A worrying report is putting DJI’s Romo robot vacuums under a harsh spotlight, after a researcher demonstrated what looks like a large-scale backend authorization failure. The claim is blunt: with the right access token, it was possible to view live camera footage (and audio) from other people’s Romo units and even issue movement commands—turning a cleaning robot into an unintended remote surveillance endpoint. The reported scale is around 7,000 devices globally, which moves this from a single-account privacy leak into a fleet-level cloud security problem. The discovery is credited to Spanish engineer Sammy Azdoufal, who wasn’t hunting for a vulnerability in the first place. He was reportedly building a third-party controller app to drive his own Romo using a PS5 gamepad. While integrating with DJI’s services, he observed that his app wasn’t limited to his vacuum—thousands of devices appeared to accept him as an authorized client. The important distinction here is that this isn’t described as a local-network hack or a cracked Wi-Fi setup. Instead, it points at a server-side permission model that didn’t properly enforce “this account can only access this device.”
The exposure to MQTT-based communication between the device and DJI’s backend, with the vulnerability described as a permission validation issue. In practice, that means encryption in transit can still be present and correct, yet the system is vulnerable because the server is returning data it shouldn’t. Live video and audio are the obvious red flags, but mapping outputs (room layout and 2D floor plans) are also sensitive, since they reveal how a home is structured and used. DJI has acknowledged a backend permission validation issue and says remediation was deployed automatically via two updates—an initial patch on February 8, 2026, followed by a second update completed on February 10, 2026—intended to ensure the fix reached all service nodes. DJI also states that the problem was not caused by traffic being sent unencrypted, claiming TLS has always been in place. The company further suggests confirmed misuse was rare and largely tied to researchers testing their own devices, though the optics of “camera and mic on wheels” are obviously not great for user trust. If there’s a broader lesson here, it’s that cloud-managed smart home gear lives or dies on backend access control. A single authorization mistake can bypass local defenses and affect devices across regions, regardless of how secure the home network is. For buyers, security update velocity and transparency need to be part of the value equation—right alongside suction power and obstacle avoidance.
