DJI robot vacuum hacked: 7,000 strangers' living rooms via a master key

Sun, 01 Mar 2026 00:00:00 +0100

A few days ago a press release turned up in my feed. I skim a lot of them every day – most I just scroll past. Not this one.

DJI. Robot vacuum. 7,000 strangers’ living rooms. A master key.

I read the article twice. And then I knew immediately: a follow-up video was needed.

The pattern that keeps repeating

If you’ve read my robot vacuum article, you might be nodding right now. Back then it was Ecovacs. Hacked robots remotely controlled in real time, chasing pets and shouting slurs through their speakers. I tried to explain back then why that wasn’t an absurd one-off incident, but a structural problem with this entire product category.

And now it’s happened again. Different manufacturer. Same category. Same fundamental vulnerability in principle.

This bothers me – not because I want to vilify robot vacuums, but because I believe most people who buy one simply don’t know what’s actually happening with their data. With the floor plan of their home. With camera footage, if the model has one. With the question of who, besides themselves, could theoretically access all of that.

What happened this time

It started innocuously. A French developer, a brand-new DJI robot vacuum, a free evening. The idea: control the robot around the apartment with a PS5 controller. Mario Kart in real life, but with dust bunnies.

To connect the controller, he needed the key from the app – nothing illegal, it was his own device. But when he used that key with the DJI server, the server didn’t just download his own data – it downloaded data from thousands of others. Over 7,000 robots across 24 countries. Battery levels, home floor plans, live camera feeds from strangers’ living rooms. The key wasn’t a normal key. It was a master key for the entire system.

DJI patched the vulnerability after it was reported. That’s good. But it doesn’t change the underlying picture.

Why I keep talking about this

After making this video I naturally asked myself whether I’m starting to get repetitive. Robot vacuums again. Privacy again. Same topic again.

But then I look at the comments under the old video. And I see how many people write that they simply hadn’t known how the technology behind it works. Not because they weren’t interested. But because hardly anyone explains it without immediately descending into panic or buzzwords.

That’s exactly what I want to do differently. No moralising, no fearmongering. Just: here are the facts. Here’s what they mean. And here are three concrete things you can do – if you want to. What you do with a camera-equipped robot vacuum in your home is your decision. I just want that decision to be an informed one.

To load the video, please click the image. Please note that by doing so, data will be transmitted to YouTube.

If you already have a view on this – or you have a robot vacuum at home and feel a quiet unease stirring – write it in the comments. I genuinely appreciate every perspective. And yes, every comment helps the video reach more people who are asking themselves exactly these questions for the first time.

Sources:

Robot Vacuums in the Smart Home - The Underestimated Data Hog

Thu, 15 May 2025 00:00:00 +0000

Introduction

Imagine your robot vacuum knows more about you than your closest friends — even though it’s only supposed to clean the floor. It drives through your home, scans your rooms, listens to your conversations, and you think it’s really just vacuuming? Sounds like a horror movie, but that’s exactly reality.

To load the video, please click the image. Please note that by doing so, data will be transmitted to YouTube.

The Ecovacs Incident of 2024

In October 2024, hacked Ecovacs robot vacuums in the US turned into full-blown stalkers ¹. They chased pets and hurled racist insults at their owners, terrorizing entire households ². But how did it get to this point? The attackers exploited a glaring security vulnerability in the robots’ software. The security PIN that was supposed to prevent unauthorized access was only verified in the app, not on the device itself — a fatal flaw that hackers knew how to exploit ³.

What makes this case particularly alarming: common security measures like strong passwords or two-factor authentication would not have helped here. The manufacturer had made such a fundamental programming error that even best-practice security measures were rendered useless.

The Underestimated Problem of Profiling

But even if your robot vacuum isn’t hacked, there is another massive problem: profiling. Many people might think, what could a robot vacuum really know about me? The answer is: frighteningly much.

To understand how powerful data analysis can be, here is a real-world example from the US: In 2012, a teenager suddenly started receiving ads for baby products from the retail chain Target. Her outraged father complained to Target about the alleged harassment of his daughter — only to find out a few days later that his daughter was actually pregnant. The algorithm had detected subtle changes in purchasing behavior and drawn the right conclusions before the family even knew ⁴.

What Does This Mean for Robot Vacuums?

Your robot vacuum links movement patterns, camera images, and sounds. It knows:

When you sleep
When you come home
Whether your routines change
Which rooms are used and how often
What conversations take place in your home

Why This Matters

“Why would anyone spy on me? I’m not important at all.” This thought is understandable, but it misses the core of the problem. It’s not about targeted surveillance of individuals — it’s about mass data collection:

Companies don’t specifically target your data
They simply collect everything, because storage is cheap
What seems harmless today can become highly sensitive tomorrow through AI analysis
The value lies not in any single household, but in the sheer volume of data

This data can feed algorithms that make decisions about:

Health insurance eligibility
Credit scoring
Personalized advertising

Concrete Recommendations

What can you actually do to protect yourself?

Basic security measures:
- Use strong passwords
- Install updates regularly
- Put devices on a guest network
Consider before buying:
- Think twice before getting devices with cameras or microphones
- Be especially critical of cloud-based data processing
Alternative solutions:
- The Valetudo project offers open-source firmware for some robot vacuum models
- This lets you keep control over your own data

Conclusion

Even large, seemingly trustworthy brands are not immune to data breaches — as the Volkswagen incident of 2024 illustrates, where data from over 400,000 electric vehicles ended up unprotected on the internet ⁵.

Making a genuinely reliable purchase recommendation for a “secure” robot vacuum is nearly impossible. The most pragmatic approach seems to be avoiding models with cameras and microphones and accepting the reduced feature set. An alternative for tech-savvy users is the Valetudo project ⁶, which provides an open-source alternative to the manufacturer’s firmware. Because in the end, protecting your privacy matters more than the supposed convenience of extra features.

Hacker on Smart Home? Sure — But Secure!

DJI robot vacuum hacked: 7,000 strangers' living rooms via a master key

The pattern that keeps repeating

What happened this time

Why I keep talking about this

Robot Vacuums in the Smart Home - The Underestimated Data Hog

Introduction

The Ecovacs Incident of 2024

The Underestimated Problem of Profiling

What Does This Mean for Robot Vacuums?

Why This Matters

Concrete Recommendations

Conclusion