Robot vacuums hit a security wall, open‑source offers a way out

A $2,500 robot vacuum can be turned into a remote webcam

Sean Kelly bought an Ecovacs Deebot X2, the company’s flagship model that retails for $2,500, hoping for top‑tier security. Within weeks of a December 2023 warning, security researcher Dennis Giese proved the device could be commandeered over Bluetooth from up to 140 metres away. He sent a payload that gave him full access to the onboard computer, Wi‑Fi credentials, logs, and—crucially—the camera and microphone nodes. The hack streamed live video of Kelly’s office kitchen without any warning sound from the Ecovacs app.

The breach shows that even premium robot vacuums can act as hidden webcams. Kelly described the experience as “like having a webcam that can roll around your house and look at your family.” Ecovacs, the world’s largest home‑robotics company, has not released a fix despite the public disclosure, leaving thousands of Australian households and countless users worldwide exposed.

Open‑source projects aim to reclaim control

While commercial vendors stumble, the maker community is building alternatives that run entirely locally. OOMWOO is an open‑hardware, open‑software robot vacuum that can be assembled from a Raspberry Pi 5 (4 GB), a 2D LiDAR, and 3D‑printed parts. Its creator estimates a $100‑$200 parts budget for a prototype, with a fully‑featured build targeting $500‑$600. The project publishes every CAD file, firmware, and ROS 2‑based navigation stack on GitHub, and even offers a convenience kit for those who prefer not to hunt for individual components.

Parallel to hardware, Valetudo provides a cloud‑free firmware layer for thousands of existing robot vacuums. Started in 2018, the Apache‑2.0‑licensed code replaces vendor‑locked cloud services with a local‑only operation mode. Its maintainer, Sören Beye, estimates a few thousand active users based on download counts and community forums. Valetudo lets owners inspect and modify robot behavior without relying on a manufacturer’s telemetry pipeline.

Both projects share a common philosophy: give users full visibility and the ability to patch security holes themselves. Unlike Ecovacs, where the firmware is opaque and updates are controlled by a distant corporate team, OOMWOO and Valetudo expose the entire software stack, making independent security audits feasible.

Dyson finally unveils a robot after a 16‑year odyssey

Dyson’s robot vacuum, long rumored since a 2001 prototype called DC06, finally entered the market at a Tokyo launch. The company spent 16 years iterating on sensors, motors, and battery chemistry before settling on a design that pairs a digital motor—the same one used in Dyson’s stick vacuums—with a panoramic lens that captures a 45‑degree field of view. The lens feeds visual data into a processor that triangulates room geometry 30 times per second, enabling the robot to locate its dock and navigate complex layouts.

Dyson claims the unit delivers 100 times the suction power of a Roomba model, thanks to the high‑speed motor and a brush bar that fits through narrow gaps. The robot’s 85 sensors and lightweight chassis address the bulk issues that doomed the earlier DC06 trials, which were deemed too heavy and pricey for home use in 2012. By launching first in Japan, Dyson signals confidence in a market that values premium home‑automation gear, while sidestepping the slower‑adopting UK market that initially rejected the concept.

The market’s forked path: premium lock‑ins versus DIY freedom

The Ecovacs hack, OOMWOO’s parts list, Valetudo’s codebase, and Dyson’s high‑end launch illustrate a widening split in the robot‑vacuum ecosystem. On one side, manufacturers bundle convenience with proprietary clouds, creating a black‑box that can be exploited, as the Deebot X2 case demonstrates. On the other side, a growing cohort of engineers and hobbyists is assembling “local‑first” vacuums that run on open standards like ROS 2 and Home Assistant.

For engineers who already manage Home Assistant instances, Valetudo offers a drop‑in replacement that eliminates outbound telemetry. For makers who enjoy soldering and 3D printing, OOMWOO provides a sandbox for testing navigation algorithms without waiting for a commercial release. Both approaches reduce reliance on vendor firmware updates—a critical factor when security patches are delayed or absent.

Dyson’s entry complicates the calculus. Its premium price point and sophisticated sensor suite will appeal to users who prefer a turnkey solution and are willing to pay for brand cachet. Yet the same users may also worry about the closed nature of the software stack, especially after the Ecovacs incident. The market now forces a choice: accept a sealed, high‑performance device with unknown privacy guarantees, or invest time and money into a DIY build that guarantees transparency but demands technical competence.

What to watch next

The next few months will reveal whether Ecovacs issues a firmware patch that closes the Bluetooth backdoor, and whether other major brands—iRobot, Roborock, and emerging Chinese players—follow suit with similar security disclosures. Keep an eye on the Valetudo GitHub for a potential surge in pull requests that add support for newer robot models, and watch the OOMWOO community for its first fully‑functional hardware release, which is slated for late 2026 according to the project’s roadmap. Finally, monitor Dyson’s sales figures in Japan; early adoption rates will indicate whether consumers are willing to trade openness for premium performance. The tension between security, openness, and convenience will shape the next generation of household robots.