Skip to main content

What are they?

AI devices (including smart assistants, AI-enabled toys, and other smart products with voice/chat features) are often part of the wider Internet of Things (IoT). Like other smart devices, they can introduce security risks if they have weak/default passwords, insecure web admin pages, insecure cloud portals/apps, or poor update mechanisms. These weaknesses can lead to unauthorised access, data exposure, or devices being controlled remotely.  

An exposed admin page is a device management interface (often a web page or online dashboard) that lets someone configure the device. If this admin interface is reachable by the wrong people (e.g. exposed to the internet, protected by weak credentials, or linked to insecure cloud login), an attacker may be able to access the device, change settings, view data, or take control.  

AI-enabled devices can raise the impact because they may collect or store: 

  • Voice recordings/transcripts, chat logs, preferences, and behavioural data 
  • Account links and tokens to other services (email, calendars, smart home controls). 

 

Who is at risk?

Individuals  

  • Anyone using smart assistants, smart cameras, baby monitors, connected toys, or other internet-connected devices can be at risk if devices are set up with insecure defaults or not kept updated.  
  • Households are particularly at risk where devices are configured for remote access (or router settings expose them), or where passwords are weak or reused.  

Businesses and organisations 

  • Organisations that use consumer-grade smart/AI devices in workplaces (offices, schools, care settings, hospitality) can be at risk if devices are added quickly without proper controls, asset tracking, or update management.  
  • Any business providing AI-enabled devices (or device-linked portals/apps) can be at risk if their ecosystem interfaces (cloud dashboards, web portals, APIs, mobile apps) are insecure.  

 

How attacks work

Example 1: Default or easily guessable passwords 

Some devices ship with weak credentials or insecure default settings. If a criminal can guess the password, they may be able to log into the device admin page and access the home or business network. UK smart device guidance recommends changing easily guessable passwords during setup. 

Example 2: Insecure cloud portals  

Sometimes the risk isn’t the device itself, it’s the web portal used to manage it. For example, reporting in January 2026 described an AI toy company whose web portal allowed access to tens of thousands of children’s chat logs with weak access controls (anyone with a basic login could view data they shouldn’t have). This shows how insecure portals can expose sensitive conversations and personal details. 

Example 3: No updates (or device is out of support) 

Manufacturers need to release updates that fix bugs and security issues. If updates aren’t available (or aren’t installed), devices become easier to hack over time.  

 

Controls

People  

  • Before you buy check reviews of the product and manufacturer and avoid devices that are no longer supported or won’t receive updates.  
  • Be cautious with devices aimed at children (toys) because they can involve highly sensitive data (conversations, routines, personal details).  

Process  

  • Change default settings at setup: If the device/app uses an easily guessable password, change it immediately.  
  • Enable MFA on accounts used to manage devices, where available.  
  • Regular updates: install device firmware/app updates promptly (or enable automatic updates if available).  
  • Know what’s connected: keep a simple list of smart/AI devices and the accounts/apps that control them (helpful for families and essential for organisations).  

Tech 

  • Don’t expose admin pages to the internet: avoid settings that allow remote management unless you understand and need it. If remote access is enabled, ensure strong authentication is used.  
  • Secure home/business Wi-Fi and router settings: exposed devices are often the result of risky router configuration (e.g. enabling remote access features without understanding them). The aim is to keep device management inside your trusted network.  
  • Segment devices if possible: put smart/AI devices on a separate Wi-Fi network (guest network) where available, to reduce risk to laptops and phones if a device is compromised. This aligns with the general risk that compromised devices can be used to access your wider network.  
  • For organisations: treat smart/AI devices like IT assets:  
    • Approved device list / procurement checks 
    • Patching/update plan 
    • Disable unnecessary services 
    • Remove devices that are out of support.