One man accidentally gained access to thousands of robot vacuums, exposing the AI cyber nightmare risk facing millions of Americans

When software engineer Sammy Azdoufal sat down to steer his new DJI Romo robot vacuum with a PlayStation 5 video game controller, he didn’t expect to accidentally commandeer a global surveillance network. Using an AI coding assistant to reverse-engineer how the vacuum communicated with DJI’s remote servers, Azdoufal extracted a security token meant to prove he owned his specific device. Instead, as reported by Popular Science, the backend servers treated him as the owner of nearly 7,000 robot vacuums operating across 24 countries.

With a few keystrokes, Azdoufal discovered he could tap into live camera feeds, activate microphones, and even compile 2D floor plans of strangers’ private homes. While he responsibly reported the security bug (to The Verge) rather than exploiting it, this staggering vulnerability highlights a terrifying reality: The rapid, unchecked integration of automated systems is creating a massive and unprecedented security gap.

Millions of Americans are increasingly welcoming these internet-connected devices into their most intimate spaces. Roughly 54 million U.S. households had at least one smart home device installed as of 2020, per Parks Associates. Furthermore, companies like Tesla, Figure, and 1X are racing to introduce sophisticated, humanoid autonomous robots capable of living in homes and performing complex chores.

The surveillance capabilities of smart devices became a national talking point earlier this year, when a Google Nest device apparently stored footage on the cloud of the alleged kidnapping of Nancy Guthrie, mother of Today show host Savannah Guthrie. That was followed shortly afterward by an Amazon Super Bowl ad for its Ring product, meant to depict the charming rescue of a lost dog but actually revealing that networked cameras capable of spying on Americans are everywhere. The backlash seemingly prompted Amazon to discontinue its partnership with a police surveillance firm. Once you add autonomous AI agents into this mix, you have what cybersecurity giant Thales describes as a budding nightmare scenario.

The nightmare scenario around the corner

According to the recently released Thales 2026 Data Threat Report, a stunning 70% of organizations now explicitly cite AI as their top data security risk. And just like the DJI vacuums relying on remote cloud servers, enterprises are eagerly embedding AI into their daily workflows, granting automated systems broad access to sprawling enterprise data.

The core issue is a shocking lack of visibility and foundational data control. The Thales report reveals only 34% of organizations actually know where all their sensitive data resides. And because AI systems continuously ingest and act upon information across vast cloud environments, it is incredibly difficult to enforce “least-privilege access,” or the practice of granting only the minimum necessary access rights. If a machine’s credentials—such as tokens or API keys—are compromised, the resulting data exposure can be devastating.

In fact, credential theft is currently the leading attack technique against cloud management infrastructure, cited by 67% of organizations that have suffered cloud attacks. Imagine not just the 7,000 robotic vacuum cleaners, but a whole community’s Nest or Ring devices, being controlled by an AI agent instead.

Rodney Brooks, cofounder of iRobot, creator of the Roomba vacuum, said Elon Musk’s vision of a future powered by humanoid robots was “pure fantasy thinking,” because they’re just too clumsy.

“Today’s humanoid robots will not learn how to be dexterous despite the hundreds of millions, or perhaps many billions of dollars, being donated by VCs and major tech companies to pay for their training,” Brooks wrote in a blog post. It’s unclear if that thinking extends to a human or AI agent controlling that robot remotely.

“Insider risk is no longer just about people. It is also about automated systems that have been trusted too quickly,” warned Sébastien Cano, senior vice president of cybersecurity products at Thales. When basic security measures like identity governance and access policies are weak, Cano notes, “AI can amplify those weaknesses across corporate environments far faster than any human ever could.”

Making matters worse, the very tools used to build software are lowering the barrier to entry for exploiting these systems. AI-powered coding tools—like the one Azdoufal used to easily reverse-engineer the DJI servers—make it significantly easier for individuals with less technical knowledge to uncover and exploit software flaws. Despite these escalating automated threats, only 30% of companies surveyed currently have a dedicated AI security budget, relying instead on traditional perimeter defenses built for human users.

As Eric Hanselman, chief analyst at S&P Global’s 451 Research, pointed out, a fundamental paradigm shift is urgently required.

“As AI becomes deeply embedded into enterprise operations, continuous data visibility and protection are no longer optional,” Hanselman stated.

Without a radical rethinking of identity and encryption protocols, society is essentially leaving the front door wide open for the proverbial next software engineer with a video game controller.

This story was originally featured on Fortune.com