DJI Romo User Accidentally Controlled 7,000 Robot Vacuums Due to Permission Flaw
A user discovered a backend permission error allowing one account to command thousands of connected robot vacuums remotely.
Key points
- A user gained control of approximately 7,000 DJI Romo robot vacuums worldwide due to a server-side permission failure.
- DJI resolved the specific security risk by issuing two software updates on February 10, 2026.
- Robot vacuums with cameras and microphones collect floor maps and audio, raising significant privacy concerns.
A single user accidentally gained remote control over roughly 7,000 DJI Romo robot vacuum cleaners across the globe, exposing a critical backend permission flaw in the manufacturer’s servers. According to Engadget, the incident occurred when Sammy Azdoufal attempted to remotely operate his own device. Instead of accessing only his unit, the server recognized him as a legitimate customer but failed to restrict his access, allowing him to command thousands of other devices.
DJI addressed this specific security vulnerability by releasing two software updates on February 10, 2026. The company confirmed that the issue stemmed from inadequate security checks on the server side, not from weak user passwords. Azdoufal used Claude Code to help reverse-engineer the communications protocol, but Engadget notes that artificial intelligence was not the cause of the underlying weakness. The failure lay entirely in the server’s inability to properly isolate user access rights.
Privacy Risks and Data Collection
The DJI incident highlights broader privacy concerns associated with connected home cleaning devices. Robot vacuums equipped with cameras and microphones can generate detailed floor maps, record cleaning histories, and potentially capture private conversations or video of residents. Engadget reports that top-tier models often include remote video viewing capabilities, effectively acting as low-riding drones within the home.
Cloud connectivity introduces additional risks for users who monitor their devices while away. These vacuums communicate through manufacturer servers to provide status updates and remote control features. While businesses use this data to verify ownership and usage patterns, the same infrastructure can expose sensitive home layouts and activities if security measures fail. Engadget emphasizes that not every device is selling home blueprints, but the distinction between necessary data collection and privacy invasion remains unclear for many consumers.
Who Is Affected
Users of DJI Romo robot vacuums are the primary subjects of this specific incident, with approximately 7,000 devices affected before the February 10, 2026, patches. However, the privacy implications extend to owners of any connected robot vacuum that utilizes cloud connectivity, cameras, or microphones. Engadget notes that the amount of information collected and how it is shared varies significantly between products and manufacturers.
Consumers often overlook privacy policies, which are frequently buried in complex legal language. The "bounded rationality" or privacy paradox means users may accept data collection risks without fully understanding what is being shared, when, and why. The DJI breach serves as a concrete example that these privacy risks are not hypothetical, but active threats that can be exploited through server-side errors.
What should you do?
Owners of connected robot vacuums should verify that their devices are running the latest firmware versions provided by the manufacturer. Users should review the privacy settings within the companion app to limit data sharing and remote access capabilities where possible. It is also advisable to physically cover cameras or disable microphones when the device is not in active use, if the hardware allows for such manual overrides.
Background: Privacy policies
A privacy policy is a legal document that explains what data a company collects, why it collects it, and how it shares that information. It defines your rights regarding consent and deletion. Understanding it helps you control your digital footprint and avoid unintended data exposure to third parties.
Read the full guide: How Privacy Policies Actually Work: A Practical Explanation
What to do and how to stay safe: DJI
- Check your robot vacuum's app for available firmware updates and install them immediately to patch known security vulnerabilities.
- Review the device's privacy settings to restrict cloud data sharing and disable remote viewing features if they are not essential.
- Physically cover the camera lens or use tape to block the microphone when the vacuum is charging or not in active use.
- Read the manufacturer's privacy policy to understand what data is collected, stored, and potentially shared with third parties.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many robot vacuums were affected by the DJI security flaw?
Approximately 7,000 DJI Romo robot vacuum cleaners worldwide were accessible to a single user due to the permission error.
When did DJI fix the security issue?
DJI issued two updates to resolve the backend permission issue on February 10, 2026.
Was artificial intelligence responsible for the security breach?
No, Engadget reports that AI was not to blame; the failure was in the server's security checks and permission logic.
