Robotics firm Yarbo is rushing to strip out an intentional “backdoor” from its internet-connected lawn mowers after a security researcher proved he could seize total control of the heavy machinery. The move comes as the technology industry faces a mounting global crisis over the safety of autonomous home AI, with regulators demanding stricter physical safeguards for hardware that can cause real-world harm. Yarbo confirmed it will disable the hidden remote-access tunnel that allowed outsiders to bypass safety switches and spin up mower blades without owner consent.
The security flaw is a nightmare scenario for the smart home. German researcher Andreas Makris discovered that over 11,000 Yarbo units across 30 countries were vulnerable due to a hardcoded root password and a “service backdoor” built into the firmware. During a terrifying live demonstration, Makris was able to hijack a 90-pound mower from thousands of miles away. He didn’t just look at the camera; he drove the machine directly at a person while remotely overriding the physical emergency stop button. According to a detailed report by Malwarebytes, the exploit even allowed hackers to spin the cutting blades at full speed while the machine was in motion.
Hardcoded Passwords and Secret Tunnels
The problem is how Yarbo designed its remote diagnostics. The company included a hidden communication channel that stayed active even after a factory reset. This “backdoor” was meant to help technicians fix software bugs. Instead, it gave anyone with the password access to the mower’s GPS location, Wi-Fi credentials, and live video feeds. It turns out the units were using a basic communication protocol that lacked modern encryption. Most homeowners had no idea their lawn care robot was essentially a 90-pound surveillance tool on wheels.
Yarbo acted fast once the news broke. The company has already disabled the remote diagnostic tunnel and is pushing out mandatory firmware updates to change the hardcoded credentials. They are also setting up a security response center to handle future bugs. But for many, the damage is done. The flaw highlights a massive gap in how we build technology for the physical world. It isn’t just about stolen data anymore. It is about a robot in your backyard that someone else can turn into a weapon.
Safety Fixes and Global Response
The scale of the vulnerability is what caught the attention of federal authorities. Because the flaw affected over 11,000 devices globally, the US National Vulnerability Database officially flagged the exploit. Cybersecurity experts at Cybernews verified the scale of the risk, noting that the shared password meant every single active unit could be hit at once. Yarbo says it will now allow users to opt-out of remote support entirely to ensure their local network stays private.
Why the Yarbo Fix Marks a Death Knell for Unfiltered Cloud Backdoors
This isn’t just a win for Yarbo owners; it is a major shift for the entire robotics industry. For years, tech companies have insisted on “always-on” remote access for maintenance. They said it was for the user’s convenience. The Yarbo hack proves that convenience is a massive liability when the device has spinning steel blades and the power to move itself. We are seeing a hard pivot toward “local-only” control where the owner, not the manufacturer, holds the keys to the hardware.
Comparing this to the 2024 smart lock hacks or the 2025 drone security scares shows that the stakes have peaked. This is the first time a major consumer robot has been caught with a backdoor that can physically override a manual “E-stop” button. Moving forward, expect to see new safety standards that require physical air-gaps for motor controls. The era of trusting a company with a secret key to your front yard is likely over. If a researcher can mow your lawn from 6,000 miles away, your privacy is the least of your worries.