DJI ROMO Robot Exposed by AI Tool; Unauthorized Access to 7,000 Devices Globally
A user using an AI code assistant discovered a vulnerability in DJI's ROMO robot vacuum that allowed unauthorized access to approximately 7,000 devices across 24 countries. The vulnerability enabled viewing camera feeds, listening to audio, and accessing room maps and device locations; DJI reported discovering the issue independently and has completed fixes with no evidence of data misuse.
What happened
A user used Anthropic's Claude Code AI assistant to reverse-engineer the communication protocol of DJI's ROMO robot vacuum in order to control it with a PlayStation 5 controller. When the custom application connected to DJI servers, approximately 7,000 robot vacuums across 24 countries simultaneously responded.
The vulnerability in DJI Home application backend authentication allowed unauthorized access to real-time camera feeds, microphone audio, 2D room maps, and device location data for affected ROMO robots. DJI reported discovering the authentication issue independently during routine internal security review in late January and received reports of the same vulnerability from two independent security researchers through its bug bounty program.
Reported impact
The vulnerability exposed the ability to access camera feeds, listen to audio through device microphones, and obtain complete 2D room maps and device locations for affected robot vacuums. DJI stated no evidence of user data misuse was found.
Index analysis
The security flaw was located in backend verification of the DJI Home application affecting ROMO robots and some DJI power bank products. The issue was identified through reverse engineering facilitated by AI coding tools and through the company's bug bounty program.
Governance controls
DJI completed patches and deployed updates to fully resolve the vulnerability. The company stated it has a bug bounty program with over 300 security researchers submitting reports, and plans independent third-party security audits and certification for ROMO and DJI Home App similar to processes used for drone products.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.