A Shark vacuum flaw is still open. Here's what yours knows about you.
A researcher pulled a live camera feed, a floor plan, and a Wi-Fi password off a Shark robot vacuum he didn't own. Shark hasn't fixed it. Here's what every robot vacuum collects, and what you can do about it.
On July 13, a researcher published a flaw he'd been trying to hand SharkNinja since March.
He opened up a Shark robot vacuum he owned and pulled out its security certificate. That's the credential the vacuum uses to prove it's really itself when it phones home. His certificate worked on other Shark vacuums too. Using it, he reached a second vacuum he'd bought separately, opened its camera feed while it drove around, read the map of the house it had been cleaning, and pulled the Wi-Fi password out of it in plain text.
He only ran the attack on machines he owned. But he sat and listened to Shark's system for 24 hours and counted more than 1.5 million vacuums checking in. About 673,000 of them answered a command he sent.
As of today it isn't fixed. No patch, no security bulletin, no public response.
How one vacuum opens the door to others
Every one of these vacuums talks to the manufacturer's servers all day. Shark's run on Amazon's cloud, and each vacuum gets a certificate so the server knows which machine is which.
That certificate was supposed to let a vacuum speak only for itself. Shark handed out a lot of them with the door left open wider than they should. One certificate could listen in on every Shark vacuum in the region and send commands to any of them by serial number, and the serial numbers were sitting right there in the same stream.
Getting that first certificate takes a screwdriver and a vacuum you own. After that, the rest of it happens over the internet.
To be fair to Shark, not every unit got a certificate this loose. The older of the two vacuums he tested had a properly locked-down one. But 673,000 machines answering a stranger's command in a single day isn't a rounding error.
He gave SharkNinja four months. He told them in March. He told them again in June that he was going to publish. They said they'd have a completion date for him by July 10. That date came and went, so he published.
This is bigger than Shark
A robot vacuum is a camera or a laser on wheels that drives every square foot of your house, writes down what it finds, and uploads the result to a company you've probably never thought about. Shark had a bad month. The category also has a track record.
If that pattern sounds familiar, it should. It's the same arrangement as the TV in your living room, which watches what you watch and sells it on the side.
What they see. There are three ways these things find their way around. The cheap ones bump into walls and turn, and they never build a map. The mid-range ones use LiDAR, a spinning laser on top that measures distances. The expensive ones add a camera so the robot can recognize a sock or a phone charger before it eats it.
The camera is the one people react to, and they're right to. Ecovacs and Roborock's high-end machines have them, some with microphones and a voice assistant attached. Several will stream that camera to your phone on purpose as a pet cam. Shark's line is mostly LiDAR, though some models carry a camera for obstacle detection. That was the one with a flaw. Eufy's vacuums have no cameras at all.
What the map is. A LiDAR map isn't a fuzzy blob. It's the floor plan of your home. The walls, the rooms, the furniture, the square footage, and whatever you named the rooms when you set it up. If you labeled one "Kids Bedroom," that label is in there.
Where it goes. This depends on the brand, and the brands aren't all telling the same story. iRobot keeps navigation images on the robot and only puts a simplified map in its cloud if you turn on map viewing. Ecovacs keeps maps in both places. Roborock's marketing says maps live on the device and never go up, while Roborock's own privacy policy talks about cloud backup and independent testers found the maps in the cloud anyway. Roborock also says it stores customer data in China, Germany, and the United States.
None of that is illegal. You agreed to it because it's sitting in a policy you scrolled past to get the thing working. From there it joins everything else about you that gets bought and sold by companies you've never heard of.
What's already happened
Four of these are real. One isn't.
Roomba, 2022. MIT Technology Review published images captured by Roomba test units that leaked out of the pipeline. One was a woman on a toilet. Another was a child on a floor. These were development machines with recording hardware, driven in the homes of paid testers who'd signed up for it, not retail Roombas off a shelf. iRobot sent more than two million images to Scale AI for labeling, and gig workers in Venezuela posted at least fifteen of them into private Facebook and Discord groups. iRobot ended the Scale AI contract. Some of the testers said afterward they hadn't understood how many humans would be looking.
Ecovacs, 2024. Over about a week in May, people in Minnesota, Los Angeles, and El Paso had their Deebot X2 vacuums taken over by somebody else. The attacker drove the robot, watched through the camera, and shouted racial slurs through its speaker. One of them chased a dog. Two researchers, Dennis Giese and Braelynn Luedtke, had warned Ecovacs about serious flaws back in December 2023, months before any of this happened. They laid the details out publicly at DEF CON that August. One of them was a four-digit PIN for the camera feed that got checked by the app instead of the server, which makes it no lock at all. Ecovacs first told reporters it wouldn't fix the problems, then said it would, and blamed the May takeovers on reused passwords.
DJI, February 2026. A software engineer trying to steer his DJI ROMO with a PlayStation controller found he could reach about 7,000 of them across 24 countries. DJI shipped an automatic patch within days and paid him a $30,000 bounty. Same class of mistake as Shark's, opposite response, which is why the silence from SharkNinja stands out.
The one that didn't happen. In 2020, researchers from Singapore and the University of Maryland turned a robot vacuum's LiDAR into a crude microphone by bouncing the laser off a trash can and reading the vibrations. It works. It also takes modified firmware, a cooperative object, and lab conditions. Nobody has been eavesdropped on this way. It gets written up as if your vacuum is listening to you, but it isn't.
What the risk really is
Four ways the map of your house ends up somewhere you didn't put it. Ranked by how often each one has actually happened to people, not by what makes a good headline.
- The company keeps it, because you agreed to that. This one isn't a maybe. It's happening in every connected vacuum, today, legally, and it's the reason the other three exist at all. There's no map to steal if nobody stored one.
- The company loses it. Shark, DJI, Ecovacs. This is where the real damage lives, because one mistake by one vendor exposes everybody at once and there's nothing you can do from your end. It's the same shape as any other breach notice you've gotten, except the file has your floor plan in it.
- Somebody breaks into your vacuum specifically. Real, and rarer. Those three Ecovacs households are the proof it happens.
- Somebody turns the laser into a microphone. Interesting. Not a real problem.
The top two are the same problem wearing different hats, and neither one gets fixed by anything you can do in the app.
What helps
Skip the account if the machine will run without it. Most of these will vacuum on a button press. You give up scheduling and mapping. You also give up the entire attack surface.
Turn the camera off, and unlink the voice assistant you never use. On models that have a camera, leave remote viewing off unless you're using it that minute.
Delete the map and factory reset before you sell it or give it away. A used robot vacuum with a live account attached is the floor plan of your old house, handed to a stranger.
Be skeptical about deleting a map in the app. Not one of the big manufacturers publishes a straight answer about whether that removes the copy on their servers. The documented way to get your data off their systems is deleting your account with them, and that can take about a month. Tapping "delete map" and assuming it's gone is the theater option.
Put it on the guest network if your router has one and you're comfortable poking around in there. Then a compromised vacuum is looking at an empty room instead of your computers.
Keep the firmware updated, with one caveat. It closes bugs in the machine. It would have done nothing about the Shark flaw, because that mistake lives on Shark's servers, not on your vacuum. Updating is good hygiene. It's not a shield against the flaw in the news this week. And if you did unplug your Shark, remember that firmware updates need Wi-Fi. Reconnect it long enough to update once there's word of a fix, then decide whether it stays on.
If you're shopping
I'm not going to point you at a model. I own one robot vacuum, I keep it off Wi-Fi, and that makes me the wrong person to tell you which one to buy.
The questions are short, though. Does it have a camera? Does it need an account and an internet connection to do the basic job? Does the maker say where the map is stored, and does the privacy policy agree with the marketing? Anything sold on pet monitoring, video calls, or AI obstacle recognition has a lens in it, and that lens ends up wherever the company's security is on its worst day.
A vacuum with no camera can't show anyone your living room. A vacuum with no Wi-Fi can't hand anyone your floor plan. Everything past that is a tradeoff you're making on purpose, which is fine, as long as you know you're making it.
What I do
Mine isn't on Wi-Fi. No app, no map, no schedule. When I want it to do something I pick it up, set it in the room, and press the button.
I'll admit that's partly because it isn't a very good vacuum. I still use a regular one. The robot's whole job is getting under the beds, and it doesn't need the layout of my house to do that.
So that's the question to sit down with. How much of your house does the thing need to know to do the job you actually bought it for? For most of us it's less than it's currently recording.
Sources
- tokay0, "No Shark is Safe: Millions of Shark Vacuums are Vulnerable to RCE" (the original disclosure, July 13, 2026)
- The Hacker News on the unpatched Shark flaw, July 2026
- Malwarebytes, "Shark vacuum flaw exposes cameras, home maps and Wi-Fi passwords", July 2026
- Tom's Hardware on the Shark disclosure timeline and SharkNinja's response, July 2026
- MIT Technology Review, "A Roomba recorded a woman on the toilet. How did screenshots end up on Facebook?", December 19, 2022, and the follow-up on what the testers thought they agreed to, January 10, 2023
- ABC News (Australia), "We hacked a robot vacuum, and could watch live through its camera", October 4, 2024
- Tom's Hardware on the DJI ROMO exposure (first reported by The Verge), February 2026, and DroneDJ on DJI's fix and the bounty, March 2026
- Sami, Dai, Tan, Roy and Han, "Spying with Your Robot Vacuum Cleaner: Eavesdropping via Lidar Sensors", SenSys 2020
