A Hobbyist's Vacuum Hack Exposed Live Camera Feeds From 7,000 Other People's Homes
What happened
A software engineer set out to do something modest: connect his DJI robot vacuum to a video game controller. He used an AI coding assistant to help reverse-engineer the device's communication protocol, working through the kind of hobbyist project that occasionally turns into something useful. What he found instead of a shortcut was a serious authorization failure in DJI's cloud infrastructure, one that had apparently been sitting there undetected across the product's entire user base.
The credentials his vacuum used to authenticate with DJI's cloud servers were not scoped to his account alone. They reportedly granted access to data associated with nearly 7,000 other vacuums operating across 24 countries, including live camera feeds, microphone audio, home floor maps, and real-time device status. None of those households had any reason to suspect this was possible, and nothing in the record suggests DJI had detected the problem on its own before this discovery.
The underlying flaw is a broken access-control boundary at the server level: the API accepted credentials it should have rejected for any request outside the issuing account. The engineer's owner-level token became a skeleton key for a large portion of DJI's customer base. That kind of failure does not require a sophisticated attacker. It required a curious person with an AI coding assistant, a consumer vacuum, and an afternoon.
Robot vacuums are not passive floor-cleaning devices. Modern models carry cameras for obstacle detection, microphones, and detailed spatial maps of interior spaces built up over weeks of normal use. When a manufacturer routes that data through a shared cloud backend, the security of that backend becomes the practical boundary around each customer's home. An authorization bug at that layer is not an abstract software defect; it is a hole in the wall of every affected household.
Nothing in the record indicates that DJI notified the nearly 7,000 affected households, and nothing suggests those users had any mechanism to learn that their feeds and floor plans had been accessible to anyone holding the right credentials. That silence defines the accountability gap here. Cloud authorization failures at this scale tend to resolve quietly, without the people most affected ever receiving confirmation of what was exposed or for how long. A provable record of what a system accessed, which credentials reached which data, and during which window, would at minimum establish the factual scope of a breach, even when disclosure arrives late.
Reported impact
- Affected parties
- Not publicly disclosed
- Harm type
- Not publicly disclosed
- Scale
- Not publicly disclosed
- Financial impact
- Not publicly disclosed
- Regulatory action
- Not publicly disclosed
Classification
Relevant governance controls
Governance control mapping is not available for this record.
- No controls mapped
Not publicly disclosed
Control mapping is analytical. It does not state that any control would have prevented the incident.
Sources and evidence
This record was researched and written by the Index. The event is also catalogued in the following database, which is listed for cross-reference.