Connect with us

Technology

The best trackers for finding your stuff

Published

on

The best trackers for finding your stuff

Some people rarely lose things. Wallets are always exactly where they’re supposed to be, keys never go missing, and remotes never slip between the couch cushions. And then there’s the rest of us — the folks who can’t ever seem to find the thing that was right there a few seconds ago. For us, there are Bluetooth trackers.

Bluetooth trackers have been around for a long time, and they all generally work the same way. You stick the tracker onto an object, pair it with your phone, and then, when you lose said object, you can go into an app and ring the tracker. But these days, Bluetooth trackers can do a lot more. Some have ultra-wideband chips that enable precision tracking, so you can find exactly where in a room your item is. Others tap into large networks that make it easier to find lost items outside the home. Many will notify you if they detect you’ve left the device behind or come with QR codes that link to your contact information so people can easily return lost devices.

These features are incredibly handy but also have the potential for misuse. Take AirTags. When Apple launched the trackers, it hadn’t anticipated they’d be used to track people or stolen items — but that’s exactly what happened. It’s since beefed up its anti-stalking features, and companies like Tile have also followed suit. The good news is that Apple and Google recently announced they’re working together to create a standard that enables unwanted tracking alerts across both Android and iOS devices — and major players like Tile, Samsung, and Chipolo are on board. But until this standard is up and running, it pays to be aware of each tracker’s current approach when you’re deciding the best option for you.

As a consummate Loser of Things, I’ve tested my fair share of Bluetooth trackers on wallets, keys, and luggage. Here’s what I’d recommend if you, too, have a hard time finding things.

AirTags: best tracker for iPhone users

An AirTag in an Apple keychain accessoryAn AirTag in an Apple keychain accessoryAn AirTag in an Apple keychain accessory

Apple’s AirTags can help you find your lost items with their ultra wideband technology. You’ll get the best compatibility with an iPhone, though Apple released an Android app that can detect an AirTag’s location and notify you if one seems to be following you.

Advertisement

When Apple launched AirTags in 2021, it really did shake up the category. That’s because AirTags are equipped with Apple’s Ultra Wideband (UWB) chip and tap into Apple’s vast Find My network. That’s a potent combo.

Basically, UWB enables precision tracking while Find My compatibility expands range far, far beyond Bluetooth’s limitations. With precision tracking, all you have to do is open the Find My app, tap “Find,” and you should see an arrow pointing you in the exact direction you need to go to find your item. Using the Find My network also means that so long as there’s an Apple device nearby, a lost AirTag can ping its location to Apple’s iCloud servers without notifying the owners of those other devices. And there are over a billion Apple products out there.

That accuracy is super convenient. My keys fell out of my pocket while running once, and I didn’t notice until my phone pinged me to say my keys were no longer with me. While I wasn’t able to use the precision tracking outdoors, I could see the last reported location in the Find My app. Twenty minutes had already passed, but I still was able to find my keys. I haven’t had that degree of success with any other item tracker.

AirTags come with UWB-powered precision tracking.
Photo by Vjeran Pavic / The Verge

However, this accuracy is a double-edged sword. In 2022, I ran a test to see whether I could track a friend and my spouse (with their consent) in real time. And I could, to a disturbing degree. While Apple’s unwanted tracking prevention measures worked, there were also inherent flaws. (You can read about our testing in full here.) However, Apple has since improved unwanted tracking alerts by shortening the time before you’re notified an unknown AirTag is in your vicinity, making chimes louder, and creating a separate app that lets Android users scan for unknown AirTags. Apple also now informs users during setup that unwanted tracking is a crime and that AirTags are “intended solely to track items that belong to you.”

Advertisement

Apple has also added more ways to share AirTag locations with trusted people. iOS 17 introduced AirTag sharing, which means shared items won’t trigger unwanted tracking alerts. In iOS 18.2, you can now share the location of a lost AirTag with other people via a temporary link. So if an airline loses your luggage, you can send them a link that shows them an interactive map of your item’s last known location. (Apple is partnering with over 15 airlines for this particular use case.)

The only thing I really don’t like about AirTags is they aren’t truly $29. They’re $29 plus the cost of whatever accessory is needed to attach them to the item you want to track. For example, you’ll need a holder to attach it to your keys or luggage. Thankfully, there’s a robust third-party accessory market, so you don’t have to pay Apple’s prices if you don’t want to. The fact that you can easily replace the battery with a regular CR2032 coin cell battery helps take the sting out, too. I just did it for two of my AirTags, and it was much, much cheaper than having to buy two new ones.

Tile: best Bluetooth tracker for Android users

Colorful Tile Pro hanging from a key ring on a hookColorful Tile Pro hanging from a key ring on a hookColorful Tile Pro hanging from a key ring on a hookColorful Tile Pro hanging from a key ring on a hook

The Tile Pro is the company’s loudest Bluetooth tracker and has the widest range at 400 feet. It also has a user-replaceable battery, unlike other Tiles.

For Android users (or households with both iOS and Android), a Tile tracker is your best bet. Not only are they platform-agnostic but they’re also much more versatile than AirTags because you can choose from four different shapes. The $24.99 Tile Mate is the OG and is a square tracker with a hole so you can stick it on a key ring or carabiner. The $34.99 Tile Pro is a bit larger and shaped like a key fob; it can also be attached to other items in the same way as the Mate. The $34.99 Tile Slim is card-shaped, so it can fit in your wallet, and the $29.99 Tile Sticker is a small disc that comes with a sticky backing so you can put it on remotes, pet collars, and anything else you can stick it on. Like AirTags, Tile devices can tap into a larger network — in this case, Amazon Sidewalk — to help you find your devices outside of your phone’s Bluetooth range.

Advertisement

The best Tile will depend on what you’re looking to track. The Slim, for example, is the best option if you’re constantly losing your wallet, while the Mate is probably the most versatile. My personal pick, however, is the Tile Pro. Of the four, it has the longest Bluetooth range at 500 feet and the loudest ring. It’s also the only one that has a replaceable one-year CR2032 battery. The Mate and Slim have a 350 foot range, while the Sticker has a 250 foot range. All three have a three-year built-in battery. That means after three years, you’ll most likely have to buy a whole new device.

Functionally, Tile trackers can do just about anything an AirTag can — minus precision tracking, as there still isn’t a Tile with UWB capability yet. The company announced one back in 2021, but we’re still waiting, partly because Apple is effectively blocking UWB compatibility for third parties in iOS and because Tile’s priorities shifted once it was acquired by Life360.

Since Life360 took over, Tile trackers have gotten a bit of a refresh. They now integrate with Life360’s SOS services. When you press them three times, it triggers an alert that gets sent to your emergency contacts. You can also designate people as being in your Circle. Those folks then have permission to see where Tile items are on a Life360 map, as well as ring nearby items like remotes.

If you’re a Samsung Galaxy phone user, the $29.99 Samsung SmartTag2 does get you UWB tracking and can tap into the Galaxy Find network, which operates similarly to Apple’s Find My network. It’s a great alternative but isn’t our overall pick for Android because it’s limited to Samsung Galaxy users. But for Samsung users, the latest SmartTag2 includes an improved Compass View, longer battery life, and a better app experience. It’s also got a newer oblong design with a larger key ring than the original SmartTag.

The back of the Tile Pro now has a QR code. If you find a Tile, you can scan the code to see the owner’s contact information so you can return it.
Photo by Victoria Song / The Verge
Advertisement

All Tile trackers can tap into both the Tile Network — all phones with the Tile app installed — and Amazon Sidewalk. It’s not as extensive a network as Apple’s, but Sidewalk’s reach has improved significantly. It’s much easier now to view a Tile tracker’s location history, though you still can’t really track an item in real time.

For anti-stalking measures, Tile has a “Scan and Secure” feature, which allows you to use the Tile app to scan for unknown Tile devices in your vicinity. While better than nothing, it’s a flawed measure, as it requires the potential victim to proactively scan their surroundings. Tiles may be the better pick, however, if you want to track a stolen item. The company just rolled out a new anti-theft feature, which renders Tile devices invisible to unwanted tracking detection in the event someone steals your item. Just know that to use it, Tile requires you to submit a government ID for verification, agree to Tile working with law enforcement without a subpoena, and consent to a $1 million fine if you misuse this feature.

My gripe with Tile is it puts its best features behind a $29.99 annual fee — though new members get a one-year free trial. Those features include alerts for when you leave a Tile behind, 30-day location history, unlimited sharing with friends and family, free replacements for damaged Tiles, and a $100 reimbursement if any of your Tile devices can’t be found. The plus side is you only have to pay one subscription for all your Tile devices. Without a subscription, you can still find your Tile within Bluetooth range, see its last known location on a map if outside Bluetooth range, ring your phone from the Tile, and share Tiles with one other person.

If you’re not keen on either Tile or Samsung, there’s good news. Earlier this year, Google finally launched its Find My Device network. It works similarly to Apple’s Find My network: you’ll be able to share trackers with family members, and there are also unwanted tracking alerts. Third-party makers like Chipolo and Pebblebee have since put out compatible trackers, and more are expected. We’re still in the process of testing how well the Find My Device network works, so stay tuned.

Best AirTag and Tile alternative

Advertisement

$30

The Pebblebee Clip supports Apple’s Find My network but also has a 500-foot Bluetooth range, LEDs that flash to help you locate it, and a rechargeable battery that lasts up to 12 months on a single charge.

If you’re looking for an AirTag or Tile alternative, the Pebblebee Clip is an excellent choice. It’s compatible with Apple’s Find My network, but it can also work with the Pebblebee app so Android users aren’t left out. The company has a version compatible with Google’s Find My Device network.

The thing I like best about the Pebblebee Clip is its rechargeable battery. A single charge lasts up to six months — though you may get longer than that depending on your usage. I’ve been using mine for about three months as of this writing, and I’m only down to 85 percent. It has a USB-C port so you don’t have to sweat it if you lose the charger it comes with. You love to see it.

The Pebblebee Clip also has an LED strip at the bottom that lights up when you ring the tracker. That’s helped me spot my car keys more quickly when they’ve fallen under the car seat or other dark areas. The ringtone is also quite loud, and the 500-foot Bluetooth range is actually about 100 feet more than the Tile Pro, our pick for Android users. Unlike AirTags, the Pebblebee Clip also comes with a snap-on key ring so you don’t have to buy another accessory to attach it. It’s also IPX6-rated for water resistance.

Advertisement

The Pebblebee Clip is much larger than an AirTag, but at least it comes with a snap-on key ring so you don’t have to buy an additional accessory.
Photo by Victoria Song / The Verge

For iOS users, setup with Find My is easy as pie. However, it’s not hard to set up with the Pebblebee app, either — and there are good reasons why you might want to opt for that instead of Find My. (You can’t use both at the same time.) For example, if you want to share the tracker between family members on different platforms, you’ll have to use the Pebblebee app since Find My is limited to iOS.

The Pebblebee app has more customizable geofencing features than Find My. You can set up custom areas on a map and be notified whenever a device enters or leaves the area — which may be useful if you want to use this as a pet tracker. You can also designate safe zones so you don’t get unnecessary alerts that something’s been left behind when you’re in a known location like your home or office. Pebblebee also allows you to set voice tags so you can ask Alexa or Google Assistant to help find your device. It doesn’t have precision finding, though there is a similar window that pops up that lets you know whether you’re distant, nearby, or very close to the item you’re looking for.

If you lose a Pebblebee, you can mark it as lost. The Pebblebee app also has a Crowd GPS network, which functions similarly to the Tile Network. It’s not going to be as robust as Apple’s Find My network, however, simply because there aren’t as many Pebblebee users in the world.

It’s not a perfect tracker. It’s bigger than an AirTag, and I had an easier time ringing the tracker when using it with Find My than with the Pebblebee app. As for unwanted tracking, Pebblebee isn’t the best on its own. You can only get alerts for unwanted tracking if you’re using it with Find My (or Find My Device whenever it launches), not if you’re using it with the Pebblebee app. Pebblebee’s site says you can, at the very least, disable the tracker without resetting it if you find one on you — meaning it’s still possible to figure out who put it on you if you choose to go to the authorities. Still, that’s not the most comforting.

Advertisement

Best AirTag alternatives for wallets

$29

The Pebblebee Card has a rechargeable battery that lasts for up to 12 months. It supports Find My, but you can also use the Pebblebee app instead for geofencing, voice tagging, and cross-platform sharing.

You could be like my spouse, who stuffs an AirTag in their bifold wallet and then makes a surprised Pikachu face every time it falls out. Or, you could opt for a Find My-compatible alternative specifically designed for wallets like the $35 Chipolo Card Spot, the $29.99 Eufy Security SmartTrack Card, or the $29.99 Pebblebee Card. None come with precision tracking because they lack UWB, but they make up for it with super loud ringtones. As part of the Find My network, they also support unwanted tracking alerts. You could also opt for the Tile Slim, though that won’t leverage the Find My network.

The Pebblebee Card is the one I’d recommend for most people. First off, it has a rechargeable battery and lasts up to 12 months on a single charge. Like the Pebblebee Clip, the Pebblebee app supports geofencing, sharing, left-behind alerts, and voice tagging. You could also choose to use it with Find My alone and get the benefits of that network plus a louder ringtone. You can also press it to help find your phone. The only thing I don’t love is that it uses a proprietary charger — so you’ll have to keep it in a safe place.

Advertisement
Eufy SmartTrack Card on top of a colorful notebookEufy SmartTrack Card on top of a colorful notebookEufy SmartTrack Card on top of a colorful notebookEufy SmartTrack Card on top of a colorful notebook

The Eufy Security SmartTrack Card works with Apple’s Find My network, comes with a clip, lets you know when you’ve left it behind, and can ring your phone even if it’s in silent mode.

  • The Eufy SmartTrack Card is another versatile pick. It comes with a little clip attachment so it doesn’t have to be stuffed in your wallet. You could clip it onto a laptop case, for example. This also has the same benefits when used with the Find My network as the Pebblebee Card. On the back, there’s also a QR code — similar to the ones Tile uses — that helps good samaritans return your item to you. Like the Pebblebee Card, you can share it with multiple people if you set it up via the Eufy Security app. The bummer here is it doesn’t work with Android, lacks a replaceable battery, and isn’t rechargeable like Eufy’s new SmartTrack Card E30. That said, though, the built-in battery should purportedly last you three years.

The Chipolo Card Spot is also another good wallet-shaped alternative to AirTags.
Photo by Victoria Song / The Verge

The Chipolo Card Spot or Card Point is also a good option if you want something a bit simpler, though it lacks the QR code, and its battery only lasts two years. If you do opt for Chipolo, double-check that the specific tracker you’re buying works on the network you want to use. For example, the Chipolo Card and Chipolo Card Spot can both be used with iPhones, but the Chipolo Card only works with the Chipolo app, while the Card Spot only works with Find My. The Chipolo Card Point is for Android users, and works with Google’s newly launched Find My Device network.

Read my Chipolo Card Spot review.

Update, January 3rd: Updated prices and availability

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Technology

Jikipedia turns Epstein’s emails into an encyclopedia of his powerful friends

Published

on

Jikipedia turns Epstein’s emails into an encyclopedia of his powerful friends

The folks behind Jmail are at it again with a clone of Wikipedia that turns the treasure trove of data in Epstein’s emails into detailed dossiers on his associates. Entries include known visits to Epstein’s properties, possible knowledge of Epstein’s crimes, and laws that they might have broken. The reports are dense, listing how many emails they exchanged with Epstein, basic biographical information, and details about how they’re connected.

Beyond that, there are entries for the properties Epstein owns, detailing how they were acquired and the alleged activities that took place there. There are also entries for his business dealings, including his relationship with JPMorgan Chase.

It is worth noting that the entries are AI-generated. While a casual glance seems to suggest Jikipedia is citing its sources, it’s still possible (if not likely) that there are some inaccuracies contained within them. The Jmail X account said that they’ll be implementing the ability for users to report inaccuracies and request changes soon.

Continue Reading

Technology

Android malware hidden in fake antivirus app

Published

on

Android malware hidden in fake antivirus app

NEWYou can now listen to Fox News articles!

If you use an Android phone, this deserves your attention. 

Cybersecurity researchers warn that hackers are using Hugging Face, a popular platform for sharing artificial intelligence (AI) tools, to spread dangerous Android malware. 

At first, the threat appears harmless because it is disguised as a fake antivirus app. Then, once you install it, criminals gain direct access to your device. Because of this, the threat stands out as especially troubling. It combines two things people already trust — security apps and AI platforms.

Sign up for my FREE CyberGuy Report

Advertisement

Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

MALICIOUS GOOGLE CHROME EXTENSIONS HIJACK ACCOUNTS

Researchers say hackers hid Android malware inside a fake antivirus app that looked legitimate at first glance.  (Kurt “CyberGuy” Knutsson)

What Hugging Face is and why it matters

For anyone unfamiliar, Hugging Face is an open platform where developers share AI, NLP and machine learning models. It is widely used by researchers and startups and has become a central hub for AI experimentation. That openness is also what attackers exploited. Because Hugging Face allows public repositories and supports many file types, criminals were able to host malicious code in plain sight.

The fake antivirus app behind the attack

The malware first appeared in an Android app called TrustBastion. On the surface, it looks like a helpful security tool. It promises virus protection, phishing defense and malware blocking. In reality, it does the opposite. 

Advertisement

Once installed, TrustBastion immediately claims your phone is infected. It then pressures you to install an update. That update delivers the malicious code. This tactic is known as scareware. It relies on panic and urgency to push users into tapping before thinking.

FAKE ERROR POPUPS ARE SPREADING MALWARE FAST

The fake TrustBastion app mimics a legitimate Google Play update screen to trick users into installing malware.  (Bitdefender)

How the malware spreads and adapts

According to Bitdefender, a global cybersecurity company, the campaign centers on a fake Android security app called TrustBastion. Victims were likely shown ads or warnings claiming their device was infected and were instructed to manually install the app.

The attackers hosted TrustBastion’s APK files directly on Hugging Face, placing them inside public datasets that appeared legitimate at first glance. Once installed, the app immediately prompted users to install a required “update,” which delivered the actual malware.

Advertisement

After researchers reported the malicious repository, it was taken down. However, Bitdefender observed that nearly identical repositories quickly reappeared, with small cosmetic changes but the same malicious behavior. That rapid re-creation made the campaign harder to fully shut down.

What this Android malware can actually do

This Trojan is not minor or annoying. It is invasive. Bitdefender says the malware can:

Take screenshots of your device

Show fake login screens for financial services

Capture your lock screen PIN

Advertisement

Once collected, that data is sent to a third-party server. From there, attackers can move quickly to drain accounts or lock you out of your own phone.

What Google says about the threat

Google says users who stick to official app stores are protected. A Google spokesperson told CyberGuy, “Based on our current detection, no apps containing this malware are found on Google Play.

“Android users are automatically protected against known versions of this malware by Google Play Protect, which is on by default on Android devices with Google Play Services.

“Google Play Protect can warn users or block apps known to exhibit malicious behavior, even when those apps come from sources outside of Play.”

BROWSER EXTENSION MALWARE INFECTED 8.8M USERS IN DARKSPECTRE ATTACK

Advertisement

Once installed, the malware could capture screenshots, fake login details and even your lock screen PIN. (Kurt “CyberGuy” Knutsson)

How to stay safe from Hugging Face Android malware

This threat is a reminder that small choices matter. Here is what you should do right now:

1) Stick to trusted app stores

Only download apps from reputable sources like Google Play Store or the Samsung Galaxy Store. These platforms have moderation and scanning in place.

2) Read reviews before installing

Look closely at ratings, download counts and recent comments. Fake security apps often have vague reviews or sudden rating spikes.

3) Use a data removal service

Even careful users can have personal data exposed. A data removal service helps remove your phone number, email and other details from data broker sites that criminals rely on. That reduces follow-up scams, fake security alerts and account takeover attempts.

Advertisement

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. 

These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

4) Run Play Protect and use strong antivirus software

Scan your device regularly with Play Protect and back it up with strong antivirus software for added protection. Google Play Protect, which is built-in malware protection for Android devices, automatically removes known malware. However, it is important to note that Google Play Protect may not be enough. Historically, it hasn’t been 100% effective at removing all known malware from Android devices.

Advertisement

The best way to protect yourself against malicious links that install malware and potentially access your private information is to have strong antivirus software installed on all your devices. This protection can also help you detect phishing emails and ransomware, keeping your personal information and digital assets safe.

Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com

5) Avoid sideloading APK files

Avoid installing apps from websites outside the app store. These apps bypass security checks, so always verify the publisher name and URL.

6) Lock down your Google account

Your phone security depends on it. Enable two-step verification (2FA) first, then use a strong, unique password stored in a password manager to prevent account takeovers.

Next, see if your email has been exposed in past breaches. Our No. 1 password manager (see Cyberguy.com) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

Advertisement

Check out the best expert-reviewed password managers of 2026 at Cyberguy.com

7) Be cautious with permissions

Be cautious with accessibility permissions. Malware often abuses them to take control of your device.

8) Watch app updates closely

Malware can hide inside fake updates. Be cautious of urgent fixes that push you outside the app store.

Kurt’s key takeaways

This attack shows how quickly trust can be weaponized. A platform designed to advance AI research was repurposed as a delivery system for malware. A fake antivirus app became the threat it claimed to stop. Staying safe no longer means avoiding sketchy-looking apps. It means questioning even those apps that appear helpful and professional.

Have you seen something on your phone that made you question its security? Let us know your thoughts by writing to us at Cyberguy.com

Advertisement

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report 

Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

Copyright 2026 CyberGuy.com.  All rights reserved.

Advertisement
Continue Reading

Technology

The DJI Romo robovac had security so poor, this man remotely accessed thousands of them

Published

on

The DJI Romo robovac had security so poor, this man remotely accessed thousands of them

Sammy Azdoufal claims he wasn’t trying to hack every robot vacuum in the world. He just wanted to remote control his brand-new DJI Romo vacuum with a PS5 gamepad, he tells The Verge, because it sounded fun.

But when his homegrown remote control app started talking to DJI’s servers, it wasn’t just one vacuum cleaner that replied. Roughly 7,000 of them, all around the world, began treating Azdoufal like their boss.

He could remotely control them, and look and listen through their live camera feeds, he tells me, saying he tested that out with a friend. He could watch them map out each room of a house, generating a complete 2D floor plan. He could use any robot’s IP address to find its rough location.

“I found my device was just one in an ocean of devices,” he says.

A map like the one I saw, with robots and packets trickling in.
Image: Gonzague Dambricourt
Advertisement

On Tuesday, when he showed me his level of access in a live demo, I couldn’t believe my eyes. Ten, hundreds, thousands of robots reporting for duty, each phoning home MQTT data packets every three seconds to say: their serial number, which rooms they’re cleaning, what they’ve seen, how far they’ve traveled, when they’re returning to the charger, and the obstacles they encountered along the way.

I watched each of these robots slowly pop into existence on a map of the world. Nine minutes after we began, Azdoufal’s laptop had already cataloged 6,700 DJI devices across 24 different countries and collected over 100,000 of their messages. If you add the company’s DJI Power portable power stations, which also phone home to these same servers, Azdoufal had access to over 10,000 devices.

Azdoufal says he could remote-control robovacs and view live video over the internet.

Azdoufal says he could remote-control robovacs and view live video over the internet.

When I say I couldn’t believe my eyes at first, I mean that literally. Azdoufal leads AI strategy at a vacation rental home company; when he told me he reverse engineered DJI’s protocols using Claude Code, I had to wonder whether AI was hallucinating these robots. So I asked my colleague Thomas Ricker, who just finished reviewing the DJI Romo, to pass us its serial number.

With nothing more than that 14-digit number, Azdoufal could not only pull up our robot, he could correctly see it was cleaning the living room and had 80 percent battery life remaining. Within minutes, I watched the robot generate and transmit an accurate floor plan of my colleague’s house, with the correct shape and size of each room, just by typing some digits into a laptop located in a different country.

Here are two maps of Thomas’ living space. Above is what we pulled from DJI’s servers without authentication; below is what the owner sees on their own phone.
Screenshots by The Verge

Here’s a fuller floor plan from Gonzague Dambricourt, who tried out a read-only version of Azdoufal’s tool.
Image: Gonzague Dambricourt (X)

Separately, Azdoufal pulled up his own DJI Romo’s live video feed, completely bypassing its security PIN, then walked into his living room and waved to the camera while I watched. He also says he shared a limited read-only version of his app with Gonzague Dambricourt, CTO at an IT consulting firm in France; Dambricourt tells me the app let him remotely watch his own DJI Romo’s camera feed before he even paired it.

Advertisement

Azdoufal was able to enable all of this without hacking into DJI’s servers, he claims. “I didn’t infringe any rules, I didn’t bypass, I didn’t crack, brute force, whatever.” He says he simply extracted his own DJI Romo’s private token — the key that tells DJI’s servers that you should have access to your own data — and those servers gave him the data of thousands of other people as well. He shows me that he can access DJI’s pre-production server, as well as the live servers for the US, China, and the EU.

DJI has MQTT servers associated with the US, EU, and China. I’m not sure what VG stands for.

DJI has MQTT servers associated with the US, EU, and China. I’m not sure what VG stands for.
Screenshot by Sean Hollister / The Verge

Here’s the good news: On Tuesday, Azdoufal was not able to take our DJI Romo on a joyride through my colleague’s house, see through its camera, or listen through its microphone. DJI had already restricted that form of access after both Azdoufal and I told the company about the vulnerabilities.

And by Wednesday morning, Azdoufal’s scanner no longer had access to any robots, not even his own. It appears that DJI has plugged the gaping hole.

But this incident raises serious questions about DJI’s security and data practices. It will no doubt be used to help retroactively justify fears that led to the Chinese dronemaker getting largely forced out of the US. If Azdoufal could find these robots without even looking for them, will it protect them against people with intent to do harm? If Claude Code can spit out an app that lets you see into someone’s house, what keeps a DJI employee from doing so? And should a robot vacuum cleaner have a microphone? “It’s so weird to have a microphone on a freaking vacuum,” says Azdoufal.

It doesn’t help that when Azdoufal and The Verge contacted DJI about the issue, the company claimed it had fixed the vulnerability when it was actually only partially resolved.

Advertisement

“DJI can confirm the issue was resolved last week and remediation was already underway prior to public disclosure,” reads part of the original statement provided by DJI spokesperson Daisy Kong. We received that statement on Tuesday morning at 12:28PM ET — about half an hour before Azdoufal showed me thousands of robots, including our review unit, reporting for duty.

Not just robovacs — DJI’s power stations also use this system.

Not just robovacs — DJI’s power stations also use this system.
Screenshot by Sean Hollister / The Verge

To be clear, it’s not surprising that a robot vacuum cleaner with a smartphone app would phone home to the cloud. For better or for worse, users currently expect those apps to work outside of their own homes. Unless you’ve built a tunnel into your own home network, that means relaying the data through cloud servers first.

But people who put a camera into their home expect that data to be protected, both in transit and once it reaches the server. Security professionals should know that — but as soon as Azdoufal connected to DJI’s MQTT servers, everything was visible in cleartext. If DJI has merely cut off one particular way into those servers, that may not be enough to protect them if hackers find another way in.

Unfortunately, DJI is far from the only smart home company that’s let people down on security. Hackers took over Ecovacs robot vacuums to chase pets and yell racist slurs in 2024. In 2025, South Korean government agencies reported that Dreame’s X50 Ultra had a flaw that could let hackers view its camera feed in real time, and that another Ecovacs and a Narwal robovac could let hackers view and steal photos from the devices. (Korea’s own Samsung and LG vacuums received high marks, and a Roborock did fine.)

It’s not just vacuums, of course. I still won’t buy a Wyze camera, despite its new security ideas, because that company tried to sweep a remote access vulnerability under the rug instead of warning its customers. I would find it hard to trust Anker’s Eufy after it lied to us about its security, too. But Anker came clean, and sunlight is a good disinfectant.

Advertisement

DJI is not being exceptionally transparent about what happened here, but it did answer almost all our questions. In a new statement to The Verge via spokesperson Daisy Kong, the company now admits “a backend permission validation issue” that could have theoretically let hackers see live video from its vacuums, and it admits that it didn’t fully patch that issue until after we confirmed that issues were still present.

Here’s that whole statement:

DJI identified a vulnerability affecting DJI Home through internal review in late January and initiated remediation immediately. The issue was addressed through two updates, with an initial patch deployed on February 8 and a follow-up update completed on February 10. The fix was deployed automatically, and no user action is required.

The vulnerability involved a backend permission validation issue affecting MQTT-based communication between the device and the server. While this issue created a theoretical potential for unauthorized access to live video of ROMO device, our investigation confirms that actual occurrences were extremely rare. Nearly all identified activity was linked to independent security researchers testing their own devices for reporting purposes, with only a handful of potential exceptions.

The first patch addressed this vulnerability but had not been applied universally across all service nodes. The second patch re-enabled and restarted the remaining service nodes. This has now been fully resolved, and there is no evidence of broader impact. This was not a transmission encryption issue. ROMO device-to-server communication was not transmitted in cleartext and has always been encrypted using TLS. Data associated with ROMO devices, such as those in Europe, is stored on U.S.-based AWS cloud infrastructure.

DJI maintains strong standards for data privacy and security and has established processes for identifying and addressing potential vulnerabilities. The company has invested in industry-standard encryption and operates a longstanding bug bounty program. We have reviewed the findings and recommendations shared by the independent security researchers who contacted us through that program as part of our standard post-remediation process. DJI will continue to implement additional security enhancements as part of its ongoing efforts.

Advertisement

Azdoufal says that even now, DJI hasn’t fixed all the vulnerabilities he’s found. One of them is the ability to view your own DJI Romo video stream without needing its security pin. Another one is so bad I won’t describe it until DJI has more time to fix it. DJI did not immediately promise to do so.

And both Azdoufal and security researcher Kevin Finisterre tell me it’s not enough for the Romo to send encrypted data to a US server, if anyone inside that server can easily read it afterward. “A server being based in the US in no way, shape, or form prevents .cn DJI employees from access,” Finisterre tells me. That seems evident, as Azdoufal lives in Barcelona and was able to see devices in entirely different regions.

“Once you’re an authenticated client on the MQTT broker, if there are no proper topic-level access controls (ACLs), you can subscribe to wildcard topics (e.g., #) and see all messages from all devices in plaintext at the application layer,” says Azdoufal. “TLS does nothing to prevent this — it only protects the pipe, not what’s inside the pipe from other authorized participants.”

When I tell Azdoufal that some may judge him for not giving DJI much time to resolve the issues before going public, he notes that he didn’t hack anything, didn’t expose sensitive data, and isn’t a security professional. He says he was simply livetweeting everything that happened while trying to control his robot with a PS5 gamepad.

“Yes, I don’t follow the rules, but people stick to the bug bounty program for money. I fucking don’t care, I just want this fixed,” he says. “Following the rules to the end would probably make this breach happen for a way longer time, I think.”

Advertisement

He doesn’t believe that DJI truly discovered these issues by itself back in January, and he’s annoyed the company only ever responded to him robotically in DMs on X, instead of answering his emails.

But he is happy about one thing: He can indeed control his Romo with a PlayStation or Xbox gamepad.

Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.

Continue Reading
Advertisement

Trending