In short: A security researcher known as tokay0 showed that a single Shark robot vacuum can be turned into a master key for hundreds of thousands of others. A client certificate pulled from one device let him run root-level commands on other Shark vacuums in the same Amazon cloud region — exposing live camera feeds, saved house maps and plaintext Wi-Fi passwords. Of about 1.5 million devices he surveyed, roughly 44% carried the vulnerable component. As of late July 2026 there is no patch and no CVE. The practical defenses: isolate smart gadgets on a separate network and keep firmware updated.
What happened
In July 2026 tokay0 published a detailed teardown of SharkNinja's robot vacuums and their cloud backend. He opened his own vacuum with an ordinary screwdriver, connected to the UART pins on the board and dropped into a U-Boot console that required no password. From there he extracted the device's client certificate — the cryptographic ID it uses to talk to the manufacturer's servers on Amazon Web Services (AWS).
That certificate turned out to be far more powerful than it should be. The same device-side risk keeps recurring across smart-home gear: we saw it in a botnet built from hijacked home devices and in unpatched flaws in embedded gadgets. If you want the basics of why network privacy matters at home, start with our blog.
How the attack works
The core problem was a misconfigured access policy in AWS IoT. Instead of allowing a vacuum to publish messages only to its own topic, the policy let one certificate send commands to the topics of all devices ($aws/things/*). On the vacuum, a daemon called appd took the contents of one such message field and passed it straight to a function that executed any command shorter than 1000 bytes through the system shell. Chain those two mistakes together and one extracted certificate becomes remote root code execution on other people's vacuums in the same cloud region.
The numbers show the scale. In a single AWS region tokay0 counted 1,517,605 unique serial numbers, of which 673,816 — about 44% — still carried the vulnerable command handler. This is a textbook example of how one cloud misconfiguration, not a super-sophisticated exploit, can put a whole product line at risk.
What an attacker could reach
Root access to a camera-equipped robot that roams your home is exactly as invasive as it sounds. According to the research, an attacker in this position could pull the vacuum's real-time video stream, read the saved floor map that reveals your home's layout and which rooms you use most, retrieve the Wi-Fi password stored in plaintext, and drive the robot around at will. A leaked Wi-Fi password is a springboard: it can expose every other device on your network.
The takeaway for your data is uncomfortable but simple. A smart gadget you bought for convenience can quietly become the weakest point in your home — a camera, a microphone and a network foothold rolled into one.
Why isn't it fixed yet?
According to tokay0's timeline, he reported the issue to SharkNinja on 12 March 2026. The company acknowledged receipt, said on 27 April that the matter was under review, and on 3 July promised to name a fix date by 10 July — a deadline that passed with nothing published. He filed for a CVE identifier with MITRE in June. As of his disclosure in mid-to-late July 2026 there was still no patch and no assigned CVE, and the researcher says the vendor downplayed the severity and questioned whether a CVE was even warranted — despite its own published disclosure policy. In short: owners cannot simply "install the update," because there isn't one yet.
What it means for your privacy
You do not need to panic and throw out your vacuum, but this is a good moment to treat every smart device as a small computer that can be attacked. The threat here did not come from the open internet — it came from a design flaw plus a cloud misconfiguration on the vendor's side, which is out of your hands. What is in your hands is limiting the blast radius when a device you own gets compromised.
How to protect your smart home
Isolate smart devices on a separate network. Put IoT gadgets on a guest Wi-Fi network or a separate VLAN, kept apart from your phones and computers. Then a hijacked vacuum cannot easily reach your main devices or the data on them.
Keep firmware updated — and watch for a fix. When SharkNinja finally ships a patch, install it immediately. In general, apply firmware updates only from the official app and retire devices the maker has abandoned.
Change your Wi-Fi password if you own an affected model. Since the password could be read in plaintext, rotating it — and using a strong, unique one — closes that specific door.
Protect the network layer. To be honest, a VPN cannot patch a flaw inside a vacuum's firmware — that is a different layer of defense. But a VPN like LiMP VPN encrypts your own traffic on untrusted networks and hides your real IP, reducing tracking and exposure when your phone and laptop talk to the internet. See how it works on our features page.
Sources
This report is based on coverage by Russian-language Xakep and CNews, and the original disclosure reported via Malwarebytes (July 2026).