Sammy Azdoufal, an AI strategist based in Barcelona, was attempting to control his DJI Romo robot vacuum with a PS5 gamepad using Claude Code when he uncovered a critical security failure. By extracting his own device’s private API token, Azdoufal discovered that DJI’s MQTT broker allowed him to access approximately 7,000 other Romo vacuums across 24 countries. This was not a theoretical exercise; in just nine minutes, he cataloged 6,700 devices and harvested over 100,000 messages, including live camera feeds, microphone audio, 2D and 3D floor maps, and real-time sensor data.
The DJI Romo breach serves as a definitive proof-of-concept for the systemic single-point-of-failure risk inherent in current autonomous home agent architectures. The technical core of the vulnerability lay in the implementation of the MQTT broker. While DJI utilized TLS encryption to protect data in transit, the application layer lacked necessary topic-level access controls. Once authenticated, any client could subscribe to wildcard topics and intercept plaintext data from thousands of other devices. This architecture effectively transformed a private consumer product into a global, open-access network, exposing everything from room layouts to IP-based rough locations.
This incident is not an isolated anomaly but part of a recurring pattern of security failures in the smart home industry. In 2024, Ecovacs Deebot X2 units were hijacked to harass pet owners and broadcast racial slurs because PIN validation was restricted to the app rather than the server or the robot itself. Similarly, the Dreame X50 Ultra was found to have flaws allowing real-time camera access and gallery theft, as reported by South Korean government agencies. From Narwal to Wyze and Anker Eufy, the industry has repeatedly treated security as an afterthought, often patching vulnerabilities only after public exposure.
For DJI, the timing of this breach is particularly damaging. The company was added to the FCC Covered List in December 2025 following a failed national security audit, resulting in a ban on new equipment authorizations. With projected losses of approximately $1.5 billion, the financial stakes are clear. Security researcher Kevin Finisterre has noted that the location of a server—even one based in the U.S.—does not inherently prevent access by personnel in other jurisdictions, a point that complicates the trust model for global hardware manufacturers. DJI’s initial response, which claimed the vulnerability was fixed when it was only partially resolved, further highlights the risks of reactive, incomplete patching strategies.
The business implications for the broader smart home sector are stark. For investors, the “agent” label now carries a significant liability profile. Security is no longer a feature; it is a core solvency risk. Companies that prioritize a “move fast and break things” approach to cloud-connected agents are finding that their reputational and financial sustainability is increasingly fragile. As the OWASP Top 10 for Agentic Applications 2026 highlights, the risks facing autonomous systems are evolving faster than the defensive measures currently in place.
Builders must shift away from centralized, insecure cloud dependencies. Relying on reactive patches—as seen in DJI’s initial, partial fix for the Romo, which required a follow-up patch on February 10 to complete—is a strategy that invites regulatory scrutiny and market abandonment. Developers must implement robust, granular access controls and prioritize edge-based processing to minimize the blast radius of any single vulnerability. As of February 17, 2026, at least two additional vulnerabilities remained unfixed in the Romo, including one that allows viewing a video stream without a security PIN.
For consumers, the convenience of autonomous agents currently comes at the cost of total domestic surveillance exposure. The DJI Romo incident, as detailed by The Verge, proves that the era of “set it and forget it” smart home technology is over. Until the industry adopts a “security-by-design” mandate, the assumption must be that any device with a camera and a cloud connection is a potential point of failure. The risks are now as tangible as the devices themselves, and for the smart home market, the cost of ignoring these vulnerabilities is becoming impossible to hide.