Hobby-Programmierer erschafft versehentlich eine Armee von Vakuumrobotern

> What makes this different from a conventional security discovery is how it happened. Azdoufal used Claude Code to decompile DJI’s mobile app, understand its protocol, extract his own authentication token, and build a custom client.

–

> The technical failure was almost comically basic. DJI’s MQTT message broker had no topic-level access controls. Once you authenticated with a single device token, you could see traffic from others device in plaintext.

Disappointed, but unsurprised, that this is literally all it took.

As if I needed another reason to avoid DJI products.

There’s a ‘Love, Death, and Robots’ episode about this.

This title blows. Where’s my coded robot vacuum army to clean up this dusty town?