Technology

Engineer receives $30,000 for exposing a vulnerability affecting 7,000 robot vacuum cleaners — tinkerer just wanted to drive his robot vacuum with a PS5 controller

Source

Tom's Hardware

Published

Mar 7, 2026

TL;DR

AI Generated

DJI has awarded a software engineer, Sammy Azdoufal, $30,000 for discovering a critical vulnerability in its cloud backend that exposed 7,000 robot vacuum cleaners to potential access. Azdoufal's initial goal was to control his DJI Romo vacuum with a PS5 controller. By reverse-engineering DJI's cloud servers, he unintentionally gained access to live camera feeds, audio, and IP addresses of homes using DJI Romos in 24 countries. DJI has since patched the vulnerability, but questions remain about the reward and the speed of patching.

Read Full Article

The Download: a Nobel winner on AI, and the case for fixing everything

Nobel-winning economist Daron Acemoglu discusses AI's impact on productivity and the future of work, emphasizing the need for human labor despite technological advancements. Stewart Brand advocates for the importance of maintenance in his new book, highlighting the significance of caring for various aspects of society. Additionally, the article mentions the discovery of the first zero-day exploit created by AI and other notable tech news stories, including OpenAI's cybersecurity efforts and developments in the hantavirus vaccine.

MIT Technology Review•

3 hours ago

Compromised Mistral AI and TanStack packages may have exposed GitHub, cloud and CI/CD credentials in 'mini Shai Hulud' malware infection — supply-chain campaign spreads across npm and AI developer ecosystems like wildfire

Microsoft is investigating a compromise of the mistralai PyPI package, where attackers injected malicious code that automatically executed on import, downloaded a secondary payload, and launched malware on Linux systems. The compromised package contained code that silently downloaded a file and executed it in the background, potentially stealing credentials and executing destructive commands. This incident is part of the broader "Mini Shai-Hulud" software supply-chain campaign affecting npm and AI developer ecosystems. Additionally, security firm Aikido warned of compromised TanStack JavaScript packages and Mistral npm SDK packages in separate attacks, urging developers to rotate credentials if affected. The incidents highlight the increasing targeting of developer infrastructure, emphasizing the importance of securing high-value credentials in modern development environments.

Tom's Hardware•

3 hours ago

Standard 90-day vulnerability disclosure policy is likely dead thanks to AI, expert warns that AI can weaponize patches in 30 minutes — LLM-assisted bug-hunting ushers in a new cyberworld order

AI-assisted code scanning tools are accelerating the discovery and exploitation of software vulnerabilities, rendering the traditional 90-day disclosure policy ineffective. Security researcher Himanshu Anand warns that AI can weaponize patches within 30 minutes, leading to a new cyberworld order where developers need to prioritize security measures like LLM-assisted bug-hunting. The rapid identification of vulnerabilities by AI-powered tools raises concerns about the effectiveness of current security practices, prompting Anand to advocate for immediate fixes for critical security issues. While open-source software benefits from quick patch distribution, closed-source software may face challenges as AI tools become more adept at identifying vulnerabilities.

Tom's Hardware•

4 hours ago

Google finds first AI-developed zero-day that bypasses 2FA — self-morphing malware and Gemini-powered backdoors signal a new era of cybercrime

Google's Threat Intelligence Group (GTIG) has identified the first AI-developed zero-day exploit that bypasses 2FA, signaling a new era of cybercrime. The exploit involves self-morphing malware and Gemini-powered backdoors, showcasing the increasing sophistication of malicious actors. AI is being used extensively in cybercrime operations, allowing attackers to dynamically generate exploit payloads and evade detection. The report highlights the use of AI in phishing attacks, network intrusions, and even political manipulation, emphasizing the need for heightened cybersecurity measures. The GTIG report provides detailed insights into these emerging threats and the evolving landscape of cybercrime.

Tom's Hardware•

5 hours ago

The Download: a Nobel winner on AI, and the case for fixing everything

MIT Technology Review•

3 hours ago

Compromised Mistral AI and TanStack packages may have exposed GitHub, cloud and CI/CD credentials in 'mini Shai Hulud' malware infection — supply-chain campaign spreads across npm and AI developer ecosystems like wildfire

Tom's Hardware•

3 hours ago

Standard 90-day vulnerability disclosure policy is likely dead thanks to AI, expert warns that AI can weaponize patches in 30 minutes — LLM-assisted bug-hunting ushers in a new cyberworld order

Tom's Hardware•

4 hours ago

Google finds first AI-developed zero-day that bypasses 2FA — self-morphing malware and Gemini-powered backdoors signal a new era of cybercrime

Tom's Hardware•

5 hours ago

Engineer receives $30,000 for exposing a vulnerability affecting 7,000 robot vacuum cleaners — tinkerer just wanted to drive his robot vacuum with a PS5 controller

TL;DR

Similar Articles

The Download: a Nobel winner on AI, and the case for fixing everything

Compromised Mistral AI and TanStack packages may have exposed GitHub, cloud and CI/CD credentials in 'mini Shai Hulud' malware infection — supply-chain campaign spreads across npm and AI developer ecosystems like wildfire

Standard 90-day vulnerability disclosure policy is likely dead thanks to AI, expert warns that AI can weaponize patches in 30 minutes — LLM-assisted bug-hunting ushers in a new cyberworld order

Google finds first AI-developed zero-day that bypasses 2FA — self-morphing malware and Gemini-powered backdoors signal a new era of cybercrime

We use cookies

Engineer receives $30,000 for exposing a vulnerability affecting 7,000 robot vacuum cleaners — tinkerer just wanted to drive his robot vacuum with a PS5 controller

TL;DR

Similar Articles

The Download: a Nobel winner on AI, and the case for fixing everything

Compromised Mistral AI and TanStack packages may have exposed GitHub, cloud and CI/CD credentials in 'mini Shai Hulud' malware infection — supply-chain campaign spreads across npm and AI developer ecosystems like wildfire

Standard 90-day vulnerability disclosure policy is likely dead thanks to AI, expert warns that AI can weaponize patches in 30 minutes — LLM-assisted bug-hunting ushers in a new cyberworld order

Google finds first AI-developed zero-day that bypasses 2FA — self-morphing malware and Gemini-powered backdoors signal a new era of cybercrime