A DJI Bug Exposed 7,000 Robot Vacuums. The Cloud Is the Problem.
Server-side authorization failures in cloud-connected vacuums expose floor plans and device controls to unintended users.
On Feb. 10, 2026, DJI pushed two software updates to fix a backend permission failure that let a single user remotely command roughly 7,000 robot vacuums worldwide, according to the company. The breach did not require sophisticated hacking tools. A customer named Sammy Azdoufal used Claude Code to reverse-engineer his DJI Romo’s communications and discovered the manufacturer’s server recognized his account credentials but failed to restrict his access to his own device.
The incident exposes a structural vulnerability in how consumer robotics companies architect their cloud infrastructure. When manufacturers route local commands through centralized servers to enable remote smartphone control, they create a single point of failure. Authentication verifies identity. Authorization dictates what that identity can touch. The DJI flaw collapsed the latter into the former.
Cloud-dependent smart home devices routinely transmit telemetry far beyond basic operational status. iRobot’s privacy policy states its connected models may send room names, floor types, detected objects, the robot’s movements and Wi-Fi network details to the company. This continuous data stream builds detailed spatial profiles of private residences.
Floor maps generated by lidar or camera-equipped vacuums are architectural blueprints. They reveal room dimensions, furniture layouts and daily movement patterns. When stored on manufacturer servers rather than locally, these datasets become targets. A compromised database does not just leak passwords. It leaks the physical layout of thousands of homes.
Some manufacturers are attempting to decouple navigation from external networks. Matic’s privacy policy says its robots process mapping data on the device itself, streaming floor plans to the companion app exclusively over local home Wi-Fi. Remote connectivity is disabled by default. According to the policy, transmitting data through an encrypted cloud connection requires explicit user consent, and sharing audio or video with support staff is restricted to authorized personnel.
Local-first processing eliminates the specific authorization gap that compromised the DJI fleet. If a device never contacts a central server during normal operation, there is no backend permission matrix to misconfigure.
But hardware architecture alone does not guarantee security. Camera-free models still generate spatial data and transmit account information. Disabling remote viewing features reduces the attack surface, though it does not prevent vulnerabilities in the local firmware itself.
For consumers operating cloud-connected vacuums, standard account hygiene remains necessary but insufficient against server-side logic errors. Strong passwords and two-factor authentication protect the front door. They do nothing when the building manager hands out master keys by accident.
