DJI Romo Hack Exposed: Robot Vacuum Security Risks & Privacy Guide

The PlayStation Controller That Unlocked 7,000 Homes

I have tested enough robot vacuums to know that they are usually more clumsy than they are clever. Most of the time, the biggest "security" risk is the vacuum accidentally eating a stray sock or getting trapped in a corner by a particularly aggressive rug. But every so often, a story breaks that serves as a jarring reminder of what we are actually doing when we bring these devices into our homes: we are installing an internet-connected camera and microphone on wheels.

The recent DJI Romo incident isn't just a minor tech glitch; it is a total systemic failure that should change how you think about smart home gifts.

It started innocently enough. Security researcher Sammy Azdoufal bought a DJI Romo and, being a tinkerer, wanted to see if he could control it using a PlayStation 5 DualSense controller. It was supposed to be a fun weekend project. But when his custom app connected to DJI’s servers, the response wasn't just from his own vacuum. Instead, he found himself with administrative access to roughly 7,000 DJI Romo units all over the world.

He didn't just have the ability to move them around. He could tap into their live camera feeds. He could listen through their microphones. Most disturbingly, he could see the detailed 2D floor plans these vacuums had painstakingly mapped out. Imagine a stranger having a blueprint of your home, knowing exactly where your bedroom is, and being able to watch you from floor level without you ever knowing. This is the "Creep Factor" personified, and it highlights a massive gap in how some manufacturers approach our personal data.

The Architecture of a Privacy Disaster

Why did this happen? It comes down to a fundamental choice in how these devices are built: Cloud Dependency versus Local Processing.

Many newer or "budget-friendly" brands rely entirely on the cloud to save on manufacturing costs. Instead of the vacuum having the "brains" to process its own maps and video, it sends everything to a central server owned by the company. When you open your app, you aren't talking to your vacuum; you are talking to the server, which then talks to the vacuum.

In the case of the DJI Romo, the security between that server and the thousands of vacuums was effectively non-existent. By mimicking a legitimate request, Azdoufal wasn't just "hacking" a device; he was walking through a front door that the manufacturer had left wide open and unlocked.