The DJI Romo robovac had security so poor, this man remotely accessed thousands of them

[ad_1] Sammy Azdoufal claims he wasn’t attempting to hack each robotic vacuum on the planet. He simply wished to distant management his brand-new DJI Romo vacuum with a PS5 gamepad, he tells The Verge, as a result of it sounded enjoyable.

However when his homegrown distant management app began speaking to DJI’s servers, it wasn’t only one vacuum cleaner that replied. Roughly 7,000 of them, all all over the world, started treating Azdoufal like their boss.

He might remotely management them, and look and hear by way of their stay digicam feeds, he tells me, saying he examined that out with a good friend. He might watch them map out every room of a home, producing a whole 2D ground plan. He might use any robotic’s IP deal with to seek out its tough location.

“I discovered my system was only one in an ocean of units,” he says.

<img alt="A map like the one I saw, with robots and packets trickling in." data-chromatic="ignore" loading="lazy" decoding="async" data-nimg="fill" class="x271pn0" style="position:absolute;height:100%;width:100%;left:0;top:0;right:0;bottom:0;color:transparent;background-size:cover;background-position:50% 50%;background-repeat:no-repeat;background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' %3E%3Cfilter id='b' color-interpolation-filters='sRGB'%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3CfeColorMatrix values='1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 100 -1' result='s'/%3E%3CfeFlood x='0' y='0' width='100%25' height='100%25'/%3E%3CfeComposite operator='out' in='s'/%3E%3CfeComposite in2='SourceGraphic'/%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3C/filter%3E%3Cimage width='100%25' height='100%25' x='0' y='0' preserveAspectRatio='none' style='filter: url(%23b);' href='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mN8+R8AAtcB6oaHtZcAAAAASUVORK5CYII='/%3E%3C/svg%3E")" sizes="(max-width: 639px) 100vw, (max-width: 1023px) 50vw, 700px" srcset="https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-api-communications-reverse-engineered-v0-e3sgj2e3ewhg1-redacted.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=256 256w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-api-communications-reverse-engineered-v0-e3sgj2e3ewhg1-redacted.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=376 376w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-api-communications-reverse-engineered-v0-e3sgj2e3ewhg1-redacted.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=384 384w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-api-communications-reverse-engineered-v0-e3sgj2e3ewhg1-redacted.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=415 415w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-api-communications-reverse-engineered-v0-e3sgj2e3ewhg1-redacted.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=480 480w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-api-communications-reverse-engineered-v0-e3sgj2e3ewhg1-redacted.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=540 540w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-api-communications-reverse-engineered-v0-e3sgj2e3ewhg1-redacted.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=640 640w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-api-communications-reverse-engineered-v0-e3sgj2e3ewhg1-redacted.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=750 750w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-api-communications-reverse-engineered-v0-e3sgj2e3ewhg1-redacted.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=828 828w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-api-communications-reverse-engineered-v0-e3sgj2e3ewhg1-redacted.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1080 1080w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-api-communications-reverse-engineered-v0-e3sgj2e3ewhg1-redacted.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1200 1200w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-api-communications-reverse-engineered-v0-e3sgj2e3ewhg1-redacted.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1440 1440w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-api-communications-reverse-engineered-v0-e3sgj2e3ewhg1-redacted.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1920 1920w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-api-communications-reverse-engineered-v0-e3sgj2e3ewhg1-redacted.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=2048 2048w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-api-communications-reverse-engineered-v0-e3sgj2e3ewhg1-redacted.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=2400 2400w" src="https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-api-communications-reverse-engineered-v0-e3sgj2e3ewhg1-redacted.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=2400"/> A map just like the one I noticed, with robots and packets trickling in. Picture: Gonzague Dambricourt

On Tuesday, when he confirmed me his degree of entry in a stay demo, I couldn’t imagine my eyes. Ten, a whole lot, hundreds of robots reporting for obligation, every phoning dwelling MQTT information packets each three seconds to say: their serial quantity, which rooms they’re cleansing, what they’ve seen, how far they’ve traveled, once they’re returning to the charger, and the obstacles they encountered alongside the best way.

I watched every of those robots slowly pop into existence on a map of the world. 9 minutes after we started, Azdoufal’s laptop computer had already cataloged 6,700 DJI units throughout 24 completely different international locations and picked up over 100,000 of their messages. For those who add the corporate’s DJI Energy transportable energy stations, which additionally cellphone dwelling to those similar servers, Azdoufal had entry to over 10,000 units.

<img alt="Azdoufal says he could remote-control robovacs and view live video over the internet." data-chromatic="ignore" loading="lazy" decoding="async" data-nimg="fill" class="x271pn0" style="position:absolute;height:100%;width:100%;left:0;top:0;right:0;bottom:0;color:transparent;background-size:cover;background-position:50% 50%;background-repeat:no-repeat;background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' %3E%3Cfilter id='b' color-interpolation-filters='sRGB'%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3CfeColorMatrix values='1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 100 -1' result='s'/%3E%3CfeFlood x='0' y='0' width='100%25' height='100%25'/%3E%3CfeComposite operator='out' in='s'/%3E%3CfeComposite in2='SourceGraphic'/%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3C/filter%3E%3Cimage width='100%25' height='100%25' x='0' y='0' preserveAspectRatio='none' style='filter: url(%23b);' href='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mN8+R8AAtcB6oaHtZcAAAAASUVORK5CYII='/%3E%3C/svg%3E")" sizes="(max-width: 639px) 100vw, (max-width: 1023px) 50vw, 700px" srcset="https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/videoframe_5741.png?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=256 256w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/videoframe_5741.png?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=376 376w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/videoframe_5741.png?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=384 384w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/videoframe_5741.png?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=415 415w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/videoframe_5741.png?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=480 480w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/videoframe_5741.png?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=540 540w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/videoframe_5741.png?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=640 640w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/videoframe_5741.png?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=750 750w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/videoframe_5741.png?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=828 828w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/videoframe_5741.png?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1080 1080w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/videoframe_5741.png?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1200 1200w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/videoframe_5741.png?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1440 1440w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/videoframe_5741.png?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1920 1920w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/videoframe_5741.png?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=2048 2048w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/videoframe_5741.png?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=2400 2400w" src="https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/videoframe_5741.png?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=2400"/> Azdoufal says he might remote-control robovacs and think about stay video over the web.

After I say I couldn’t imagine my eyes at first, I imply that actually. Azdoufal leads AI technique at a trip rental dwelling firm; when he instructed me he reverse engineered DJI’s protocols utilizing Claude Code, I had to wonder if AI was hallucinating these robots. So I requested my colleague Thomas Ricker, who simply completed reviewing the DJI Romo, to go us its serial quantity.

With nothing greater than that 14-digit quantity, Azdoufal couldn't solely pull up our robotic, he might appropriately see it was cleansing the lounge and had 80 % battery life remaining. Inside minutes, I watched the robotic generate and transmit an correct ground plan of my colleague’s home, with the right form and dimension of every room, simply by typing some digits right into a laptop computer positioned in a distinct nation.

<img alt="" data-chromatic="ignore" loading="lazy" decoding="async" data-nimg="fill" class="x271pn0" style="position:absolute;height:100%;width:100%;left:0;top:0;right:0;bottom:0;color:transparent;background-size:cover;background-position:50% 50%;background-repeat:no-repeat;background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' %3E%3Cfilter id='b' color-interpolation-filters='sRGB'%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3CfeColorMatrix values='1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 100 -1' result='s'/%3E%3CfeFlood x='0' y='0' width='100%25' height='100%25'/%3E%3CfeComposite operator='out' in='s'/%3E%3CfeComposite in2='SourceGraphic'/%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3C/filter%3E%3Cimage width='100%25' height='100%25' x='0' y='0' preserveAspectRatio='none' style='filter: url(%23b);' href='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mN8+R8AAtcB6oaHtZcAAAAASUVORK5CYII='/%3E%3C/svg%3E")" sizes="(max-width: 639px) 100vw, (max-width: 1023px) 50vw, 700px" srcset="https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/romo-2d-floor.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=256 256w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/romo-2d-floor.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=376 376w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/romo-2d-floor.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=384 384w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/romo-2d-floor.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=415 415w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/romo-2d-floor.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=480 480w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/romo-2d-floor.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=540 540w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/romo-2d-floor.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=640 640w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/romo-2d-floor.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=750 750w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/romo-2d-floor.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=828 828w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/romo-2d-floor.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1080 1080w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/romo-2d-floor.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1200 1200w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/romo-2d-floor.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1440 1440w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/romo-2d-floor.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1920 1920w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/romo-2d-floor.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=2048 2048w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/romo-2d-floor.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=2400 2400w" src="https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/romo-2d-floor.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=2400"/> Listed below are two maps of Thomas’ residing area. Above is what we pulled from DJI’s servers with out authentication; under is what the proprietor sees on their very own cellphone. Screenshots by The Verge

<img alt="" data-chromatic="ignore" loading="lazy" decoding="async" data-nimg="fill" class="x271pn0" style="position:absolute;height:100%;width:100%;left:0;top:0;right:0;bottom:0;color:transparent;background-size:cover;background-position:50% 50%;background-repeat:no-repeat;background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' %3E%3Cfilter id='b' color-interpolation-filters='sRGB'%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3CfeColorMatrix values='1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 100 -1' result='s'/%3E%3CfeFlood x='0' y='0' width='100%25' height='100%25'/%3E%3CfeComposite operator='out' in='s'/%3E%3CfeComposite in2='SourceGraphic'/%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3C/filter%3E%3Cimage width='100%25' height='100%25' x='0' y='0' preserveAspectRatio='none' style='filter: url(%23b);' href='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mN8+R8AAtcB6oaHtZcAAAAASUVORK5CYII='/%3E%3C/svg%3E")" sizes="(max-width: 639px) 100vw, (max-width: 1023px) 50vw, 700px" srcset="https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/HAlxmLzXgAA57kq.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=256 256w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/HAlxmLzXgAA57kq.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=376 376w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/HAlxmLzXgAA57kq.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=384 384w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/HAlxmLzXgAA57kq.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=415 415w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/HAlxmLzXgAA57kq.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=480 480w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/HAlxmLzXgAA57kq.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=540 540w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/HAlxmLzXgAA57kq.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=640 640w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/HAlxmLzXgAA57kq.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=750 750w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/HAlxmLzXgAA57kq.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=828 828w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/HAlxmLzXgAA57kq.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1080 1080w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/HAlxmLzXgAA57kq.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1200 1200w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/HAlxmLzXgAA57kq.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1440 1440w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/HAlxmLzXgAA57kq.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1920 1920w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/HAlxmLzXgAA57kq.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=2048 2048w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/HAlxmLzXgAA57kq.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=2400 2400w" src="https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/HAlxmLzXgAA57kq.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=2400"/> Right here’s a fuller ground plan from Gonzague Dambricourt, who tried out a read-only model of Azdoufal’s device. Picture: Gonzague Dambricourt (X)

Individually, Azdoufal pulled up his personal DJI Romo’s stay video feed, fully bypassing its safety PIN, then walked into his front room and waved to the digicam whereas I watched. He additionally says he shared a restricted read-only model of his app with Gonzague Dambricourt, CTO at an IT consulting agency in France; Dambricourt tells me the app let him remotely watch his personal DJI Romo’s digicam feed earlier than he even paired it.

Azdoufal was in a position to allow all of this with out hacking into DJI’s servers, he claims. “I didn’t infringe any guidelines, I didn’t bypass, I didn’t crack, brute power, no matter.” He says he merely extracted his personal DJI Romo’s personal token — the important thing that tells DJI’s servers that you need to have entry to your individual information — and people servers gave him the information of hundreds of different individuals as effectively. He reveals me that he can entry DJI’s pre-production server, in addition to the stay servers for the US, China, and the EU.

<img alt="DJI has MQTT servers associated with the US, EU, and China. I’m not sure what VG stands for." data-chromatic="ignore" loading="lazy" decoding="async" data-nimg="fill" class="x271pn0" style="position:absolute;height:100%;width:100%;left:0;top:0;right:0;bottom:0;color:transparent;background-size:cover;background-position:50% 50%;background-repeat:no-repeat;background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' %3E%3Cfilter id='b' color-interpolation-filters='sRGB'%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3CfeColorMatrix values='1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 100 -1' result='s'/%3E%3CfeFlood x='0' y='0' width='100%25' height='100%25'/%3E%3CfeComposite operator='out' in='s'/%3E%3CfeComposite in2='SourceGraphic'/%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3C/filter%3E%3Cimage width='100%25' height='100%25' x='0' y='0' preserveAspectRatio='none' style='filter: url(%23b);' href='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mN8+R8AAtcB6oaHtZcAAAAASUVORK5CYII='/%3E%3C/svg%3E")" sizes="(max-width: 639px) 100vw, (max-width: 1023px) 50vw, 700px" srcset="https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-1.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=256 256w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-1.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=376 376w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-1.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=384 384w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-1.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=415 415w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-1.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=480 480w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-1.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=540 540w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-1.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=640 640w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-1.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=750 750w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-1.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=828 828w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-1.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1080 1080w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-1.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1200 1200w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-1.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1440 1440w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-1.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1920 1920w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-1.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=2048 2048w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-1.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=2400 2400w" src="https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-1.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=2400"/> DJI has MQTT servers related to the US, EU, and China. I’m unsure what VG stands for. Screenshot by Sean Hollister / The Verge

Right here’s the excellent news: On Tuesday, Azdoufal was not in a position to take our DJI Romo on a joyride by way of my colleague’s home, see by way of its digicam, or hear by way of its microphone. DJI had already restricted that type of entry after each Azdoufal and I instructed the corporate in regards to the vulnerabilities.

And by Wednesday morning, Azdoufal’s scanner not had entry to any robots, not even his personal. It seems that DJI has plugged the gaping gap.

However this incident raises severe questions on DJI’s safety and information practices. It would little doubt be used to assist retroactively justify fears that led to the Chinese language dronemaker getting largely compelled out of the US. If Azdoufal might discover these robots with out even searching for them, will it shield them towards individuals with intent to do hurt? If Claude Code can spit out an app that allows you to see into somebody’s home, what retains a DJI worker from doing so? And will a robotic vacuum cleaner have a microphone? “It’s so bizarre to have a microphone on a freaking vacuum,” says Azdoufal.

It doesn’t assist that when Azdoufal and The Verge contacted DJI in regards to the problem, the corporate claimed it had mounted the vulnerability when it was truly solely partially resolved.

“DJI can verify the problem was resolved final week and remediation was already underway previous to public disclosure,” reads a part of the unique assertion offered by DJI spokesperson Daisy Kong. We acquired that assertion on Tuesday morning at 12:28PM ET — about half an hour earlier than Azdoufal confirmed me hundreds of robots, together with our assessment unit, reporting for obligation.

<img alt="Not just robovacs — DJI’s power stations also use this system." data-chromatic="ignore" loading="lazy" decoding="async" data-nimg="fill" class="x271pn0" style="position:absolute;height:100%;width:100%;left:0;top:0;right:0;bottom:0;color:transparent;background-size:cover;background-position:50% 50%;background-repeat:no-repeat;background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' %3E%3Cfilter id='b' color-interpolation-filters='sRGB'%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3CfeColorMatrix values='1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 100 -1' result='s'/%3E%3CfeFlood x='0' y='0' width='100%25' height='100%25'/%3E%3CfeComposite operator='out' in='s'/%3E%3CfeComposite in2='SourceGraphic'/%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3C/filter%3E%3Cimage width='100%25' height='100%25' x='0' y='0' preserveAspectRatio='none' style='filter: url(%23b);' href='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mN8+R8AAtcB6oaHtZcAAAAASUVORK5CYII='/%3E%3C/svg%3E")" sizes="(max-width: 639px) 100vw, (max-width: 1023px) 50vw, 700px" srcset="https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-6.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=256 256w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-6.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=376 376w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-6.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=384 384w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-6.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=415 415w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-6.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=480 480w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-6.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=540 540w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-6.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=640 640w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-6.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=750 750w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-6.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=828 828w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-6.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1080 1080w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-6.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1200 1200w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-6.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1440 1440w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-6.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1920 1920w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-6.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=2048 2048w, https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-6.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=2400 2400w" src="https://platform.theverge.com/wp-content/uploads/sites/2/2026/02/dji-romo-access-6.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=2400"/> Not simply robovacs — DJI’s energy stations additionally use this technique. Screenshot by Sean Hollister / The Verge

To be clear, it’s not shocking {that a} robotic vacuum cleaner with a smartphone app would cellphone dwelling to the cloud. For higher or for worse, customers at the moment anticipate these apps to work exterior of their very own properties. Until you’ve constructed a tunnel into your individual dwelling community, meaning relaying the information by way of cloud servers first.

However individuals who put a digicam into their dwelling anticipate that information to be protected, each in transit and as soon as it reaches the server. Safety professionals ought to know that — however as quickly as Azdoufal related to DJI’s MQTT servers, all the things was seen in cleartext. If DJI has merely reduce off one specific approach into these servers, that might not be sufficient to guard them if hackers discover one other approach in.

Sadly, DJI is way from the one good dwelling firm that’s let individuals down on safety. Hackers took over Ecovacs robotic vacuums to chase pets and yell racist slurs in 2024. In 2025, South Korean authorities businesses reported that Dreame’s X50 Extremely had a flaw that might let hackers view its digicam feed in actual time, and that one other Ecovacs and a Narwal robovac might let hackers view and steal pictures from the units. (Korea’s personal Samsung and LG vacuums acquired excessive marks, and a Roborock did fantastic.)

It’s not simply vacuums, in fact. I nonetheless received’t purchase a Wyze digicam, regardless of its new safety concepts, as a result of that firm tried to comb a distant entry vulnerability beneath the rug as an alternative of warning its prospects. I'd discover it exhausting to belief Anker’s Eufy after it lied to us about its safety, too. However Anker got here clear, and daylight is an effective disinfectant.

DJI shouldn't be being exceptionally clear about what occurred right here, but it surely did reply nearly all our questions. In a brand new assertion to The Verge through spokesperson Daisy Kong, the corporate now admits “a backend permission validation problem” that might have theoretically let hackers see stay video from its vacuums, and it admits that it didn’t totally patch that problem till after we confirmed that points have been nonetheless current.

Right here’s that complete assertion:

DJI recognized a vulnerability affecting DJI House by way of inner assessment in late January and initiated remediation instantly. The difficulty was addressed by way of two updates, with an preliminary patch deployed on February 8 and a follow-up replace accomplished on February 10. The repair was deployed routinely, and no person motion is required.

The vulnerability concerned a backend permission validation problem affecting MQTT-based communication between the system and the server. Whereas this problem created a theoretical potential for unauthorized entry to stay video of ROMO system, our investigation confirms that precise occurrences have been extraordinarily uncommon. Almost all recognized exercise was linked to unbiased safety researchers testing their very own units for reporting functions, with solely a handful of potential exceptions.

The primary patch addressed this vulnerability however had not been utilized universally throughout all service nodes. The second patch re-enabled and restarted the remaining service nodes. This has now been totally resolved, and there's no proof of broader affect. This was not a transmission encryption problem. ROMO device-to-server communication was not transmitted in cleartext and has all the time been encrypted utilizing TLS. Information related to ROMO units, reminiscent of these in Europe, is saved on U.S.-based AWS cloud infrastructure.

DJI maintains robust requirements for information privateness and safety and has established processes for figuring out and addressing potential vulnerabilities. The corporate has invested in industry-standard encryption and operates a longstanding bug bounty program. We've reviewed the findings and suggestions shared by the unbiased safety researchers who contacted us by way of that program as a part of our commonplace post-remediation course of. DJI will proceed to implement extra safety enhancements as a part of its ongoing efforts.

Azdoufal says that even now, DJI hasn’t mounted all of the vulnerabilities he’s discovered. Certainly one of them is the power to view your individual DJI Romo video stream without having its safety pin. One other one is so unhealthy I received’t describe it till DJI has extra time to repair it. DJI didn't instantly promise to take action.

And each Azdoufal and safety researcher Kevin Finisterre inform me it’s not sufficient for the Romo to ship encrypted information to a US server, if anybody inside that server can simply learn it afterward. “A server being primarily based within the US under no circumstances, form, or type prevents .cn DJI staff from entry,” Finisterre tells me. That appears evident, as Azdoufal lives in Barcelona and was in a position to see units in completely completely different areas.

“When you’re an authenticated consumer on the MQTT dealer, if there aren't any correct topic-level entry controls (ACLs), you'll be able to subscribe to wildcard subjects (e.g., #) and see all messages from all units in plaintext on the utility layer,” says Azdoufal. “TLS does nothing to forestall this — it solely protects the pipe, not what’s contained in the pipe from different licensed contributors.”

After I inform Azdoufal that some might choose him for not giving DJI a lot time to resolve the problems earlier than going public, he notes that he didn’t hack something, didn’t expose delicate information, and isn’t a safety skilled. He says he was merely livetweeting all the things that occurred whereas attempting to regulate his robotic with a PS5 gamepad.

“Sure, I don’t comply with the foundations, however individuals keep on with the bug bounty program for cash. I fucking don’t care, I simply need this mounted,” he says. “Following the foundations to the tip would in all probability make this breach occur for a approach longer time, I feel.”

He doesn’t imagine that DJI actually found these points by itself again in January, and he’s irritated the corporate solely ever responded to him robotically in DMs on X, as an alternative of answering his emails.

However he's completely happy about one factor: He can certainly management his Romo with a PlayStation or Xbox gamepad.

Comply with subjects and authors from this story to see extra like this in your personalised homepage feed and to obtain electronic mail updates. Sean Hollister Shut <img alt="Sean Hollister" data-chromatic="ignore" loading="lazy" decoding="async" data-nimg="fill" class="_1bw37385 x271pn0" style="position:absolute;height:100%;width:100%;left:0;top:0;right:0;bottom:0;color:transparent;background-size:cover;background-position:50% 50%;background-repeat:no-repeat;background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' %3E%3Cfilter id='b' color-interpolation-filters='sRGB'%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3CfeColorMatrix values='1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 100 -1' result='s'/%3E%3CfeFlood x='0' y='0' width='100%25' height='100%25'/%3E%3CfeComposite operator='out' in='s'/%3E%3CfeComposite in2='SourceGraphic'/%3E%3CfeGaussianBlur stdDeviation='20'/%3E%3C/filter%3E%3Cimage width='100%25' height='100%25' x='0' y='0' preserveAspectRatio='none' style='filter: url(%23b);' href='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mN8+R8AAtcB6oaHtZcAAAAASUVORK5CYII='/%3E%3C/svg%3E")" sizes="125px" srcset="https://platform.theverge.com/wp-content/uploads/sites/2/chorus/author_profile_images/196092/sean-nerf-profile-pic..0.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=16 16w, https://platform.theverge.com/wp-content/uploads/sites/2/chorus/author_profile_images/196092/sean-nerf-profile-pic..0.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=32 32w, https://platform.theverge.com/wp-content/uploads/sites/2/chorus/author_profile_images/196092/sean-nerf-profile-pic..0.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=48 48w, https://platform.theverge.com/wp-content/uploads/sites/2/chorus/author_profile_images/196092/sean-nerf-profile-pic..0.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=64 64w, https://platform.theverge.com/wp-content/uploads/sites/2/chorus/author_profile_images/196092/sean-nerf-profile-pic..0.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=96 96w, https://platform.theverge.com/wp-content/uploads/sites/2/chorus/author_profile_images/196092/sean-nerf-profile-pic..0.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=128 128w, https://platform.theverge.com/wp-content/uploads/sites/2/chorus/author_profile_images/196092/sean-nerf-profile-pic..0.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=256 256w, https://platform.theverge.com/wp-content/uploads/sites/2/chorus/author_profile_images/196092/sean-nerf-profile-pic..0.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=376 376w, https://platform.theverge.com/wp-content/uploads/sites/2/chorus/author_profile_images/196092/sean-nerf-profile-pic..0.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=384 384w, https://platform.theverge.com/wp-content/uploads/sites/2/chorus/author_profile_images/196092/sean-nerf-profile-pic..0.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=415 415w, https://platform.theverge.com/wp-content/uploads/sites/2/chorus/author_profile_images/196092/sean-nerf-profile-pic..0.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=480 480w, https://platform.theverge.com/wp-content/uploads/sites/2/chorus/author_profile_images/196092/sean-nerf-profile-pic..0.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=540 540w, https://platform.theverge.com/wp-content/uploads/sites/2/chorus/author_profile_images/196092/sean-nerf-profile-pic..0.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=640 640w, https://platform.theverge.com/wp-content/uploads/sites/2/chorus/author_profile_images/196092/sean-nerf-profile-pic..0.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=750 750w, https://platform.theverge.com/wp-content/uploads/sites/2/chorus/author_profile_images/196092/sean-nerf-profile-pic..0.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=828 828w, https://platform.theverge.com/wp-content/uploads/sites/2/chorus/author_profile_images/196092/sean-nerf-profile-pic..0.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1080 1080w, https://platform.theverge.com/wp-content/uploads/sites/2/chorus/author_profile_images/196092/sean-nerf-profile-pic..0.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1200 1200w, https://platform.theverge.com/wp-content/uploads/sites/2/chorus/author_profile_images/196092/sean-nerf-profile-pic..0.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1440 1440w, https://platform.theverge.com/wp-content/uploads/sites/2/chorus/author_profile_images/196092/sean-nerf-profile-pic..0.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=1920 1920w, https://platform.theverge.com/wp-content/uploads/sites/2/chorus/author_profile_images/196092/sean-nerf-profile-pic..0.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=2048 2048w, https://platform.theverge.com/wp-content/uploads/sites/2/chorus/author_profile_images/196092/sean-nerf-profile-pic..0.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=2400 2400w" src="https://platform.theverge.com/wp-content/uploads/sites/2/chorus/author_profile_images/196092/sean-nerf-profile-pic..0.jpg?quality=90&strip=all&crop=0%2C0%2C100%2C100&w=2400"/> Sean Hollister

Posts from this creator shall be added to your every day electronic mail digest and your homepage feed.

Comply with Comply with See All by Sean Hollister

Report Shut Report

Posts from this subject shall be added to your every day electronic mail digest and your homepage feed.

Comply with Comply with See All Report

Good House Shut Good House

Posts from this subject shall be added to your every day electronic mail digest and your homepage feed.

Comply with Comply with See All Good House

Tech Shut Tech

Posts from this subject shall be added to your every day electronic mail digest and your homepage feed.

Comply with Comply with See All Tech

[ad_2] Source link

The DJI Romo robovac had security so poor, this man remotely accessed thousands of them

Jason Kelce sends A.J. Brown warning to Eagles after interesting comments

Western alliance must reclaim industrial leadership and supply chain control – Marco Rubio

Related Posts

Bitcoin biopic starring Casey Affleck to use AI to generate locations and tweak performances

Sex toys maker Tenga says hacker stole customer information | TechCrunch

Google warns that the EU risks undermining its own competitiveness drive with the “tech sovereignty package” the bloc is set to present in the spring (Barbara Moens/Financial Times)

Spotify vs. YouTube Music: I've tested both services, and this is the one you should pick

You don’t need to watch ‘Wuthering Heights’ this Valentine’s Day — stream this sexy crime-thriller classic for free instead

iOS 26.3 introduces new tool to simplify your switch from iPhone to Android

Western alliance must reclaim industrial leadership and supply chain control – Marco Rubio

ANAMA, UNDP organize joint event on mine action and eco-resilience at COP29 (PHOTO)

Security camera subscriptions: Which plans offer the best value?

HOA Documents for Closing: What to Request, Review, and Deliver

Diddy's Reaction to Dawn Richard Lawsuit Days Before Arrest Seen In New Docuseries

Hello world!

Holiday Home – Julia Berolzheimer

Four Seasons Hotel NY reopens as city’s priciest stay

Everything You Need to Create a Paris Outfit: Fall Edition

Western alliance must reclaim industrial leadership and supply chain control – Marco Rubio