Man accidentally gains control of 7k robot vacuums
popsci.com
February 22, 2026
5 min read
🔥🔥🔥🔥🔥
66/100
Summary
A software engineer gained unauthorized access to 7,000 robot vacuums while developing a remote-control app for his DJI vacuum. By reverse-engineering the communication between the robot and DJI's cloud servers, he discovered that his credentials allowed him to view live camera feeds from multiple devices.
Key Takeaways
- A software engineer gained unauthorized access to live camera feeds and microphone audio from nearly 7,000 DJI robot vacuums due to a security vulnerability in the company's cloud servers.
- The engineer discovered that the same credentials used for his vacuum allowed access to other devices, raising concerns about the potential for surveillance without owners' knowledge.
- DJI acknowledged the security issue and implemented two updates to resolve it, stating that no user action was required for the fix.
- The incident highlights the cybersecurity risks associated with internet-connected home devices as their adoption increases.
Community Sentiment
Positives
- The separation of the computer vision module from the main board in robot vacuums enhances privacy by ensuring only processed data is sent, reducing risks of raw data exposure.
- Using valetudo compatible vacuums allows users to replace default software, potentially increasing security and control over their devices.
Concerns
- The incident highlights significant security flaws in IoT devices, where shared credentials can lead to unauthorized access to sensitive data across thousands of devices.
- Reliance on internet connections for device functionality poses privacy concerns, as users may prefer devices that operate reliably offline.