A software engineer accidentally uncovered a massive security flaw in DJI's robot vacuum systems. Sammy Azdoufal, building a custom remote control app, discovered that credentials for his DJI Romo vacuum granted access to live camera feeds, microphone audio, and location data from nearly 7,000 other vacuums across 24 countries. The vulnerability meant Azdoufal could potentially map homes and activate devices remotely. DJI confirmed the issue was fixed through two updates deployed automatically in late February 2026.

This incident highlights persistent security weaknesses in internet-connected home robots, raising concerns about privacy as more sophisticated models enter homes. The flaw underscores warnings from experts about the inherent risks of smart home devices, especially as AI-powered tools may make exploiting such flaws easier.