A Hobbyist Accidentally Hacked 7000 DJI Robot Vacuums Using a PlayStation Controller

The event raises massive issues about the security of "smart devices".

When Sammy Azdoufal got a DJI Romo vacuum, he wanted to have a little bit of fun with it. Instead of just using the app, he wanted to use his PlayStation 5 controller to drive the $2,000 machine like a car in a video game.

He started poking at the code with AI and tried to reverse-engineer the secret digital greeting that his vacuum used to talk to the cloud. When the connection finally clicked, Azdoufal suddenly realized he could see thousands of rooms.

He had accessed 6,700 other vacuums across 24 countries. He saw their battery levels, their serial numbers, and their maps. With a few more keystrokes, he realized he could tap into live camera feeds and listen through microphones. The “Romo,” a machine the size of a small terrier designed to clean floors, had inadvertently become a fleet of 7,000 mobile spies. And their owners had no idea they were spied on.

Whoopsie

It’s a classic security breach. Essentially, the security token intended to verify his ownership of a single device acted as a skeleton key for DJI’s entire fleet.

When you buy a modern autonomous device, you aren’t just buying hardware. You are buying a persistent connection to a server farm, often thousands of miles away. Modern robots like the DJI Romo use a protocol called MQTT (Message Queuing Telemetry Transport). The devices send packets to the server every few seconds. These packets contain information like “I’m stuck on a rug,” “I’m at 40% battery,” or “Here is a 2D map of the master bedroom.”

Obviously, there are security risks. In a secure system, the server checks your “security token” and only lets you see data that belongs to your specific device. But when Azdoufal presented his token, the DJI server handed him the master ledger. It’s like using your hotel room key to get access to everything in the building.

Azdoufal told The Verge he tried to put the vacuum on his PS5 because it seemed “fun”, but he quickly realized what he had actually done. The laptop began cataloging thousands of devices and the messages they were sending. Within nine minutes of a live demo, he had collected over 100,000 messages from robots globally. He gained access to live camera feeds, microphone audio, maps, and status data from nearly 7,000 other vacuums across 24 countries.

A Crazy Breach

The craziest part of this is that Azdoufal wasn’t even trying to achieve this. He simply used an AI (Claude Code) to help him translate the “machine speak” of the DJI protocols into human-readable instructions. This democratization of technical skill is a double-edged sword. While it allows hobbyists to build cool apps for their game controllers, it also means that the barrier to finding catastrophic security flaws has never been lower.

×

Get smarter every day...

Stay ahead with ZME Science and subscribe.

Daily Newsletter
The science you need to know, every weekday.

Weekly Newsletter
A week in science, all in one place. Sends every Sunday.
No spam, ever. Unsubscribe anytime. Review our Privacy Policy.

Thank you! One more thing...

Please check your inbox and confirm your subscription.

RelatedPosts

Google scientists propose adding a ‘kill switch’ for A.I.
Google just released a chatbot that’s trying to figure out the purpose of life
Scientists override fear response in humans using artificial intelligence and hard cash
Anti-robot protest rallied at SXSW is just a marketing stunt – the message isn’t

This matters more than ever because we are filling our homes with cameras and other sensors at a rate that would make a Cold War intelligence officer jealous.

We now have “smart” doorbells, “smart” speakers, and “smart” refrigerators. All of these are equipped with cheap but very robust sensors. You wouldn’t think a vacuum needs a microphone, but here we are. The vacuum is all the more problematic because it moves around and knows the layout of your home. The 2D maps Azdoufal saw were accurate enough to plan a physical break-in. It also knows when you are home and when you are at work.

In 2024, hackers took over Ecovacs vacuums to shout slurs at owners. In 2025, Dreame and Narwal robots were found to have flaws that allowed real-time camera access. We are inviting these machines into our most intimate spaces — our bedrooms and nurseries — while the companies building them are still learning the basics of “Security 101.”

There is also a geopolitical dimension. DJI, a Chinese tech giant, has long been under the microscope of US lawmakers. While the evidence of state-sponsored “backdoors” remains a subject of intense debate, bugs like this one provide political ammunition. If a hobbyist with a PS5 controller can see into 7,000 homes, what could a dedicated state actor do?

A Game of Whack-a-Mole
DJI’s response was pretty much what we’ve come to expect from a corporate response: initial denial, followed by a quiet scramble. The company initially claimed the flaw was patched before it actually was, only fully securing the servers after journalists provided proof of ongoing access. The company claims the issue is now “resolved” via a series of automatic updates deployed in early February 2026.

So, where do we go from here?

Companies like Unitree, Tesla, and 1X are already retailing robots that can perform tasks inside our homes. These robots are human-sized assistants with articulated limbs and advanced spatial awareness. A humanoid robot leaking a 3D video feed of your entire life is a dystopian catastrophe, and the potential threats are mind-bending.

The rapid proliferation of these “roaming eyes” has outpaced the slow-moving gears of global privacy legislation, leaving a Wild West where security is often an afterthought to speed-to-market. Currently, most smart home devices fall into a regulatory “grey zone” — they aren’t held to the same stringent safety standards as medical devices or automobiles, creating a “whack-a-mole” landscape where a patch for one vulnerability often reveals two more in the underlying architecture.

We are trading our most intimate data for the convenience of clean floors. If a man with a video game controller can see into 7,000 homes by accident, imagine what someone could do on purpose.