Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
A researcher reportedly gained access to roughly 7,000 DJI Romo robot vacuums across 24 countries while trying to control his own vacuum with a PlayStation controller. The exposed capabilities reportedly included live camera video, microphone audio, floor maps, cleaning routes, battery status and other telemetry.
That does not prove that thousands of homes were actively watched, recorded or targeted by criminals. The available reporting demonstrates a serious authorization failure and proof-of-concept access—not mass surveillance of every affected owner.
What happened
According to reports from Malwarebytes, TechRadar and Tom’s Hardware, researcher Sammy Azdoufal was developing an unofficial app to operate his DJI Romo using a PS5 controller.
While reverse-engineering communication between his vacuum and DJI’s cloud services, his application reportedly received responses associated with other Romo devices. The discovery was not described as a conventional brute-force attack. Instead, the researcher appears to have encountered a failure in the way DJI’s backend enforced permissions between authenticated users and individual vacuums.
#1 Best Overall
- 𝐏𝐨𝐖𝐞𝐫𝐟𝐮𝐥 𝐂𝐥𝐞𝐚𝐧𝐢𝐧𝐠 𝐒𝐲𝐬𝐭𝐞𝐦: With 22000Pa HyperForce suction and Zero-Tangling Design, the Roborock Qrevo CurvX robot vacuum and mop conquers tough challenges including deep carpet debris, stubborn floor gap residue, pet fur, and long hair up to 40cm. You can freely select different mopping and vacuuming modes on the app to clean your home.
- 𝐃𝐞𝐬𝐢𝐠𝐧𝐞𝐝 𝐭𝐨 𝐑𝐞𝐚𝐜𝐡 𝐖𝐡𝐞𝐫𝐞 𝐃𝐮𝐬𝐭 𝐇𝐢𝐝𝐞𝐬: The Roborock Qrevo CurvX— the slimmest Roborock yet, only 7.98 cm, is designed for unreachable spots under sofas and cabinets, capturing hidden dust and delivering a deeper, more thorough clean.
- 𝟖𝟎°𝐂 𝐇𝐨𝐭 𝐖𝐚𝐭𝐞𝐫 𝐟𝐨𝐫 𝐓𝐫𝐮𝐥𝐲 𝐂𝐥𝐞𝐚𝐧 𝐌𝐨𝐩𝐬: The Roborock Qrevo CurvX uses 80°C hot water to dissolve stubborn stains and grease, ensuring your mops are thoroughly cleaned and hygienic with every use.
- 𝐑𝐞𝐚𝐜𝐭𝐢𝐯𝐞 𝐀𝐈 𝐎𝐛𝐬𝐭𝐚𝐜𝐥𝐞 𝐑𝐞𝐜𝐨𝐠𝐧𝐢𝐭𝐢𝐨𝐧: With structured light and an RGB camera, the robot intelligently detects and avoids 108 types of objects, seamlessly navigating around obstacles in both well-lit and dark spaces—no need to clear your floor beforehand.
- 𝐈𝐧𝐝𝐮𝐬𝐭𝐫𝐲-𝐅𝐢𝐫𝐬𝐭 𝐀𝐝𝐚𝐩𝐭𝐢𝐋𝐢𝐟𝐭 𝐂𝐡𝐚𝐬𝐬𝐢𝐬: The Roborock AdaptiLift Chassis technology brings a new level of versatility, allowing the robot to lift its entire chassis to 4cm max or adjust individual sections—front, rear, left, or right—based on the terrain. Whether tackling high thresholds or effortlessly maneuvering around furniture legs, it adapts seamlessly to your home's layout, enabling smooth, uninterrupted cleaning. (roborock was the first in the robot vacuum industry to mass-produce a product featuring a liftable chassis system with three-wheel control, officially launching this technology in Q3 2024.)
Reports say the researcher notified DJI and limited his testing to the access needed to demonstrate the problem.
How many vacuums were exposed?
Coverage varies between approximately 6,700 and 7,000 devices. The safest description is roughly 7,000 Romo vacuums, commonly reported as about 6,700, across 24 countries.
The number should not be read as an exact count of households whose owners were victimized. It reportedly represents devices visible or accessible through the flawed cloud path. It does not establish that every device was actively accessed by a malicious person, or that every owner’s camera was viewed.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What information was reportedly accessible?
Reports describe access to several types of Romo data and functions:
Rank #2
- Robot Vacuum Self-Emptying, App, Alexa & Google Assistant for Pet Hair, Carpet & Hard Floor
- Live video from the onboard camera;
- Microphone audio;
- Two-dimensional home maps;
- Cleaning routes and location information;
- Battery levels and device status;
- Serial numbers and related telemetry; and
- Remote-control capabilities.
Some coverage also says geographic information could be inferred from network data. Separately, technical reporting described a possible camera-access PIN bypass. That additional issue should be treated as a reported vulnerability rather than an independently verified detail; its complete technical information was reportedly withheld.
Was this a live camera hack?
Reportedly, yes: the researcher demonstrated access to live video and audio from other Romo units. But “access was possible” is different from “hackers watched 7,000 homes.” The available evidence does not establish that every camera was viewed, that footage was recorded or distributed, or that criminals exploited the flaw before it was disclosed.
What the incident proves—and what it does not
- It reportedly proves: a Romo cloud authorization failure could expose data and live sensor streams belonging to other devices.
- It does not prove: that every Romo was affected, every camera was watched, or customer data was stolen.
- It does not prove: that the vulnerability remains exploitable as of September 2026.
- It does not prove: that DJI’s entire smart-home ecosystem was breached.
What was the technical failure?
The strongest consistent explanation is an authorization failure involving the MQTT-based messaging used between Romo devices and DJI’s cloud infrastructure. In plain English, a device credential or token that should have granted access only to one vacuum reportedly allowed access to data associated with many devices.
Free tools Windows power users keep installed
One-click scans. No signup required.
This is primarily an access-control problem, not simply a failure of encryption. Encrypted communication can still deliver the wrong information if the server incorrectly decides which authenticated client is permitted to access a device, topic, map or video stream. Technical accounts from Guru3D and Compiuta describe the issue in those terms.
Rank #3
- 𝟯𝟬,𝟬𝟬𝟬𝗣𝗮 𝗕𝗟𝗔𝗦𝗧 𝗦𝗨𝗖𝗧𝗜𝗢𝗡 — 𝗖𝗟𝗘𝗔𝗡 𝗠𝗢𝗥𝗘 𝗜𝗡 𝗢𝗡𝗘 𝗣𝗔𝗦𝗦: Weak suction leaves dirt behind. BLAST 30,000Pa high-airflow suction lifts dust, pet hair, and crumbs from carpets and hard floors in one go—cleaning faster with fewer repeat passes.
- 𝗥𝗘𝗔𝗟 𝗦𝗖𝗥𝗨𝗕𝗕𝗜𝗡𝗚 𝗪𝗜𝗧𝗛 𝗢𝗭𝗠𝗢 𝗥𝗢𝗟𝗟𝗘𝗥 𝟯.𝟬 — 𝗡𝗢𝗧 𝗣𝗔𝗗 𝗦𝗠𝗘𝗔𝗥𝗜𝗡𝗚: Pads wipe, they don’t scrub. OZMO ROLLER 3.0 uses a 10.6-inch self-washing roller with continuous, pressurized scrubbing to lift sticky spills, dried stains, and kitchen grime—removing mess instead of spreading it.
- 𝗜𝗡𝗦𝗧𝗔𝗡𝗧 𝗦𝗘𝗟𝗙-𝗖𝗟𝗘𝗔𝗡𝗜𝗡𝗚 𝗢𝗭𝗠𝗢 𝗥𝗢𝗟𝗟𝗘𝗥 𝗠𝗢𝗣, 𝗔𝗟𝗪𝗔𝗬𝗦 𝗠𝗢𝗣 𝗪𝗜𝗧𝗛 𝗖𝗟𝗘𝗔𝗡 𝗪𝗔𝗧𝗘𝗥: Dirty pads re-soil floors. Pressurized self-washing with fresh-flow rinsing cleans the roller in real time, so it always mops with clean water—preventing streaks, residue, and secondary contamination from start to finish.
- 𝗧𝗥𝗨𝗘𝗗𝗚𝗘 𝟯.𝟬 — 𝗖𝗟𝗘𝗔𝗡 𝗧𝗛𝗘 𝗟𝗔𝗦𝗧 𝗜𝗡𝗖𝗛: Edges are often missed. TruEdge 3.0 extends the roller 0.6 inches beyond the body, gliding along baseboards and corners to remove dust lines where side brushes can’t scrub.
- 𝗭𝗘𝗥𝗢𝗧𝗔𝗡𝗚𝗟𝗘 𝟰.𝟬 — 𝗕𝗨𝗜𝗟𝗧 𝗙𝗢𝗥 𝗛𝗔𝗜𝗥 & 𝗣𝗘𝗧𝗦: Tired of hair tangles? BLAST airflow guides hair directly into suction, while ZeroTangle 4.0 helps prevent wrapping—less maintenance, more consistent cleaning power.
The public reporting does not justify publishing token-extraction methods, MQTT topic patterns or working exploit code. Owners need to know how to reduce risk, not how to reproduce the flaw.
DJI’s reported response
Available reporting says DJI acknowledged a backend permission-validation issue and deployed automatic fixes. The reported timeline was:
- February 8, 2026: initial remediation reportedly began.
- February 10, 2026: a further update was reportedly completed.
- March 2026: reports said DJI paid the researcher a $30,000 bug bounty.
- April 13, 2026: DJI’s official Romo release notes listed firmware version V01.00.15.
The February dates and bounty come from secondary reporting, including Tom’s Hardware and Guru3D. The April release notes are available from DJI’s Romo download site, but the available evidence does not establish that V01.00.15 is the definitive security fix for every model and region.
Recommended Free Tools
No clearly identifiable public DJI security bulletin in the available material confirms the complete affected-version range, whether all historical tokens were invalidated, whether cloud-stored maps or recordings were deleted, or whether every regional service was patched simultaneously. The incident should therefore be regarded as patched or mitigated according to current reporting, not as independently audited worldwide.
Rank #4
- 𝟯.𝟭𝟰-𝗜𝗻𝗰𝗵 𝗨𝗹𝘁𝗿𝗮-𝗧𝗵𝗶𝗻 𝗗𝗲𝘀𝗶𝗴𝗻: The Roborock Saros 10R redefines home cleaning with its ultra-slim 3.14-inch profile. Powered by the advanced StarSight Autonomous System 2.0, it eliminates the need for a raised LDS unit, unlike traditional bulky robot vacuums. It easily glides under beds, sofas, cabinets, and coffee tables, reaching hard-to-clean areas with precision. Perfect for homes that value both efficiency and elegance, it offers superior cleaning coverage in a sleek, compact design.
- 𝗦𝘁𝗮𝗿𝗦𝗶𝗴𝗵𝘁 𝗔𝘂𝘁𝗼𝗻𝗼𝗺𝗼𝘂𝘀 𝗦𝘆𝘀𝘁𝗲𝗺 𝟮.𝟬: Experience smarter cleaning with advanced 3D sensing technology, enabling precise mapping even under narrow-legged furniture and suspended cabinets. The innovative VertiBeam Lateral Obstacle Avoidance system navigates cables and irregular furniture with ease, cleaning along cords without manual intervention. Enhanced algorithms detect and adapt to 108 obstacle types, ensuring seamless and efficient cleaning across every corner of your home.
- 𝗣𝗼𝘄𝗲𝗿𝗳𝘂𝗹 𝗖𝗹𝗲𝗮𝗻𝗶𝗻𝗴 𝗦𝘆𝘀𝘁𝗲𝗺: With 22,000 Pa HyperForce suction, the Roborock Saros 10R effortlessly removes dirt, hair, and debris from all floor types, including hardwood, tile, and carpets. The Zero-Tangling DuoDivide Main Brush and FlexiArm Riser Side Brush ensure no hair tangles, even with long hair or pet fur. Additionally, the anti-tangle omnidirectional wheels eliminate the need for manual hair removal, significantly boosting cleaning efficiency and making maintenance effortless.
- 𝗖𝗼𝗿𝗻𝗲𝗿 𝗮𝗻𝗱 𝗘𝗱𝗴𝗲 𝗖𝗹𝗲𝗮𝗻𝗶𝗻𝗴: The FlexiArm Riser Side Brush & Mop automatically extends to reach difficult corners and low spaces under furniture, sweeping away dust with ease. As it detects corners and edges, the mop extends to provide thorough, efficient cleaning. This design ensures comprehensive coverage, effectively eliminating blind spots and leaving every area spotless.
- 𝗜𝗻𝗱𝘂𝘀𝘁𝗿𝘆-𝗙𝗶𝗿𝘀𝘁 𝗔𝗱𝗮𝗽𝘁𝗶𝗟𝗶𝗳𝘁 𝗖𝗵𝗮𝘀𝘀𝗶𝘀: The innovative AdaptiLift Chassis, featuring left/right wheels and omnidirectional wheels, effortlessly navigates obstacles up to 4 cm high, including thresholds and U-shaped furniture legs. When carpets are detected, the Dual Spinning Mops and mop bracket automatically lift to prevent wetting long-pile carpets. During recharging, the main and side brushes are raised to avoid dirt transfer onto the floor, delivering a quiet and pristine mopping experience.
What Romo owners should do now
- Update the DJI Home app. Use the normal app store for your country and install the newest available version.
- Check Romo firmware. Use the update function inside the official app. Record the installed version rather than relying only on an “up to date” message.
- Restart after updating. Confirm that the vacuum reconnects normally and that its firmware version remains current.
- Review camera, microphone, remote-viewing and cloud-sharing settings. Disable features you do not use.
- Secure the DJI account. Use a unique password and enable multifactor authentication if it is offered for your account and region.
- Remove unofficial integrations. Delete third-party companion apps, scripts or automations that connect to Romo cloud services, especially if they retain old access tokens.
- Inspect household access. Check shared accounts and remove people or integrations that no longer need control.
- Reset before transfer. Unbind the vacuum from your account and perform the manufacturer’s factory-reset procedure before selling or returning it.
- Contact DJI support if the vacuum shows unexplained camera activation, unknown account activity, unexpected remote commands or repeated update failures.
A password change is useful for account security, but it would not by itself repair a backend authorization defect. The important remedies are the manufacturer’s server-side changes, current app and firmware, and reduced use of unnecessary camera or microphone features.
Privacy settings are not the same as security updates
Owners should check three separate layers:
- Account security: password, multifactor authentication and shared users.
- Software security: DJI Home app, Romo firmware and unofficial integrations.
- Sensor privacy: camera, microphone, remote viewing, map synchronization and cloud-sharing controls.
Disabling the camera may reduce visual exposure while leaving maps, telemetry or cloud connectivity enabled. Conversely, blocking the vacuum at the router may prevent cloud access but can also disable remote control, map synchronization, firmware updates and support diagnostics.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Important regional and ownership edge cases
- Imported or mainland-China units may have different activation, cloud, app and firmware behavior from officially supported products in other countries.
- Firmware availability can differ by model and region.
- A used or grey-market Romo may not receive the same updates or support as an officially distributed unit.
- A factory reset may remove local account associations without necessarily deleting cloud-stored history. Check DJI’s deletion policy if this matters.
- Camera and microphone controls can differ between Romo models and app versions.
Should you buy a camera-equipped robot vacuum?
This incident does not prove that every camera-equipped robot vacuum is unsafe. It does show why a connected vacuum with video, audio, maps and remote control should be evaluated as a smart-home sensor—not merely as a cleaning appliance.
Camera-based navigation and remote viewing can improve obstacle recognition, pet monitoring and cleaning performance. The trade-off is that the device may collect information about interior layouts, occupancy patterns, children, pets, visitors, cleaning schedules and household routines.
Best Value
- Self-Cleaning Mop with FlowWash — Always Cleans with Fresh Water. Tired of robot mops spreading dirty water? This robot vacuum and mop combo continuously washes its track mop in real time, so only clean water touches your floors. With up to 7x more contact area and 15x longer stain scrubbing, it cleans deeper with every pass. 140°F hot water loosens dirt, 12N pressure scrubs it away, while a scraper removes residue and dirty water is collected into a sealed tank.
- 31,000Pa Suction for Pet Hair + Dual Tangle-Free Brush System. This robot vacuum for pet hair delivers 31,000Pa suction power to lift dust, crumbs, debris, and pet hair from hard floors and carpets. Its Dual Zero-Tangle System combines dual short rollers with an upgraded long-bristle side brush to reduce hair wrap and support a 0% hair entanglement rate, certified by SGS, making it ideal for homes with pets or long hair.
- AI Object Recognition with Dual Cameras — Avoids Obstacles, Cleans Smarter. Powered by dual cameras and an advanced VLM AI brain, Flow 2 goes beyond basic obstacle avoidance. It recognizes common household objects like shoes, cables, and pet bowls in real time, then adjusts its path for smarter cleaning with fewer bumps and less getting stuck.
- Adapts to Pets, Kids, and Everyday Life. Flow 2 intelligently responds to your home environment. It can lower noise near a crib for quieter cleaning and supports interactive pet features through the app, including playful sounds and pet locating support. The result is a more responsive robot vacuum and mop that fits your family’s daily routine with less interruption.
- Smart Light Bar — Status Updates at a Glance. No need to open the app or walk over to the dock. This vacuum mop combo features a built-in smart light bar that communicates cleaning, charging, drying, and alerts through clear color cues, so you always know what’s happening.
Before buying any model, check:
- Whether it has a camera or microphone;
- Whether video and audio are processed locally or sent to the cloud;
- Whether remote viewing can be disabled independently;
- Whether the camera has a physical shutter and whether microphone activity has a clear indicator;
- Whether maps are stored locally, in the cloud, or both;
- Whether the vacuum supports local-only operation;
- Whether a cloud account and internet connection are required;
- Whether multifactor authentication is available;
- Whether the vendor publishes security advisories and firmware notes; and
- Whether the device can operate on an isolated Wi-Fi network.
A camera-free model may sacrifice some obstacle-recognition and monitoring features, but it also reduces the consequences of a camera or microphone access-control failure. No competing brand should be assumed private or secure without model-specific evidence.
The broader smart-home lesson
The Romo case illustrates how a cloud authorization mistake can expose an entire device population. A single authenticated connection does not need to be “broken” in the traditional sense if the backend fails to enforce the boundary between one customer’s device and everyone else’s.
For privacy-sensitive rooms such as bedrooms and home offices, the simplest risk reduction is often physical and operational: choose a model without an indoor camera, keep microphones and remote viewing disabled when unnecessary, isolate smart-home devices from important computers, and favor vendors that publish clear security updates and support policies.
Frequently Asked Questions
Does changing my DJI password fix the Romo vulnerability?
No. A password change protects the DJI account, but the reported problem was a backend authorization failure. Owners should also update the app and firmware and remove unofficial integrations.
Should I disconnect my Romo from the internet?
That can reduce cloud exposure, but it may disable remote control, map synchronization, firmware updates and support diagnostics. Use it as a considered temporary measure rather than assuming it is a complete fix.
Has DJI confirmed exactly how many Romo devices were affected?
Public reporting varies between approximately 6,700 and 7,000 devices across 24 countries. The available material does not provide an independently audited final count.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute
