RECALLS · FEB 14, 2026
DJI Romo flaw exposed cameras, mics and floor plans of about 7,000 robot vacuums
A hobbyist trying to drive his own vacuum with a game controller found he could reach other owners' robots. DJI says server side fixes were rolled out automatically.
By Riley Hart · 4 sources linked below
Any robot vacuum with a camera and microphone depends on the maker's servers being secure, and owners cannot check that themselves. Keep the app and firmware updated, turn off remote video or voice features you do not use, and put smart home devices on a separate guest network. If a camera in the home is a deal breaker, a lidar only model avoids the issue.
A software engineer in Spain, Sammy Azdoufal, found that he could see into other people's homes through DJI's Romo robot vacuums. The Verge first reported the problem on February 14, 2026, and later coverage put the number of exposed vacuums at about 7,000.
He was not trying to break in. He wanted to steer his own Romo with a PlayStation 5 controller and used an AI coding tool to build a small app. When the app connected to DJI's servers using the private token from his own robot, the servers gave it access to other owners' robots too. PetaPixel reports that he says he did not bypass any security.
According to PetaPixel's summary of The Verge's report, the access included live camera video and microphone audio, rough locations based on IP addresses, and floor plans of owners' homes. The Verge checked the claim by finding a Romo that one of its own reviewers had at home, using only its serial number, and showing that robot's map and live video. Some DJI Power portable battery stations were also exposed.
DJI's account differs in timing. DroneXL reports that DJI says it found a backend validation issue during an internal review in late January 2026 and pushed automatic fixes on February 8 and February 10, with no action needed from owners. DJI told The Verge the problem was fixed shortly before the demonstration, but the first patch had not reached all servers, and at least one remaining issue was still open on February 17. DJI said it would close it within weeks.
In March, DroneDJ reported that DJI said the updates had been deployed and that it had paid an unnamed researcher through its bug bounty program. An email shared by Azdoufal mentions a $30,000 reward. DJI has not said which report earned it. DroneDJ also cites a figure of 24 countries, which we could not confirm from DJI itself.
Two points are confirmed: the exposure was real, and DJI has rolled out fixes on its servers. What is not public is whether anyone besides the researchers used the flaw, and how long it was open before late January.
For owners of any camera equipped vacuum, a few habits help. Keep the app updated, switch off remote viewing and voice features you never use, and use a strong, unique password for the account. These steps would not have stopped this particular flaw, which sat on DJI's servers, but they reduce other risks.
The DJI Romo is not on our floor rankings. The lesson applies to any camera equipped robot vacuum, because the weak point here was the company's cloud, not the robot in the living room.