The Flaw
Your robot vacuum knows the layout of your home better than most of your furniture. It maps every room, every wall, every doorway — and on some models, it carries a camera to see what it's cleaning. In July 2026, a security researcher demonstrated that for Shark's connected vacuums, an attacker didn't even need to target your specific device to get at that data.
The problem was on the cloud side: an overly permissive AWS IoT policy that allowed any device certificate — once extracted from a single device — to publish and subscribe to cross-device topics across the entire region. A certificate is a trust credential, not a per-device lock. With it, an attacker could command not just one vacuum, but the 670,000+ devices sharing that misconfigured trust domain.
What Was Exposed
The blast radius goes well beyond "my vacuum won't turn on":
Live camera feeds on camera-equipped models — a view directly into your home, at your pets' eye level
Digital home floor plans — the precise layout of your rooms, walls, and furniture
Plaintext Wi-Fi network passwords — stored and synced for the vacuum's own connectivity, readable by anyone who could reach the device
That last item is the multiplier: a Wi-Fi password turns a single compromised device into full access to your home network — your laptop, your phone, your other smart devices, all behind a door the vacuum was holding open.
Why IoT Keeps Failing
This is the same failure mode we've documented in smart-home nightmares and the smart doorbell surveillance problem: IoT manufacturers design for convenience and cost, not least privilege. One shared cloud policy, one device certificate with region-wide authority, one plaintext credential — each is a single point of failure that turns a $400 cleaning appliance into a home-security liability.
The Roomba floor-plan sale showed that even without a flaw, this data is a commodity. With a flaw like this one, it's free for anyone with the skill to extract a certificate.
What to Do
Update your device firmware and app — vendor patches and cloud-side policy fixes are the first line of defense. Check for updates this week.
Separate your networks. Put smart devices on a guest or IoT VLAN with no access to your main network. If your Wi-Fi password falls, your computers shouldn't.
Treat the mapping data as sensitive. If your device stores floor plans in the cloud, consider whether the convenience is worth a detailed architectural blueprint of your home being stored by a third party.
Cover or disable cameras you don't use. A camera that can't see your home can't leak your home.
Use a password manager for your Wi-Fi credentials too — and rotate your network password if you've ever bought a used device or moved one between homes.
The Pattern
The Shark flaw is the archetype of voice-assistant and smart-device eavesdropping risks: the attack surface is invisible, the trust is implicit, and the damage isn't in the device — it's in everything the device was allowed to reach. The fix is the same as it has always been: least privilege, per-device credentials, and never assume a convenience device was built to keep secrets. For a fuller defense checklist, our privacy guide for 2026 walks through smart-home hardening step by step.