30 秒でわかる
Matthew Berman recounts how a developer building an alternative app for his DJI robot vacuum discovered access to other owners' devices. He highlights the privacy implications and the disclosure to DJI. Reporting by The Verge describes the issue as a backend permission-validation flaw, rather than establishing that every robot used the same token.
- 1An alternative appBerman says a developer bought a DJI robot and built his own app rather than using the normal one.
- 2Unexpected accessThe developer found access to thousands of other devices. Berman describes this as a shared token, while DJI described a backend permission-validation issue.
- 3Privacy and disclosureBerman highlights camera and home-mapping data and says the developer notified DJI, which fixed the issue.
ポイント
- A homemade controller exposed access to thousands of DJI robot vacuums across multiple countries.
- The reported exposure included device data and home maps, with camera and microphone access demonstrated on devices belonging to the researcher and a friend.
- The researcher reported the problem, and DJI deployed server-side fixes; the initial patch was not applied across all service nodes.
チャプターごとに整えた全文を読む
Building a controller
A developer wanted an alternative app for his DJI robot. Berman says the project unexpectedly exposed many other devices.
A developer bought an expensive DJI robot vacuum and wanted to use his own app instead of the standard one. While building it, he found access to roughly 7,000 other robots. I describe this as DJI using the same token for every robot; [The Verge's firsthand report](https://www.theverge.com/tech/879088/dji-romo-hack-vulnerability-remote-control-camera-access-mqtt) instead says his own token granted access to other devices, and DJI called it a backend permission-validation problem. He used Claude Code to help build the tool.
Sensitive data and a fix
Berman describes the privacy implications and says the developer reported the issue. DJI deployed fixes, although its initial patch did not reach all service nodes.
The exposure spanned devices in 24 countries and included home-mapping information. The researcher told The Verge he could access camera and microphone feeds and tested that with his own and a friend's devices; this does not establish that he viewed every home. He reported the problem to DJI, and I praise him for doing so. DJI said it deployed two server updates, with a follow-up needed because the first patch had not reached all service nodes.
同じチャンネルの記事
34:21EN
Matthew Berman· 2026年10月27日Matthew Berman Examines Anthropic’s IPO Filing, AI Growth and GovernanceMatthew Berman, Sam Altman · Forward FutureThe presenter reviews the S-1’s financial metrics, compute strategy and voting structure while questioning the tension between rapid AI development and safety.
0:26ENMatthew Berman· 2026年10月25日Sam Altman on Human Values and Problem-Solving in an AI WorldSam Altman · OpenAIIn a short interview excerpt, Altman considers the enjoyment of solving hard problems and the human role in interpreting results.
0:36ENMatthew Berman· 2026年10月25日Kimi K3.1 and a Rubik’s Cube Solver DemonstrationMatthew Berman · Forward FutureMatthew Berman shows a scrambled virtual cube being solved and gives the Kimi K3.1 test a favorable assessment.
0:21ENMatthew Berman· 2026年10月24日An AI-Generated Kimi Benchmark Chart Used Invented ScoresMatthew Berman · Forward FutureMatthew Berman asks for a graph of Kimi K3.1 Pro benchmarks, then discovers that the displayed figures are illustrative placeholders.
25:50ENMatthew Berman· 2026年10月24日Kimi K3.1 Pro Tested: Strong 3D Demos, Uneven Results and Competitive PricingMatthew Berman · Forward FutureMatthew Berman tests the open-weight model on coding, 3D rendering and visual explanations, then compares benchmark results and prices.
32:20ENMatthew Berman· 2026年10月23日Who Is Local AI For? The Costs, Trade-offs and a Hybrid FutureMatthew Berman · Forward FutureMatthew Berman weighs data control and independence against hardware cost, setup complexity and inference speed.