The file in front of the auditor
The maker says it has disabled memory, yet a photograph showing an owner's face remains accessible at a web address. That is the condition Sean Hollister reports verifying in The Verge's new Eiliko investigation. Energize Lab promises an independent security review; Hollister says some photos and audio files still opened through unsecured public links when its statement arrived. The audit has a concrete starting point: the authorization governing access to that file. Disabling a conversational feature can leave the route to its stored material open.[1]
The statement names several objects: conversation transcripts, profiles derived from them and avatar images. It says new conversations and profiles are no longer being stored and older material will be deleted. Yet audio files and photos are among the objects the reporter could still open. How all of these fit within the company's promise to erase related content determines what a family's request actually reaches. Removing a transcript alone does not explain what happened to an audio copy of the same conversation.[1]
What a temporary shutdown achieves
Temporarily disabling long-term memory and custom avatars creates a meaningful boundary. Remembering an owner or displaying a chosen face may be a legitimate personalization feature; reducing new accumulation is a concrete measure while a review proceeds. The company says those features will not return until their security is confirmed. That commitment establishes a condition for operating the feature again. The present access permissions on a previously uploaded file still require a separate assessment.[1]
The company says external backend access has been closed, while Hollister verifies that some files remain exposed. That discrepancy calls for identifying which systems the announced measures actually cover. A separate file service left outside the initial intervention is one possible explanation; the report does not describe enough architecture to establish it. I cannot infer that every repair is fictitious. The narrower conclusion is that the scope described in the statement has yet to account for the files the reporter could still access.[1]
Where deletion has to reach
Researcher Sammy Azdoufal separately says he retains SSH access to robots and can theoretically read transcripts or change their behavior. This is a broader capability claim from the researcher, distinct from Hollister's check that a photo opens. Treating the two routes separately makes the outcome intelligible to a family: who can reach an old photograph, and who can alter what the robot says next? Closing one route does not establish that the other has closed as well.[1]
The review's value to a family lies in making the fate of those files understandable. Erasure, restricted access and an end to new collection produce different outcomes; all may matter for the same toy. Explaining which copies a request from the person depicted or recorded reaches need not expose private data or publish technical details that create another vulnerability. In the promised follow-up, the meaningful account concerns access to the photographs and audio already left behind, rather than simply the number of features switched off.[1]