{"schema_version":"0.10.0","id":"LR-2026-0412","record_version":1,"title":"Man accidentally gains access to thousands of robot vacuums","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":43.5,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":3.2,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: Fortune · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: Fortune · subject to change"}]},"sources_hash":"a46956c9fface8c3f82a3801a774c7aa58844f16dc28eede5dfeeee4f1448240"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-02-25","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"A software engineer, Sammy Azdoufal, was steering a DJI Romo robot vacuum with a game controller when he used an AI coding assistant to reverse-engineer how the vacuum talked to DJI's remote servers. He extracted a security token meant to prove ownership of his own device. The backend servers instead treated him as the owner of nearly 7,000 robot vacuums across 24 countries, and he could reach live camera feeds, microphones and floor plans of other people's homes. He responsibly reported the security bug to The Verge rather than exploiting it. Press coverage used the case to argue that automated systems are widening security gaps. The sources do not state how DJI fixed the flaw or when it was closed.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":"none","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK03","secondary_risks":["RK15"]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Test: data or systems of others touched with a bounded scope stated. Fact: nearly 7,000 robot vacuums across 24 countries, including live camera feeds and microphones of other people's homes","harm_class":["privacy"],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://fortune.com/2026/02/25/who-is-sammy-azdoufal-robot-vacuum-cleaner-access-to-thousands-cyber-ai-agent-risk/","publisher":"Fortune","date":"2026-02-25","type":"press","title":"Man accidentally gained access to thousands of robot vacuums, exposing an AI cyber nightmare - Fortune","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"event.incident_class":"C","event.adversarial_actor":"C","impact.harm_class":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"Instead, as reported by Popular Science, the backend servers treated him as the owner of nearly 7,000 robot vacuums operating across 24 countries."}],"event.adversarial_actor":[{"source_index":0,"quote":"While he responsibly reported the security bug (to The Verge) rather than exploiting it, this staggering vulnerability highlights a terrifying reality: The rapid, unchecked integration of automated systems is creating a massive and unprecedented security gap."}],"impact.harm_class":[{"source_index":0,"quote":"With a few keystrokes, Azdoufal discovered he could tap into live camera feeds, activate microphones, and even compile 2D floor plans of strangers’ private homes."}],"impact.severity":[{"source_index":0,"quote":"Instead, as reported by Popular Science, the backend servers treated him as the owner of nearly 7,000 robot vacuums operating across 24 countries."}],"impact.severity_because":[{"source_index":0,"quote":"Instead, as reported by Popular Science, the backend servers treated him as the owner of nearly 7,000 robot vacuums operating across 24 countries."}],"event.summary":[{"source_index":0,"quote":"When software engineer Sammy Azdoufal sat down to steer his new DJI Romo robot vacuum with a PlayStation 5 video game controller, he didn’t expect to accidentally commandeer a global surveillance network."},{"source_index":0,"quote":"Using an AI coding assistant to reverse-engineer how the vacuum communicated with DJI’s remote servers, Azdoufal extracted a security token meant to prove he owned his specific device."},{"source_index":0,"quote":"Instead, as reported by Popular Science, the backend servers treated him as the owner of nearly 7,000 robot vacuums operating across 24 countries."},{"source_index":0,"quote":"With a few keystrokes, Azdoufal discovered he could tap into live camera feeds, activate microphones, and even compile 2D floor plans of strangers’ private homes."},{"source_index":0,"quote":"While he responsibly reported the security bug (to The Verge) rather than exploiting it, this staggering vulnerability highlights a terrifying reality: The rapid, unchecked integration of automated systems is creating a massive and unprecedented security gap."}]},"notes_on_gaps":"The source does not state the dates of occurrence, disclosure or detection; the article date 2026-02-25 is only the publication date and is not used as a disclosure date. The AI coding assistant is not named and the sources do not say it acted autonomously, so agent fields are omitted. The sources do not state the country or industry of the incident, the model, harness or developer of any AI system, a trigger, or any fix or remediation by DJI. Judgements made: severity set to moderate on the bounded scope of nearly 7,000 devices in 24 countries; root cause set to infrastructure for the backend ownership check; control A1 treated as failed because the backend granted owner-level access broader than the token was meant to allow; detection method set to public_researcher because the discoverer reported it himself. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: Fortune · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"He extracted a security token meant to prove ownership of his own device.","quote":"Using an AI coding assistant to reverse-engineer how the vacuum communicated with DJI’s remote servers, Azdoufal extracted a security token meant to prove he owned his specific device.","source_index":0,"grade":"C"},{"step":"reached","text":"The backend servers treated him as the owner of nearly 7,000 robot vacuums across 24 countries.","quote":"Instead, as reported by Popular Science, the backend servers treated him as the owner of nearly 7,000 robot vacuums operating across 24 countries.","source_index":0,"grade":"C"},{"step":"done","text":"He responsibly reported the security bug to The Verge rather than exploiting it.","quote":"While he responsibly reported the security bug (to The Verge) rather than exploiting it, this staggering vulnerability highlights a terrifying reality: The rapid, unchecked integration of automated systems is creating a massive and unprecedented security gap.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://fortune.com/2026/02/25/who-is-sammy-azdoufal-robot-vacuum-cleaner-access-to-thousands-cyber-ai-agent-risk/"]},"analysis":{"sections":{"timeline":[{"text":"He reported the security bug to The Verge rather than exploiting it.","quote":"While he responsibly reported the security bug (to The Verge) rather than exploiting it, this staggering vulnerability highlights a terrifying reality: The rapid, unchecked integration of automated systems is creating a massive and unprecedented security gap.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://fortune.com/2026/02/25/who-is-sammy-azdoufal-robot-vacuum-cleaner-access-to-thousands-cyber-ai-agent-risk/"]}}