Shark Robot Vacuum Flaw Could Let One Hack Reach 670,000 Homes

The Flaw Your robot vacuum knows the layout of your home better than most of your furniture. It maps every room, every wall, every doorway — and on some models, it carries a camera to see what it's cleaning. In July 2026, a security researcher demonstrated that for Shark's connected vacuums, an attacker didn't even need to target your specific device to get at that data. The problem was on the cloud side: an overly permissive AWS IoT policy that allowed any device certificate — once extracted from a single device — to publish and subscribe to cross-device topics across the entire region. A certificate is a trust credential, not a per-device lock. With it, an attacker could command not just one vacuum, but the 670,000+ devices sharing that misconfigured trust domain. What Was Exposed The blast radius goes well beyond "my vacuum won't turn on": Live camera feeds on camera-equipped models — a view directly into your home, at your pets' eye level Digital home floor plans — the precise layout of your rooms, walls, and furniture Plaintext Wi-Fi network passwords — stored and synced for the vacuum's own connectivity, readable by anyone who could reach the device That last item is the multiplier: a Wi-Fi password turns a single compromised device into full access to your home network — your laptop, your phone, your other smart devices, all behind a door the vacuum was holding open. Why IoT Keeps Failing This is the same failure mode we've documented in smart-home nightmares and the smart doorbell surveillance problem: IoT manufacturers design for convenience and cost, not least privilege. One shared cloud policy, one device certificate with region-wide authority, one plaintext credential — each is a single point of failure that turns a $400 cleaning appliance into a home-security liability. The Roomba floor-plan sale showed that even without a flaw, this data is a commodity. With a flaw like this one, it's free for anyone with the skill to extract a certificate. What to Do Update your device firmware and app — vendor patches and cloud-side policy fixes are the first line of defense. Check for updates this week. Separate your networks. Put smart devices on a guest or IoT VLAN with no access to your main network. If your Wi-Fi password falls, your computers shouldn't. Treat the mapping data as sensitive. If your device stores floor plans in the cloud, consider whether the convenience is worth a detailed architectural blueprint of your home being stored by a third party. Cover or disable cameras you don't use. A camera that can't see your home can't leak your home. Use a password manager for your Wi-Fi credentials too — and rotate your network password if you've ever bought a used device or moved one between homes. The Pattern The Shark flaw is the archetype of voice-assistant and smart-device eavesdropping risks: the attack surface is invisible, the trust is implicit, and the damage isn't in the device — it's in everything the device was allowed to reach. The fix is the same as it has always been: least privilege, per-device credentials, and never assume a convenience device was built to keep secrets. For a fuller defense checklist, our privacy guide for 2026 walks through smart-home hardening step by step.