One Hobbyist, a Game Controller, and 7,000 Robot Vacuums With Their Cameras Exposed

In February 2026, a hobbyist set out to do something playful: control his DJI Romo robot vacuum with a game controller. What he found instead was a security flaw with serious implications. A backend authorization bug meant he could reach beyond his own device, and reporting since has put the potential exposure at around 7,000 vacuums, with their cameras and microphones at risk of remote activation.

The story resurfaced this week in fresh reporting on October 13, and it deserves attention not because robot vacuums are exotic, but because they are ordinary. Millions of connected appliances now sit in homes, and the Romo flaw is a case study in how a single permissions mistake can turn a household gadget into a privacy problem at scale.

How one vacuum became 7,000

The discoverer, tinkerer Sammy Azdoufal, was using AI-assisted tooling to build a custom way to drive his vacuum. During the process he found that the authorization checks on DJI's backend did not properly isolate one user's device from another's. The flaw allowed access beyond his own unit, exposing data tied to thousands of vacuums, including mapping and sensor-related data.

This is the detail that elevates the story from a curiosity to a genuine privacy incident. Modern robot vacuums do not just bump around rooms. They use cameras and other sensors to navigate, identify obstacles, and build detailed maps of a home's layout. If those systems are compromised, an attacker could potentially learn the floor plan of a house, infer daily routines from cleaning schedules, and in the worst case activate cameras and microphones remotely.

A device can be smart and still be fragile. The Romo flaw was not in the vacuum. It was in the backend that forgot whose vacuum was whose.

The disclosure and the fix

To DJI's credit, the response timeline looks responsible. Outlets reporting the story say the company was alerted, issued updates to address the flaw, and indicated that additional security improvements were coming. That is how vulnerability disclosure is supposed to work: a researcher finds it, the vendor fixes it, users get patched.

The uncomfortable part is what users cannot verify. Without transparency from the company about its internal logs, there is no easy way for an owner to know whether their device's data was accessed before the patch landed, or what was exposed. The fix closes the door going forward. It does not answer what walked through it before.

Why vacuums are the canary

Robot vacuums occupy a strange position in the smart home. They are among the most sensor-rich devices people own, combining cameras, microphones, lidar or visual mapping, and constant network connectivity, yet they are sold and treated as appliances. Few buyers evaluate a vacuum's privacy policy the way they might a security camera, even though the vacuum arguably collects more intimate data.

Cybersecurity experts quoted in this week's reporting warn that vacuums are not the only target. Smart refrigerators, connected speakers, surveillance cameras, and other internet-enabled appliances can all become attack surfaces if they lack adequate security. The common thread is not the device category but the backend: authorization, access controls, and auditing matter as much as any feature on the box.

What owners should actually do

The practical advice has not changed, but it bears repeating because so few people follow it. Use strong, unique passwords for every smart device and its app. Keep firmware updated, since the Romo fix only helps if it is installed. Disable remote-access features you do not use. And before buying a connected appliance, check the manufacturer's software-update policy and approach to data protection, not just the suction power.

There is also a network-level defense worth considering. In some countries, like France, ISP routers generally restrict direct access to home devices from outside the local network, which limits what a remote attacker can reach. But stolen passwords and compromised cloud accounts bypass those barriers entirely, which is why credential hygiene matters more than any single device setting.

The broader lesson of the Romo story is that the smart home's security is only as strong as its weakest backend. Consumers can buy the most locked-down device on the shelf and still be exposed by a permissions bug on a server they will never see. Until manufacturers treat authorization bugs with the same urgency as hardware defects, the next hobbyist with a game controller is a matter of when, not if.

The accountability gap

There is a final, structural point worth making. When a physical product has a defect, recalls and liability frameworks kick in. When a cloud backend has an authorization flaw that exposes thousands of homes, the accountability picture is murkier. The vendor patches, the news cycle moves on, and affected users are left to trust that the fix was complete and timely.

Regulators are beginning to close this gap, with connected-device security rules advancing in several markets. But rules move slowly and backends change quickly. For now, the most reliable protection remains the oldest one: assume any connected device can be compromised, and choose accordingly.