This is f*cking creepy. I pointed Claude Code at our robot vacuum's app for one evening
it doesn't just clean the flat. it draws it. every room, where the beds stand, which door is the bathroom, and it sends that drawing somewhere after every single clean
here's where it goes and 5 fixes:
what Claude found in one read-only pass over the app:
> a full floor plan uploads after every run, not once
> the map sits next to our Wi-Fi name, so it's not "a map" anymore, it's our address
> the camera has a remote view mode that works from anywhere, behind a 4-digit PIN
> 3 trackers keep pinging while the vacuum sleeps on the dock
> the vacuum shares one Wi-Fi with my laptop, so the weakest device sees all the others
and this isn't paranoia:
- 2022: photos taken by Roomba test units, one of a woman on the toilet, ended up in private Facebook groups
- 2024: strangers took over Ecovacs vacuums across the US, watched the live camera and shouted insults at families through the speaker
how to fix yours tonight:
1. app settings → turn off remote camera, video call and voice features you don't use
2. delete saved maps you don't need
3. move the vacuum to a guest Wi-Fi, away from your phone and laptop
4. give the vacuum app a password you use nowhere else
5. Roborock or Dreame? Valetudo on GitHub runs the robot with zero cloud. the map never leaves your flat
the prompt I used, paste it into Claude Code next to the app's APK:
"Audit my own robot vacuum's Android app. Read-only. Decompile the APK and list every server it talks to, everything it uploads (maps, images, audio, Wi-Fi info), every tracker SDK and every permission. Show the file behind each finding. Then give me the 5 settings to change first."
save this before the next clean. the article below runs the same check on phones and Macs, your vacuum is the one nobody checks