A software engineer who set out to connect a robot vacuum cleaner to a gaming controller instead uncovered a security vulnerability that allowed access to thousands of connected devices around the world.
Sammy Azdoufal discovered that software used to control his DJI Romo robot vacuum could communicate with the company’s servers in a way that exposed remote access to approximately 7,000 devices. The flaw potentially allowed an outside user to control the robots and access their camera feeds.
After reporting the issue through DJI’s security program, the researcher received a $30,000 reward for identifying the vulnerability.
The episode highlights a growing challenge in robotics and smart home technology: ensuring that connected machines operating inside private spaces remain secure from unauthorized access.
A Discovery That Revealed Remote Access
Azdoufal originally attempted to integrate his DJI robot vacuum with a PlayStation 5 controller, experimenting with ways to control the device remotely.
During testing, he noticed that his custom control application was communicating directly with DJI’s cloud infrastructure. This interaction unexpectedly granted him visibility into a network of thousands of robot vacuums deployed globally.
According to the researcher, the system allowed remote interaction with the devices without requiring traditional hacking methods such as password cracking or server intrusion.
The vulnerability reportedly enabled several capabilities, including remotely operating the robots, accessing live camera feeds, and viewing the digital maps the devices create when scanning household environments.
Because robot vacuums typically map rooms and navigate through homes using onboard sensors and cameras, such access could potentially expose sensitive information about users’ living spaces.
Security Risks in Connected Home Robotics
The incident underscores the broader cybersecurity risks associated with consumer robotics and smart home devices.
Unlike traditional appliances, modern robot vacuums rely heavily on cloud connectivity to enable features such as remote control, mapping, software updates, and integration with mobile apps.
These capabilities create new attack surfaces where vulnerabilities can potentially expose both device control and user data.
In the case of the DJI Romo devices, the vulnerability allowed interaction with the robots through the company’s application infrastructure rather than requiring direct access to individual devices.
Although there is no evidence that the flaw was exploited maliciously, the ability to access cameras and mapping data raised concerns about privacy.
Company Response and Security Updates
DJI said it had already begun addressing related vulnerabilities before the researcher publicly described the issue. The company later confirmed that updates had been deployed to resolve the problem.
According to DJI, the fix was implemented through the DJI Home application infrastructure and did not require action from users.
The company also noted that two independent security researchers reported the vulnerability through its bug bounty program.
DJI said it found no evidence that customer data had been misused.
“Our customers place trust in our technology, and we do not take that lightly,” the company said in a statement outlining steps taken to strengthen the product’s security.
What This Signals for Consumer Robotics
As robots become more common in homes, offices, and industrial environments, cybersecurity is emerging as one of the central challenges facing the robotics industry.
Devices that move through physical spaces while collecting environmental data create a unique category of connected systems that combine robotics with cloud computing and artificial intelligence.
Researchers say this convergence increases the importance of secure software architectures and rapid vulnerability response programs.
Bug bounty initiatives, which reward researchers for reporting security flaws, have become one mechanism companies use to identify weaknesses before they can be exploited.
The DJI case illustrates how unexpected experimentation by independent developers can reveal vulnerabilities that might otherwise remain undetected.
As consumer robotics continues to expand, ensuring that machines operating inside private environments remain secure may become as critical as improving their navigation, autonomy, or intelligence.