DJI flaw gives gamer keys to 7,000 robot vacuums

A software engineer wanted to drive his new vacuum with a video game controller. Instead, he ended up with the master keys to thousands of living rooms.

Sammy Azdoufal was building a custom controller app for his $2,000 DJI Romo vacuum. With a little help from an AI coding assistant, he reverse-engineered how the device talked to DJI’s cloud servers to fetch a security token. But when the cloud responded, it didn’t just verify his hardware. It handed him live access to nearly 7,000 other vacuums across 24 countries.

An accidental digital invasion

The glitch effectively turned Azdoufal into an admin for an army of roving internet-connected cameras. Without breaking any serious encryption or writing bespoke malware, he suddenly had access to real-time video feeds, live microphone audio, generated 2D floor plans, and approximate physical locations via IP addresses.

Modern autonomous cleaners rely heavily on rich visual context to tell a kitchen from a living room, offloading spatial maps and sensor streams to cloud servers. When server-side access controls drop the ball, those spatial maps become blueprints for bad actors.

Azdoufal didn't exploit the access. He took his findings to The Verge, which flagged the issue with DJI. DJI told Popular Science that it spotted the flaw in late January during an internal review and rolled out two automatic backend patches on February 8 and February 10, requiring no action from device owners.

The growing surveillance footprint inside our homes

The incident lands during an already uncomfortable stretch for connected home security. Amazon's Ring recently caught heat over a pet-finding ad campaign that critics blasted as a cover for neighborhood surveillance. Around the same time, reports surfaced that Google pulled supposedly deleted footage from a Nest Doorbell to aid a police investigation, reigniting debates over who truly controls smart home footage.

And vacuums are just the baseline. Companies like Tesla, Figure, and 1X are racing to bring full-fledged humanoid assistants into residential spaces. For a helper robot to fold laundry or clean dishes, it requires total, intimate spatial visibility. In an insecure cloud environment, that is a potential goldmine for stalkers and extortionists.

Why it matters

For everyday consumers, this is a wake-up call about the physical risks of smart appliances. The 7,000 affected owners did nothing wrong. They didn't fall for phishing links or pick weak passwords; their privacy was completely compromised simply because a backend server failed to verify basic ownership.

For hardware makers, the lesson is painful. DJI built a premium $2,000 machine loaded with top-tier sensors, but the barrier protecting thousands of camera feeds came down over a routine authorization oversight. Building physical robots is hard, but securing the cloud pipelines they depend on is what keeps them from turning into surveillance liabilities.

We also think this highlights a new dynamic created by generative AI. Azdoufal used an AI coding assistant to quickly tear down proprietary communications. As AI lowers the barrier for reverse-engineering and exploring APIs, companies will have to assume that curious tinkerers and bad actors alike can probe their backend infrastructure with far greater speed and ease.