This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
A software engineer discovered a security vulnerability in DJI's cloud infrastructure while reverse-engineering his DJI Romo vacuum. The flaw allowed unauthorized access to live camera feeds, microphone audio, and floor plans for approximately 7,000 devices globally. DJI patched the vulnerability in early February 2026.
A software engineer reportedly used an AI coding assistant while attempting to reverse-engineer his DJI robot vacuum so he could control it with a video game controller. In the course of that work, he reportedly said he discovered that credentials used to communicate with DJI's cloud servers could also grant access to data associated with nearly 7,000 other vacuums across 24 countries, including live camera feeds, microphone audio, maps, and status information.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Vulnerabilities that can be exploited in AI systems, software development toolchains, and hardware, resulting in unauthorized access, data and privacy breaches, or system manipulation causing unsafe outputs or behavior.
Also classified as
The security flaw exposed highly sensitive, non-public personal data including live camera feeds, microphone audio, and home floor plans of thousands of users.
The incident involved a critical backend security vulnerability in the DJI Romo's cloud infrastructure that exposed live camera feeds and microphone audio of nearly 7,000 devices, representing a major AI system security flaw.
Human
Due to a decision or action made by humans
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The security vulnerability was caused by an unintentional human programming error in DJI's cloud infrastructure, which was discovered post-deployment while the robot vacuums were active in users' homes.
A security vulnerability in DJI's cloud infrastructure exposed live feeds and floor plans of approximately 7000 robot vacuums globally. Discovered by a researcher using an AI coding assistant, the bug was patched by DJI without evidence of malicious exploitation. The incident highlights minor privacy risks associated with IoT devices rather than a significant national security threat.
The report describes the DJI Romo as 'an autonomous home vacuum' that is 'designed to spend most of its time cleaning and mopping autonomously.' It uses sensors to navigate and distinguish between rooms without requiring constant human planning.
Risk Level 4: Minimal or No Risk. The DJI Romo is described as 'an autonomous home vacuum' used for household cleaning, which represents a consumer application posing minimal inherent risk to safety or fundamental rights under normal operation.
The primary function of the DJI Romo is acting as a smart home device (autonomous vacuum) that collects environmental data to navigate and clean residential spaces.
The report provides clear details about the nature of the security vulnerability, the number of affected devices (nearly 7,000), the types of data exposed (camera, audio, maps), and the timeline of the patch (February 8 and 10, 2026). There is no conflicting information regarding whether the flaw was exploited.
None
Technology
Broken Backend Authentication
Servers granted access to 7,000 robots using a single credential token.
AI-Assisted Code Exploitation
AI coding assistants made reverse-engineering backend protocols much easier.
Data Inputs
Exposed Spatial Mapping Data
Sensitive 2D floor plans were accessible to unauthorized users.
Unsecured Camera and Audio Feeds
Live video and microphone feeds were transmitted without proper authorization.
Human Factors
Developer Credential Oversight
Backend developers failed to properly restrict token validation to single users.
Process and Methods
Flawed API Security Validation
Lack of rigorous penetration testing allowed backend access bugs to persist.
Management
Inadequate IoT Risk Assessment
Management failed to prioritize security risks of cloud-connected cameras.
Regulatory Environment
Weak IoT Privacy Regulations
Absence of strict legal standards for smart home camera data security.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
