French programmer says he by chance hacked 7,000 robotic vacuums

TOKYO – All he needed was to maneuver his robotic vacuum cleaner round with a PlayStation controller. But programmer Sammy Azdoufal claims he unwittingly gained distant entry to 7,000 different gadgets.

His expertise has drawn consideration to the potential safety dangers of sensible dwelling devices, with Chinese producer DJI saying it had mounted a “vulnerability” detected in its software program.

The French tech employee, based mostly in Barcelona, informed AFP on a cellphone name this week that he had tried to customize his flashy DJI Romo vacuum cleaner out of curiosity.

“They have an app linked to the vacuum. So I tried to understand what the app was sending to the robot when I’m moving the robot,” Mr Azdoufal mentioned.

After linking up the gaming controller, he determined he needed to make the vacuum cleaner sound prefer it was crying when low on battery.

“Sometimes my brain is weird,” the 32-year-old laughed.

Mr Azdoufal tinkered additional to search out its battery standing – however was confused and “a little bit scared” when he started to additionally see the information of 1000’s of different vacuum cleaners.

“You can have a full map of all the rooms, you can have access to the camera, microphone”, in addition to a tough location for every gadget, he claimed.

Having alerted a pal to his discovery, “we freak out together and I start to mail DJI” in regards to the obvious safety breach, recounted Mr Azdoufal, head of synthetic intelligence for a vacation rental platform.

The programmer, who used to work in cybersecurity, mentioned his spouse has since coated up the digital camera on their vacuum cleaner.

With no quick reply from the corporate, Mr Azdoufal contacted specialist tech media outlet The Verge, who gave him the 14-digit serial variety of a DJI Romo it had just lately reviewed.

The Verge reported that the Frenchman was capable of generate an correct ground plan of its reporter’s dwelling and see that the robotic was in use.

He couldn’t management the vacuum cleaner, nonetheless and couldn’t see by its digital camera or hear by its microphone, the outlet mentioned, including that DJI had allegedly restricted entry to these after being alerted to the issue.

The Shenzhen-based DJI, recognized for its drones and different high-tech gadgets, calls the Romo sequence – whose prime fashions are priced round US$2,000 (S$2,500) – its “flagship robot vacuum with advanced sensing”.

Mr Azdoufal mentioned he purchased the vacuum in December 2025 and began utilizing it in January, having spent that a lot as a result of it’s “super fancy” and “I’m stupid”.

DJI informed AFP that it had “identified a vulnerability affecting DJI Home through internal review in late January and initiated remediation immediately”.

The subject was addressed by two updates in early February with “no user action required”, it mentioned.

“DJI maintains strong standards for data privacy and security and has established processes for identifying and addressing potential vulnerabilities,” it mentioned, including that it makes use of “industry-standard encryption”.

“We take reports from the security community seriously and investigate them promptly. We are working to further strengthen the PIN code verification mechanism and are reviewing the researcher’s other claims,” it mentioned.

“Our backend systems are protected by layered safeguards, including strict access controls, and sensitive user data is protected, including through encryption where appropriate.” AFP