market signal that would discipline the design arrives after three more generations have shipped.

No forcing function. UN R155 and ISO 21434 gate automotive through type approval: no certificate, no sale. Nothing gates a $200–300 consumer robot. The nearest evidence that connected-device security does not self-organise is October’s attack on European supermarket refrigeration: Reuters named Intermarché with 150 stores targeted, Le Monde reported chains shutting freezers, Claroty’s Team82 had earlier disclosed Danfoss refrigeration-controller vulnerabilities — and the reporting still does not confirm the CVE, the attacker or the losses. A refrigeration controller at least has an operator and a service contract. A toy has a parent.

The options, and what I traded away

The fork is not secure versus insecure; it is where the boundary sits and what capability you give up holding it. HomeView is the useful counter-architecture because it prices into the same band: $299, a 7-inch display, on sale 13 November in the US, UK, Canada and Australia, with A18 Secure Exclaves processing camera and microphone data in an isolation region the OS and Apple cannot read. That is a product-page claim, not an independently verified property — treat it as design intent. It also has no App Store access, which is the same trade seen from the other side.

Evidence

Three data points do the work.

Eiliko’s scale: 68,000 reachable devices, 13 million conversations, 31,000+ US child profiles. The last number is what turns an architecture critique into a regulatory and reputational event — and it is a number a product manager could have put on a slide before shipping.

HomeView: $299, 13 November, four markets, enclave claim unverified. Proof that the trust boundary is affordable at this price, and proof that it costs you the app ecosystem.

Waymo: 400M+ fully autonomous km, a claimed 95% reduction in serious-injury-or-worse crashes versus human drivers, and a Toronto service aiming at first passengers in 2028, preceded by human-driven mapping and expert testing with Element Fleet Management. That is what a safety case with a denominator looks like. A $299 desktop robot cannot make a claim of that shape — and the week’s DIY single-motor drone video, with no productisation and no independent performance data, shows how wide the demo-to-deployment gap still is.

Counter-arguments. “It’s a toy, the threat is low” — the demonstrated hijack and the child-profile count answer it. “Enclaves break the product” — partly true; Apple answers that with services revenue a startup does not have, and the asymmetry is real, not a morality gap. “Regulation will come, so waiting is rational” — only if the liability is capped, and it isn’t. “The car analogy is overreach because cars kill people” — correct, and that is the point: the analogy breaks in the direction that makes robotics harder, because feedback is slow and the victim is not the buyer.

Where this stops being true

The argument holds for sub-$500 consumer robots with always-on sensors, sold through retail in the US and EU, at fleets above roughly ten thousand units where manual handling stops scaling. It weakens for warehouse and field robots, where the operator is the buyer, the site has its own security function and the service contract already carries an SLA; for enterprise fleets with an incident-response owner on day one; for devices whose current generation already ships a hardware root of trust; and at very small fleets — 68,000 units is big enough to hurt and small enough that a determined team could almost inventory and patch by hand. What I am not claiming: that HomeView’s enclave is verified, or that any of this is settled.

What I would do differently

Four demands, all falsifiable.

A retention limit on the spec sheet, with a number: how long conversations and images are kept, where, and whether they leave the device. A vendor who will not write it down has answered.

An OTA and revocation SLA: how fast a fix reaches the installed base, how fast a device or a credential can be cut off. No number, no capability.

An incident disclosure commitment with a named person who has the authority to revoke a SKU — not a security@ inbox. That is the answer to “who do I call at 3am”.

A definition of “deployed” written into the purchase contract or the investor memo — inventoried, authenticated, patchable, revocable, owned — and the vendor scored against it.

My reading is that the category gets there through product choices booked as costs, not through a regime that arrives on its own. Automotive needed type approval plus two standards before a trust boundary became a condition of sale. Consumer robotics has neither, so the only forcing function available now is a buyer who asks and a product manager who writes the answers into the spec. Until then the flywheel is financed with data that, in this case, belonged to more than 31,000 American children.

中文版

问题

2026 年 10 月 16 日，The Verge 公布了与黑客 Sammy Azdoufal 一起对 Energize Lab 旗下陪伴机器人 Eiliko 所做的实测：用户的对话、用户画像、儿童照片和音频被存放在一台没有防护的服务器上；约 68000 台设备可被访问，涉及约 1300 万条对话，其中超过 31000 份儿童档案来自美国，并且演示了远程劫持一台设备。

先说结论：这不是某个玩具上额外长出来的一个安全漏洞，而是消费机器人的默认架构——常开的麦克风和摄像头、以方便为先的后端，而公开报道中没有描述任何补丁或吊销路径——它在整个品类还没定义清楚什么叫“已部署”之前，就已经按机队规模出货了。汽车行业之所以能做到“可监控、可修补、可吊销的信任边界是销售前提”，是因为型式认证把这个要求变成了硬门槛。消费机器人没有这样的强制力，所以这份纪律只能来自产品选择。在它到来之前，陪伴机器人的单位经济模型，本质上是在抵押一笔没有人入账的负债。

我的结论

一个可用的定义：只有当每一台设备同时满足下面五点时，这支机队才算“已部署”——可清点（能枚举出来，并知道归谁所有）、接入时可认证（没有身份的可达性只是暴露，不是部署）、可修补（修复能在明确的时间窗内覆盖整个存量装机）、可吊销（几分钟内能把一台设备或一份凭证切断）、有责任人（凌晨三点有人负责，并且有权关停）。

只用已报道的事实给 Eiliko 打分：可清点——部分成立，机队确实以数据库记录的形式存在、还挂着用户画像，但访问不需要身份，于是“清点”和“访问”变成了同一件事，这正是失败点；接入可认证——否；可修补——报道中没有；可吊销——报道中没有；责任人——没有公开。五条里占两条，而且都是最便宜的两条。

这就是本文的论点：一个产品可以很讨喜、可以卖得很好，却仍然不算“已部署”。行业一直把“出货”和“部署”当同义词，因为这两者的差别只在最糟糕的那一天才显现。

约束条件

四个约束决定了这件事，其中只有一个与技术有关。

成本。Apple 给 HomeView 定的 299 美元，大致就是大众家庭设备的价格上限。BOM 上每多花一美元在安全芯片、硬件信任根或单机密钥注入上，就要从麦克风阵列或者毛利里扣回来。

可观察性。在购买那一刻，买家无法判断一个后端是否做了认证。安全是不可观察的属性，货架就无法给它定价，最便宜的架构于是赢下货架。Eiliko 这件事的机制更多在这里，而不是恶意。

反馈延迟。汽车出问题，是动能事件、责任可归、几周内进入诉讼。机器人玩具出问题，是几年后才浮出水面的隐私泄露，而买单的客户根本看不到账单。本来可以约束设计的那条市场信号，要等到又出货三代之后才到。

没有强制力。汽车有 UN R155 和 ISO 21434，靠型式认证卡住：没有证书就不能卖。200–300 美元的消费机器人没有任何对应的关卡。最接近的反证是 10 月那起针对欧洲超市冷链的网络攻击：路透点名 Intermarché，称 150 家门店被针对；《世界报》报道多家连锁被迫关闭冷柜；Claroty 的 Team82 此前披露过 Danfoss 制冷控制器的漏洞——但报道至今没有确认用的是哪个 CVE、攻击者是谁、损失多少。制冷控制器好歹有一个运营方和一份服务合同；玩具只有一个家长。

取舍选项

真正的分岔不是“安全还是不安全”，而是边界放在哪里，以及为了守住它愿意放弃什么能力。HomeView 是最好的对照架构，因为它落在同一个价格带：299 美元、7 英寸屏、11 月 13 日起在美英加澳发售，按产品页面描述，A18 芯片的 Secure Exclaves 把摄像头和麦克风的数据放在操作系统和 Apple 都无法访问的隔离区内处理。这只是产品页面的说法，尚无独立验证，应当按设计意图而非实测属性来看。它同时不提供 App Store 访问——这是同一笔取舍的另一面。

证据

三个数据点撑起全文。

第一是 Eiliko 的规模：68000 台可达设备、1300 万条对话、超过 31000 份美国儿童档案。最后一个数字才是把架构批评变成监管与声誉事件的东西——而这个数字，产品经理在出货前就能写进一页 PPT。

第二是 HomeView：299 美元、11 月 13 日、四个市场、隔离区说法未经独立验证。它证明信任边界在这个价位是负担得起的，也证明代价是失去应用生态。

第三是 Waymo：超过 4 亿公里完全自动驾驶里程、官方称在严重伤害及以上事故中比人类驾驶少 95%、多伦多目标 2028 年迎接首批乘客，且此前先以人工驾驶采图并由自动驾驶专家测试、与 Element Fleet Management 合作做车队管理。这才是一份有分母的安全论证。299 美元的桌面机器人做不出这种形状的声明——而同期流传的单电机 DIY 无人机视频，既没有产品化也没有独立性能数据，恰好说明从 demo 到部署的沟还多宽。

反方意见值得认真对待。“它只是个玩具，威胁很低”——演示出来的远程劫持和那 31000 份儿童档案就是回答。“隔离区会毁掉产品”——部分成立；Apple 用初创公司没有的服务收入来填这笔账，这种不对称是真实的，不是道德差距。“监管总会来，等等更理性”——只有当责任被封顶时才成立，而它并没有被封顶。“汽车类比是硬套，汽车会撞死人”——说得对，而这正是要点：这个类比断裂的方向，是让机器人更难而不是更容易，因为反馈慢，而且受害者不是买家。

这个结论的边界

这套论证适用于 500 美元以下、带常开传感器、走零售渠道、销往美国和欧盟的消费机器人，且机队规模大致在万台以上、人工处理已经不可行的区间。它在这些情况下会变弱：仓储与野外机器人，买家就是运营方、现场自带安全团队、服务合同里本来就有 SLA；第一天就有事故响应责任人的企业机队；当前一代已经带硬件信任根的设备；以及规模极小的机队——6.8 万台大到会疼，也小到一个有决心的团队几乎能靠人工清点和打补丁。我不主张的是：HomeView 的隔离区已经得到验证，或者这件事已经有了定论。

我会怎么改

四条要求，都可被证伪。

第一，把留存上限写进规格表并给出数字：对话和图像保存多久、存在哪里、是否会离开设备。不愿意白纸黑字写下来的厂商，其实已经回答了。

第二，OTA 与吊销的 SLA：修复多久能覆盖存量装机，多久能切断一台设备或一份凭证。没有数字，就等于没有能力。

第三，事件披露承诺，并指名一个有权限吊销某个 SKU 的人，而不是一个 security@ 邮箱。这就是“凌晨三点我打给谁”的答案。

第四，把“已部署”的定义写进采购合同或投资备忘录——可清点、可认证、可修补、可吊销、有责任人——并据此给厂商打分。

我的判断是：这个品类会走到那一步，靠的是被记成成本的产品选择，而不是一个自己长出来的监管框架。汽车是在有了型式认证加两份标准之后，信任边界才成为销售前提的。消费机器人两样都没有，所以眼下唯一可用的强制力，是一个会提问的买家，和一个把答案写进规格的产品经理。在那之前，飞轮是用数据融资的——而这一次，这些数据属于超过 31000 名美国儿童。