DJI Romo cloud permissions flaw exposed home-privacy risks

An attempt to steer a robot vacuum with a game controller exposed access to other devices. The Verge reported Sammy Azdoufal’s DJI Romo discovery in February 2026. DJI says the flaw was fixed; this is a retrospective, not a new breach.

Remote cleaning functions depend on more than a robot’s navigation software. A cloud service may relay commands and information between the machine and its owner. That service must establish both identity and entitlement: knowing that a request comes from a genuine customer is not sufficient to establish which device the customer is allowed to access.

DJI’s own account says the problem involved DJI Home and affected Romo as well as some portable power stations. It says internal reviews identified the issue in late January, and that independent researchers subsequently reported the same vulnerability through its bounty program. The company says remediation is complete and its investigation did not identify evidence of user-data misuse. Discovery of an access flaw and proof that private households were maliciously monitored are different findings.

An apartment-building analogy makes the distinction clearer. A legitimate entrance card should not unlock every resident’s mailbox. The building must check ownership again at each mailbox, rather than treating entry through the front door as universal permission. Cloud authorization serves that second purpose. Encryption protects a different part of the journey: a protected message can still be delivered to the wrong authorized customer if the server’s permissions are incorrect.

That is why this case matters beyond another list of software bugs. A household robot turns physical space into data. A floor plan and an image of an obstacle are useful inputs to navigation and remote assistance, but they also describe a private home. The consequences of a failed account boundary are therefore different from a harmless setting appearing on the wrong screen.

DJI’s current privacy documentation gives owners several controls to consider. It describes separate permission for shared-device video access, an option to disable obstacle-photo uploads, and Local Data Mode on Romo 2. The company says this mode disconnects DJI Home from the internet while retaining local map and image processing and core operation; initial mapping still involves an internet connection.

Those controls are not evidence of a continuing February vulnerability. They illustrate a practical question for buyers today: how much of the device’s usefulness survives when its cloud connection or image sharing is disabled? Cleaning performance remains important, but data boundaries and usable offline functions belong in the same purchasing conversation.

Original report published: The Verge, February 14, 2026, 16:00 Beijing time / 3:00 AM EST.