A software engineer using an AI coding assistant to reverse-engineer his DJI robot vacuum's communication system inadvertently gained access to live camera feeds, microphone audio, maps, and status data from nearly 7,000 other vacuums across 24 countries due to a backend security vulnerability.
Sammy Azdoufal was attempting to build a remote-control app for his DJI Romo robot vacuum using an AI coding assistant to help reverse-engineer the device's communication with DJI's cloud servers. The DJI Romo is an autonomous home vacuum that retails for around $2,000 and launched in China last year before expanding to other countries. During his development process, Azdoufal discovered that the same credentials allowing him to control his own device also provided unauthorized access to nearly 7,000 other robot vacuums across 24 countries. This backend security bug exposed live camera feeds, microphone audio, 2D floor plans of homes, and status data from the affected devices. The vulnerability essentially created an army of potential surveillance tools that could have been exploited without owners' knowledge. Azdoufal responsibly disclosed the findings to The Verge, which contacted DJI to report the flaw. DJI stated they identified the vulnerability through internal review in late January and deployed fixes on February 8 and February 10, with automatic updates requiring no user action. The incident highlights broader cybersecurity concerns about internet-connected smart home devices and robots.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Vulnerabilities that can be exploited in AI systems, software development toolchains, and hardware, resulting in unauthorized access, data and privacy breaches, or system manipulation causing unsafe outputs or behavior.
AI system
Due to a decision or action made by an AI system
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
