Can Someone Hack a Robot Mower in 2026? Simple Fixes

9 min read by Rachel Whitman Updated November 11, 2026

Can someone hack a robot mower? Yes, security researchers have shown it for at least two brands. The documented weak points are the app PIN, the vendor cloud, shared passwords and Bluetooth. The cases below come mostly from robot vacuums and one large yard-robot incident, so exposure depends on the brand, the firmware and how the mower is connected.

The short answer

Documented: researchers took over Ecovacs robots in 2024, and a 2026 report described thousands of Yarbo yard robots open to remote takeover.
Weak points: PIN checks done in the app, shared or default passwords, open remote tunnels and insecure Wi-Fi.
Worst reported outcomes: camera and microphone access, remote control, and exposure of location and Wi-Fi passwords.
Lower the risk: change default passwords, install updates, turn off unneeded services and use a guest network.
No universal fix: Kaspersky says no protection covers every case, so ask about a vendor’s cloud security before you buy.

Can someone hack a robot mower? What researchers found

Researchers Dennis Giese and Braelynn Luedtke presented their Ecovacs attacks at DEF CON 32 in August 2024. The methods show several weak points in the design. Most of the published detail concerns vacuums, but the research also covered robot lawnmowers.

Kaspersky’s write-up describes three access routes. First, the PIN that protects the video feed is “verified on the app side,” so it “can be bypassed.” Second, if the app is used on an insecure network, an attacker can intercept the authentication token and communicate with the robot. Third, researchers gained root access to the robot’s operating system by sending a malicious payload over Bluetooth, and Ecovacs used a static encryption key shared across devices.

Range is the other factor. Kaspersky says vacuums can be reached from up to 50 meters, about 165 feet, and that mowers are “hackable at more than 100 meters” because they have stronger Bluetooth. The article does not say the researchers tested that mower distance, so treat the 100-meter figure as a claim rather than a measured result. The researchers reported the flaws to Ecovacs, received no response, and said the company’s partial fixes were ineffective.

Person holding a phone showing a lawn map app while a robot mower works in the backyard — Phone apps control the mower, so their login and PIN checks matter.

Our reading is that a mower with the same kind of app login and Bluetooth link faces the same categories of weak point. That is why the vendor’s security record matters as much as the hardware. Kaspersky’s article also notes that some models can be unlinked from the vendor cloud, but the process is complex. Our guide on what data robot mowers collect shows what sits behind the login.

The Yarbo case: thousands of yard robots exposed

In a 2026 report, researcher Andreas Makris said he could remotely hijack thousands of Yarbo yard robots worldwide, because every unit shared the same hardcoded root password, so one compromised unit could expose the rest. Malwarebytes described the root cause as a set of “legacy” design choices.

According to that report, remote tunnels were left open, and messaging over MQTT was so weakly protected that “once you had one device, you effectively had the worldwide fleet.” The exposed data included GPS coordinates, owner email addresses and Wi-Fi passwords. Camera feeds could also be turned into “remote spying tools.” The article gives no exact count of affected robots, so “thousands” is the researcher’s scale, not a confirmed inventory.

Malwarebytes reports that Yarbo acknowledged the core findings as accurate. The short-term steps it described were:

Temporarily disabling the remote diagnostic tunnels.
Resetting the root passwords and locking down endpoints that did not require authentication.
Removing unneeded legacy access paths.

Yarbo also promised unique per-device credentials, over-the-air credential rotation, allowlist-based remote diagnostics and a dedicated security contact. Malwarebytes notes that the company kept a remote access tunnel “wrapped in better controls and logs” rather than letting owners opt out.

Heads up

These promises are the vendor’s stated plans as reported in May 2026. This page did not verify whether they were completed, so check the current vendor notices for any model you are considering.

What someone could do after they hack a robot mower

A successful hack can expose where the mower is kept, what it sees and the network it shares with your devices. The Yarbo research also showed an attacker could re-arm a mower after someone pressed the emergency stop.

Risk	What the sources report
Location and identity	GPS coordinates and owner email addresses could be pulled from the fleet.
Home network	Wi-Fi passwords were exposed, and the article lists scanning local networks and joining a botnet as network-abuse risks.
Video and audio	Camera feeds could become spying tools, and Kaspersky reports attacks that reached the camera and microphone.
Physical safety	Attackers could re-arm the mower after an emergency stop, and the article says the emergency stop “can be bypassed.”
Spread to other robots	Kaspersky calls a self-spreading worm a theoretical possibility.

Physical safety is the item that matters most to buyers, because a mower’s blades can be a hazard. In the Ecovacs cases, Kaspersky reports a robot that moved by itself and another that played offensive audio through its speakers, and warns that hackers may watch owners through the built-in camera. If theft is the bigger worry, see our note on a GPS tracker for robot mower theft.

Where the weak points usually are

Can someone hack a robot mower through the app login alone? The Ecovacs research shows that is one route among several. The documented weak points are app-side checks, shared or default passwords, open remote access and insecure networks, and no single fix covers all of them.

App-side checks: a PIN verified in the app can be bypassed.
Credentials: one password shared across a fleet means one leak exposes every unit.
Remote access: tunnels the owner cannot see or switch off widen the attack surface.
Networks: an app used on an insecure network can expose the login token.
Bluetooth: a short-range link can still carry a malicious payload.

Kaspersky states that no universal protection exists, so no single step covers every case. Our reading is that the owner controls the home network and the password, while the vendor controls the cloud and firmware, so both sides need to do their part. For a look at vendor apps, see our comparison of which robot mower brand has the best app.

How to lower the risk

To make it harder for someone to hack a robot mower, CISA advises changing default passwords, applying software updates and disabling unnecessary services, and Kaspersky adds that IoT devices should sit on a guest network. These steps cost little and address most of the weak points listed above.

Man checking a mower app on his phone while a robot mower cuts the front lawn — Updates and strong passwords cut down the risk of a robot mower hack.

Change every default password. CISA says most network devices ship with default administrator passwords that are insecure, may be easy to find online, and should be changed.
Install firmware updates. CISA calls regular software updates “one of the most effective steps you can take,” and Kaspersky advises always installing firmware updates.
Put the mower on a guest network. Kaspersky advises moving IoT devices to a guest network, which limits what a compromised robot can reach on your main network.
Turn off what you do not need. CISA’s home network guidance says to disable all unnecessary services, including on the router.
Research the vendor before buying. Kaspersky says to look into the vendor’s security practices before you buy.

What to check before you buy a robot mower

Can someone hack a robot mower you are about to buy? The vendor’s record is the best clue, so check whether the vendor describes its security practices, ships firmware updates and gives each unit its own credentials. These are the points where the Yarbo and Ecovacs cases broke down.

Security contact: a published way to report a flaw, which Yarbo later promised.
Update history: recent firmware releases for the specific model.
Credentials: whether each unit has its own password instead of one shared across the fleet.
Remote access: whether you can see and switch off remote diagnostics.
Offline use: whether the mower still works without the vendor cloud. Our comparison of cellular versus Wi-Fi robot mowers covers how each connects.

Our reading is that no checklist can promise that someone cannot hack a robot mower, and a vendor’s promises are only as good as its follow-through. For the wider buying checklist, read what to look for in a robot lawn mower. Physical theft is a separate problem, covered by PIN locks, alarms and tracking, so do not rely on a security check alone.

Frequently asked questions

Can someone hack a robot mower from far away?

Can someone hack a robot mower from far away? Only within Bluetooth range, according to the research. Kaspersky reports that Ecovacs vacuums can be reached from up to 50 meters, and says mowers are “hackable at more than 100 meters” because of stronger Bluetooth. The article does not say the researchers tested the mower distance, so treat that figure as a claim.

Does a guest network stop someone from hacking a robot mower?

A guest network limits what a compromised robot can reach on your main network, and Kaspersky recommends it for IoT devices. It does not fix a weak app PIN, a shared password or a flaw in the vendor’s cloud, so combine it with password changes and firmware updates.

Should I unlink my mower from the vendor cloud?

Only if the model supports it and you are prepared for the work. Kaspersky says unlinking is possible in theory for some robots, but calls the procedure complex and time-consuming. Ask the vendor before you buy whether the mower still works without its cloud.

Are robot mowers less risky than robot vacuums?

The sources do not answer that directly. The published Ecovacs research centered on vacuums, and the Yarbo case involved a yard robot. Our reading is that risk depends on each brand’s design, credentials and update habits more than on the product type.

Sources

Home Network Security (CISA, archived tip released February 1, 2021): default passwords, software updates and disabling unnecessary services.
Yarbo responds to robot flaws that could mow down their owners (Malwarebytes, May 2026): the Yarbo case, exposed data and vendor response.
How vulnerable Ecovacs robot vacuums are being hacked (Kaspersky, January 9, 2025): Bluetooth range, mower claims and protective advice.
Ecovacs robot vacuums get hacked (Kaspersky): the PIN check, token interception, root access and attack capabilities.