Roger Linn is a legend in the world of musical instruments. He’s been at the cutting edge of music technology for decades. He created the LM-1, the first drum machine to use samples, and its successor, the LinnDrum, is one of the most iconic drum machines of all time. They were used on countless records in the 1980s, including hits by Tom Petty, Queen, and Tears for Fears. But the most notable fan was probably Prince, who used them extensively on Purple Rain and 1999.
Technology
Google Fast Pair flaw lets hackers hijack headphones
NEWYou can now listen to Fox News articles!
Google designed Fast Pair to make Bluetooth connections fast and effortless. One tap replaces menus, codes and manual pairing. That convenience now comes with serious risk. Security researchers at KU Leuven uncovered flaws in Google’s Fast Pair protocol that allows silent device takeovers. They named the attack method WhisperPair. An attacker nearby can connect to headphones, earbuds or speakers without the owner knowing. In some cases, the attacker can also track the user’s location. Even more concerning, victims do not need to use Android or own any Google products. iPhone users are also affected.
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.
APPLE WARNS MILLIONS OF IPHONES ARE EXPOSED TO ATTACK
Fast Pair makes connecting Bluetooth headphones quick, but researchers found that some devices accept new pairings without proper authorization. (Kurt “CyberGuy” Knutsson)
What WhisperPair is and how it hijacks Bluetooth devices
Fast Pair works by broadcasting a device’s identity to nearby phones and computers. That shortcut speeds up pairing. Researchers found that many devices ignore a key rule. They still accept new pairings while already connected. That opens the door to abuse.
Within Bluetooth range, an attacker can silently pair with a device in about 10 to 15 seconds. Once connected, they can interrupt calls, inject audio or activate microphones. The attack does not require specialized hardware and can be carried out using a standard phone, laptop, or low-cost device like a Raspberry Pi. According to the researchers, the attacker effectively becomes the device owner.
Audio brands affected by the Fast Pair vulnerability
The researchers tested 17 Fast Pair compatible devices from major brands, including Sony, Jabra, JBL, Marshall, Xiaomi, Nothing, OnePlus, Soundcore, Logitech and Google. Most of these products passed Google certification testing. That detail raises uncomfortable questions about how security checks are performed.
How headphones can become tracking devices
Some affected models create an even bigger privacy issue. Certain Google and Sony devices integrate with Find Hub, which uses nearby devices to estimate location. If a headset has never been linked to a Google account, an attacker can claim it first. That allows continuous tracking of the user’s movements. If the victim later receives a tracking alert, it may appear to reference their own device. That makes the warning easy to dismiss as an error.
GOOGLE NEST STILL SENDS DATA AFTER REMOTE CONTROL CUTOFF, RESEARCHER FINDS
Attacker’s dashboard with location from the Find Hub network. (KU Leuven)
Why many Fast Pair devices may stay vulnerable
There is another problem most users never consider. Headphones and speakers require firmware updates. Those updates usually arrive through brand-specific apps that many people never install. If you never download the app, you never see the update. That means vulnerable devices could remain exposed for months or even years.
The only way to fix this vulnerability is by installing a software update issued by the device manufacturer. While many companies have released patches, updates may not yet be available for every affected model. Users should check directly with the manufacturer to confirm whether a security update exists for their specific device.
Why convenience keeps creating security gaps
Bluetooth itself was not the problem. The flaw lives in the convenience layer built on top of it. Fast Pair prioritized speed over strict ownership enforcement. Researchers argue that pairing should require cryptographic proof of ownership. Without it, convenience features become attack surfaces. Security and ease of use do not have to conflict. But they must be designed together.
Google responds to the Fast Pair WhisperPair security flaws
Google says it has been working with researchers to address the WhisperPair vulnerabilities and began sending recommended patches to headphone manufacturers in early September. Google also confirmed that its own Pixel headphones are now patched.
In a statement to CyberGuy, a Google spokesperson said, “We appreciate collaborating with security researchers through our Vulnerability Rewards Program, which helps keep our users safe. We worked with these researchers to fix these vulnerabilities, and we have not seen evidence of any exploitation outside of this report’s lab setting. As a best security practice, we recommend users check their headphones for the latest firmware updates. We are constantly evaluating and enhancing Fast Pair and Find Hub security.”
Google says the core issue stemmed from some accessory makers not fully following the Fast Pair specification. That specification requires accessories to accept pairing requests only when a user has intentionally placed the device into pairing mode. According to Google, failures to enforce that rule contributed to the audio and microphone risks identified by the researchers.
To reduce the risk going forward, Google says it updated its Fast Pair Validator and certification requirements to explicitly test whether devices properly enforce pairing mode checks. Google also says it provided accessory partners with fixes intended to fully resolve all related issues once applied.
On the location tracking side, Google says it rolled out a server-side fix that prevents accessories from being silently enrolled into the Find Hub network if they have never been paired with an Android device. According to the company, this change addresses the Find Hub tracking risk in that specific scenario across all devices, including Google’s own accessories.
Researchers, however, have raised questions about how quickly patches reach users and how much visibility Google has into real-world abuse that does not involve Google hardware. They also argue that weaknesses in certification allowed flawed implementations to reach the market at scale, suggesting broader systemic issues.
For now, both Google and the researchers agree on one key point. Users must install manufacturer firmware updates to be protected, and availability may vary by device and brand.
SMART HOME HACKING FEARS: WHAT’S REAL AND WHAT’S HYPE
Unwanted tracking notification showing the victim’s own device. (KU Leuven)
How to reduce your risk right now
You cannot disable Fast Pair entirely, but you can lower your exposure.
1) Check if your device is affected
If you use a Bluetooth accessory that supports Google Fast Pair, including wireless earbuds, headphones or speakers, you may be affected. The researchers created a public lookup tool that lets you search for your specific device model and see whether it is vulnerable. Checking your device is a simple first step before deciding what actions to take. Visit whisperpair.eu/vulnerable-devices to see if your device is on the list.
2) Update your audio devices
Install the official app from your headphone or speaker manufacturer. Check for firmware updates and apply them promptly.
3) Avoid pairing in public places
Pair new devices in private spaces. Avoid pairing in airports, cafés or gyms where strangers are nearby.
4) Factory reset if something feels off
Unexpected audio interruptions, strange sounds or dropped connections are warning signs. A factory reset can remove unauthorized pairings, but it does not fix the underlying vulnerability. A firmware update is still required.
5) Turn off Bluetooth when not needed
Bluetooth only needs to be on during active use. Turning off Bluetooth when not in use limits exposure, but it does not eliminate the underlying risk if the device remains unpatched.
6) Reset secondhand devices
Always factory reset used headphones or speakers before pairing them. This removes hidden links and account associations.
7) Take tracking alerts seriously
Investigate Find Hub or Apple tracking alerts, even if they appear to reference your own device.
8) Keep your phone updated
Install operating system updates promptly. Platform patches can block exploit paths even when accessories lag behind.
Kurt’s key takeaways
WhisperPair shows how small shortcuts can lead to large privacy failures. Headphones feel harmless. Yet, they contain microphones, radios and software that need care and updates. Ignoring them leaves a blind spot that attackers are happy to exploit. Staying secure now means paying attention to the devices you once took for granted.
Should companies be allowed to prioritize fast pairing over cryptographic proof of device ownership? Let us know by writing to us at Cyberguy.com
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.
Copyright 2026 CyberGuy.com. All rights reserved.
Somehow, those are not his greatest contributions to the music world. That would, undoubtedly, be the MPC. Linn partnered with Akai to create one of the most popular and important samplers ever. The MPC60 and its successors became the tool of choice for countless hip-hop and house producers. J Dilla’s MPC 3000 even sits in the Smithsonian.
Roger Linn was also an early adopter of MPE, or MIDI polyphonic expression. It’s a key feature of his LinnStrument, an expressive 3D controller released in 2014 — three years before the Association of Musical Electronics Industry (AMEI) officially released the MPE standard. Turns out the man stays so innovative by keeping things simple and focused.
What is your most indispensable tool?
My MacBook Pro.
Which is the most underappreciated?
My Vision Pro. I called it the most amazing product I rarely use.
What is the first app you install on a new phone or computer?
On a computer, Rhino3D.
What is one thing you wish you could change about your phone?
Apple Mail’s bugs.
What sites do you have pinned to your tab bar?
New York Times.
How many tabs do you have open right now?
One. This document.
Which social media platform do you use the most (if any)?
I don’t use social media except to announce my monthly “All Things LinnStrument” email newsletter.
What is your happy place online?
A VR app for the Meta Quest called Walkabout Mini Golf. It was a large number of artistically created open VR worlds that offer a surprising level of beauty from the Quest 3’s limited power. I go there to play a game of mini golf, fly around, or meet friends in a private instance of a particular world.
What is your favorite gadget you’ve ever owned?
I don’t know about “ever”, but these days it’s VR headsets, currently the Meta Quest 3 or Apple Vision Pro.
Which was the most disappointing?
In general, I’m disappointed by products that are designed by engineers who assume their customers are engineers.
What game do you have the fondest memories of?
Myst.
Which tech trend do you wish would go away?
Spam.
What creation are you most proud of?
LinnStrument.
What’s the best piece of advice you’ve ever received?
Keep it simple.
What is your current obsession?
VR.
What do you do when you need to focus?
Breathe. Calm down.
What do you do when you’re feeling stuck?
I try to shift my perspective.
When was the last time you went somewhere without your phone?
I never go anywhere without my phone. Maybe swimming.
What’s the last piece of physical media you bought?
That would be a long time ago. I’ve only bought books, music, films, etc. in digital form for a long time.
What do you think is worth splurging on?
If someone made a VR headset with retina resolution, very high power, lots of beautiful open worlds, but it was expensive, I’d probably buy it.
What would the tagline for your biopic be?
“He created tools that allowed musicians to make better music.”
What’s the last GIF or meme you used?
This isn’t a GIF, but maybe it’s a meme:
( ͡° ͜ʖ ͡°)
Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.
NEWYou can now listen to Fox News articles!
A robot mower sounds like the kind of yard tool that should make life easier. It cuts the grass, saves you time and quietly handles a chore most people would rather avoid.
But a new independent security report raises a bigger concern about what may be happening behind the scenes. Security researcher Andreas Makris says Yarbo robots, which include autonomous lawn mowers and snow blowers, contained serious flaws that could expose owners to remote access, live camera viewing and Wi-Fi credential theft. The report says roughly 6,000 robots are currently affected.
Yarbo has since responded through its Security Center, saying the core technical findings are accurate and that it has started rolling out security fixes. Still, the report raises important questions about how much access smart yard devices should have inside your home network.
Sign up for my FREE CyberGuy Report
- Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
- For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
- Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
SMART HOME HACKING FEARS: WHAT’S REAL AND WHAT’S HYPE
A robot mower connected to home Wi-Fi can create security risks if remote access controls are weak or unclear. (Yarbo)
Yarbo robot security risk: What the report claims
Makris says Yarbo robots ship with a persistent remote access setup that uses a tunnel to reach the robot over the internet. According to the report, the robots also include a hardcoded root password shared across the fleet and a remote connection method tied to the robot’s serial number. That is important because “root” access gives someone deep control over the device. In simple terms, it can mean administrator-level access to the system inside the robot. The report also says the remote tunnel runs automatically, can restart itself if stopped and may return if removed. That raises a major concern for owners because they may not have a simple switch in the app to shut it off.
Why a robot mower could put your home network at risk
Smart devices often need internet access to work. App controls, software updates, diagnostics and support all depend on that connection. However, Makris claims Yarbo’s setup creates a much riskier situation. He says remote access appears to be built into every robot, rather than turned on only when an owner asks for help. The report says an attacker with the right information could potentially reach a robot remotely, access internal functions and use it as a foothold on the owner’s network. So while a robot mower may seem harmless as it cuts grass, rolls through the yard or parks near the garage, that same machine can also connect to your Wi-Fi, carry cameras and sit close to your home every day.
5 WORRISOME PRIVACY CLAUSES HIDDEN IN SMART HOME DEVICES
The Yarbo report raises concerns about remote access, live camera feeds and saved Wi-Fi credentials on connected yard robots. (Yarbo)
Yarbo camera access concerns for homeowners
According to the report, Yarbo robots can have multiple camera feeds. Makris says that if someone gained root access through the remote tunnel, they could potentially view the robot’s surroundings remotely. That could include a driveway, backyard, entryway, garage area or outdoor space where your family spends time. For homeowners, this concern goes beyond a glitch. A camera-equipped device outside your home deserves the same scrutiny as a camera inside your home.
How saved Wi-Fi passwords could be exposed
The report also says an attacker with root access could retrieve saved Wi-Fi credentials from the robot’s system. That would be a serious issue because many homes use one main Wi-Fi network for phones, laptops, tablets, smart TVs, security devices and more. Once someone has your Wi-Fi password, the risk can spread. They may try to reach other connected devices or look for weak spots that were never meant to face the internet. This is why connected outdoor equipment should never get a free pass. A lawn robot may be housed outside or in the garage, but its network access can reach inside.
What Yarbo says now
After Makris published his report, Yarbo posted a response to its Security Center page on its website. The company said the report identified serious vulnerabilities in its remote diagnostic, credential management and data-handling systems. Yarbo co-founder Kenneth Kohlmann also said the “core technical findings are accurate” and acknowledged that the company’s initial response did not reflect the seriousness of the issues.
Yarbo says the problems primarily involved historical design choices in parts of its remote diagnostic, access management and data-handling systems. The company also said some legacy support tools did not give users enough visibility or control. Yarbo said some authentication and credential systems did not meet its current security expectations.
A NEW SECURITY SEAL OF APPROVAL IS COMING TO YOUR SMART HOME GADGETS
Security experts recommend keeping smart yard devices on a guest network instead of your main home Wi-Fi. (Yarbo)
What Yarbo says it has fixed
Yarbo says it has taken several remediation steps since the report was published. According to the company, it has retired historical fleet-level root credentials, revoked shared FRP remote-access credentials and disabled related FRP server-side connection paths.
The company also says updated versions of the Yarbo mobile app no longer contain static credentials or embedded access mechanisms capable of directly authenticating against backend services. Yarbo says it has removed reporting scripts, legacy dependencies and non-essential network configurations that no longer served a necessary product function.
However, Yarbo says more work remains. The company says it is rebuilding its credential management system so any remaining shared-credential models can be replaced with individually scoped, per-device credentials. Each credential would support independent rotation and revocation.
Why Yarbo data connections raise privacy questions
The report also points to connections involving Hanyangtech, Yarbo’s Shenzhen-based parent company, along with ByteDance Feishu, Tencent TDMQ and Chinese DNS resolvers. Makris says some robot telemetry can be sent to ByteDance’s Feishu platform and that certain infrastructure choices are built into the firmware.
Yarbo now says it has removed reporting scripts, legacy dependencies and non-essential network configurations that no longer served a necessary operational or product function. The company also says historical servers and legacy access channels will continue to be phased out as part of its remediation work.
The core issue is transparency. Owners should know where their devices send data, which companies can access it and whether those connections are essential for normal use. That level of clarity matters even more for devices with cameras, location data and access to home networks.
What this means for you
If you own a Yarbo robot, this report means you should treat it like any other connected device with cameras, location data and access to your home Wi-Fi. Yarbo says it is pushing security updates automatically to connected devices. That means owners should connect their Yarbo long enough to receive the latest security update. After that, consider moving it back to a guest network or an isolated smart-device network.
CyberGuy reached out to Yarbo, and a representative said the company encouraged readers to refer to the Security Center at yarbo.com/pages/yarbo-security-center for the latest verified information and ongoing updates.
How Yarbo owners can reduce the risk
You may not be able to control everything happening inside the robot, but you can take a few practical steps to limit what it can reach on your home network.
1) Put the robot on a guest network
Do not keep your robot mower on the same network as your laptop, phone or security cameras. Use a guest network or a separate smart-device network if your router supports it.
2) Change your main Wi-Fi password if you are concerned
If your robot has connected to your main Wi-Fi and you are worried about exposure, change the Wi-Fi password. Use a strong, unique password and store it in a trusted password manager so you do not have to reuse or remember it. Then reconnect only trusted devices. Check out the best expert-reviewed password managers of 2026 at Cyberguy.com
3) Check your router for unknown devices
Open your router app or admin page and review connected devices. Look for anything unfamiliar. Remove devices you do not recognize.
4) Limit what the robot can access
Some routers let you isolate guest devices. Turn that on when available. This can keep the robot from seeing other devices on your network.
5) Ask Yarbo for specific answers
Owners should ask what remote diagnostic access remains, whether credentials are now unique per robot and whether the company will provide a true off switch for remote diagnostics.
6) Keep the robot updated, but stay cautious
Yarbo says security updates are delivered automatically once devices connect to the internet. Connect the robot through a guest network or an isolated smart-device network so it can receive the latest update without giving it access to your main devices.
Join CyberGuy Live: Lock Down Your Phone in 30 Minutes (Saturday, June 13, 10 am ET)
Your phone holds your email, passwords, photos, banking apps and personal data. In this free, live online class, Kurt the CyberGuy will walk you step by step through simple phone security fixes you can do in real time. You’ll learn how to improve your privacy settings, spot the latest phone scams, use trusted security tools and walk away with a simple checklist to stay protected. Register here: CyberGuyLive.com
Kurt’s key takeaways
The Yarbo report is a reminder that convenience can come with hidden access. A robot mower may seem like a helpful yard tool, but under the hood, it can act like a connected computer with cameras, location data and a path into your network. The biggest concern is control. Owners need to know who can reach their devices, when remote access turns on and whether they can shut it off. A company should not expect you to trust a black box sitting on your Wi-Fi. If you own one of these robots, isolate it from your main network and push Yarbo for clear answers. If you are shopping for any smart yard device, ask about security before you ask about battery life.
Would you let a smart yard robot onto your Wi-Fi if the company could not clearly explain who can access it and when? Let us know by writing to us at Cyberguy.com
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Sign up for my FREE CyberGuy Report
- Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
- For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
- Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
Copyright 2026 CyberGuy.com. All rights reserved.
Google’s AI Overviews are running into an interesting problem right now. Earlier on Friday, if you searched for the term “disregard,” the AI Overview section would include a response like what you’d see from a more traditional AI chatbot instead of the typical AI summary, as spotted on X. As you can see in the image at the top of this story, I got an AI Overview response that said, “Got it. If you need anything else or have a new question later, just let me know!”
As of Friday afternoon, however, Google isn’t showing an AI Overview for the term “disregard” at all — instead, it shows a list of news stories about the issue first. Google hasn’t replied to our requests for comment. In a statement to Android Authority, a spokesperson said that “We’re aware that AI Overviews are misinterpreting some action-related queries, and we’re working on a fix, which will roll out soon.”
AI Overviews haven’t just been tripping up over the word “disregard.” When searching for “ignore,” Google’s AI Overview section showed the following message to a Verge colleague:
Message received! I’m here and ready to help. What would you like to focus on today? Just let me know if there’s a specific topic, task, or question you’d like to explore.
When they searched “skip,” the AI Overview section said:
It looks like your message was just a test or a typo! Feel free to ask a question, share a prompt, or let me know how I can help you with your tasks today. I’m ready whenever you are!
As of Friday afternoon, Google is still showing me AI Overviews with broken responses when I search for “ignore” and “skip.”
As funny as this all is, it’s almost certainly just some kind of bug — I expect Google will fix it soon enough. Maybe Google Search itself is tired after everything that happened at Google I/O.
Updates, May 22nd: Google now isn’t showing AI Overviews for “disregard.” Also added a Google statement.
-
News3 minutes agoThe power struggle in the world’s narrow seas
-
World9 minutes ago
At least two killed after massive Russian drone and missile attack on Kyiv
-
News39 minutes agoWhy Kouri Richins jurors decided Utah mom was a killer
-
New York2 hours agoBrooklyn Man Wedged in Upstate New York Cave Is Rescued After 6 Hours
-
Los Angeles, Ca2 hours agoGrandmother hospitalized after hit-and-run slams into her in San Fernando
-
Detroit, MI3 hours ago3 injured in separate weekend shootings in Detroit, police say
-
San Francisco, CA3 hours agoThe Store Cats of San Francisco
-
Dallas, TX3 hours agoFC Dallas vs Colorado Rapids: Lineup notes 📝
