A software engineer's weekend project to control his robot vacuum with a gaming controller turned into one of the most striking smart-home security incidents in recent memory, after he discovered that his homemade app had inadvertently given him access to nearly 7,000 DJI Romo vacuums in homes across the globe.
Sammy Azdoufal, a 32-year-old French programmer based in Barcelona who serves as head of AI strategy at a holiday rental company, purchased a DJI Romo late last year. The Romo is DJI's flagship robot vacuum, priced at up to around €1,690 for its top-tier models and marketed for its advanced sensing capabilities.
Azdoufal's goal was simple: he wanted to link the vacuum to his PS5 controller, partly for the fun of it, and partly because he wanted to customize its behavior — including, he told AFP, making it cry when the battery ran low.
To make that work, he used Claude Code, an AI-powered coding assistant, to reverse-engineer the communication protocol between the Romo and DJI's cloud servers. The app needed to extract a security token from DJI's backend to authenticate Azdoufal as the owner of his specific device.
But when the server responded, it didn't just hand back credentials for his vacuum. It returned data from thousands of others.
An Ocean of Devices
Every three seconds, Azdoufal's app was receiving serial numbers from Romo units pinging DJI's servers across the United States, Europe, China, and more than 20 other countries — roughly 7,000 devices in all. The backend permission validation flaw in DJI's MQTT-based device-server communication meant that a single authenticated client could subscribe to data channels far broader than intended.
The scope of what was exposed was significant: live video feeds from onboard cameras, microphone audio, real-time cleaning status, battery levels, and detailed 2D floor plans generated from the robots' mapping data. IP addresses associated with each device also revealed approximate physical locations.
Azdoufal has been emphatic that none of this amounted to hacking in any traditional sense. He did not bypass encryption, brute-force any credentials, or exploit any system beyond requesting his own device's token. The vulnerability was entirely on DJI's end — the server simply failed to restrict which devices a given token could access.
Responsible Disclosure
Rather than exploit the access, Azdoufal reached out to DJI. When the company did not respond promptly, he contacted The Verge.
To verify his claims, a Verge reporter provided Azdoufal with the 14-digit serial number of a DJI Romo the publication had recently reviewed. Within minutes, Azdoufal was able to confirm the vacuum was actively in use, report its battery level at 80%, and generate a floor plan of the reporter's home.
DJI subsequently told The Verge the issue was "resolved" and that remediation had been underway before public disclosure. The company told Popular Science it had identified the vulnerability through an internal review in late January and deployed patches on February 8 and February 10 that were applied automatically to connected devices.
However, roughly 30 minutes after DJI issued its statement to The Verge, Azdoufal said he could still remotely control thousands of vacuums. He has also flagged additional unresolved issues, including the ability to stream a Romo's video feed without the required security PIN, as well as another vulnerability he considers too severe to disclose publicly.
A deeper structural concern also remains. Azdoufal has pointed out that the core problem is not about the encryption used during transit — it's that device data is stored in plain text on DJI's servers, making it readable to anyone who gains access.
Broader Implications for Smart-Home Security
The incident arrives at a moment of growing scrutiny over the surveillance potential of internet-connected home devices. DJI's products are already subject to restrictions in the United States due to concerns about the Shenzhen-based company's ties to the Chinese government, and new DJI devices are currently banned from sale in the country.
For modern robot vacuums to function, they must continuously collect visual data from the homes they operate in. They need to distinguish a kitchen from a bedroom, map obstacles, and store navigational information — much of which is transmitted to and stored on remote servers rather than remaining on the device itself.
Cybersecurity experts have long warned that this model creates attractive targets. The Thales 2026 Data Threat Report found that 70% of organizations now identify AI as their top data security concern, and only 34% say they know where all their sensitive data resides.
The DJI Romo case illustrates these risks in particularly vivid terms. As the Fortune columnist Eric Hanselman of S&P Global's 451 Research noted in the wake of the story, the proliferation of AI-powered coding tools is lowering the barrier for this kind of security research — which means it's also lowering it for exploitation.
Meanwhile, the question Azdoufal posed to The Verge lingers: if a hobbyist with an AI coding tool could peer into thousands of homes through their vacuums, what safeguards existed internally to prevent DJI employees from doing the same?
Or, as he put it more bluntly: "It's so weird to have a microphone on a freaking vacuum."
DJI has stated it plans to continue implementing additional security enhancements but has not specified what those measures will involve.
