Thousands of AI-driven companion robots sold as interactive toys are vulnerable to hacking, according to a security researcher who identified serious flaws affecting around 68,000 units. The weakness could allow attackers to control these devices remotely and manipulate their messages to unsuspecting child users, posing emotional risks.
The affected toys, such as mini AI companions designed to engage children in conversation and play, rely on cloud-based services to operate. The security gap lies in inadequate protections around device authentication and communication with the manufacturer’s servers, enabling unauthorized access. Hackers could exploit this to send harmful or traumatizing statements, including false claims about a child's parents, which the toy might vocalize in interaction.
This discovery raises concerns about the safety of AI-powered devices aimed at minors, highlighting the need for stricter cybersecurity measures in consumer electronics. Owners of these toys are advised to remain vigilant about software updates and confirm security features are up to date. Manufacturers, in turn, face mounting pressure to implement robust safeguards against unauthorized remote manipulation to protect vulnerable users.