Andreas Makris remotely controls Yarbo mower to expose critical security flaws
Updated
Updated · The Verge · May 7
Andreas Makris remotely controls Yarbo mower to expose critical security flaws
2 articles · Updated · The Verge · May 7
Makris, operating from Germany, showed he could access about 11,000 Yarbo robots worldwide, including 5,400 in the US and Europe, and retrieve owners’ GPS locations, emails and Wi-Fi passwords.
He said hardcoded passwords, an undeletable remote-access backdoor and safety overrides could let attackers hijack mowers, re-enable emergency-stopped machines, spy through cameras or compromise home networks.
Yarbo said it had developed a fix for one app-backend permissions issue and was preparing updates, while planning clearer customer approval, access logs and a security response channel.
With backdoors in Chinese robots sending data to ByteDance, is your smart home secretly spying on your family?
A researcher hijacked a robot mower from overseas. Are thousands of bladed smart devices potential weapons in our neighborhoods?
Hackers can weaponize a lawn mower from across the world. Can new security laws actually protect our smart homes?
Yarbo Lawn Mower Backdoor Exposes Users to Remote Control, Privacy Breaches, and Botnet Risks
Overview
In April 2026, researcher Andreas Makris revealed critical security flaws in Yarbo robotic lawnmowers, including a hardcoded root password that created a persistent backdoor. This vulnerability allowed attackers to remotely control the mowers, disable safety features, access onboard cameras, and steal sensitive data like Wi-Fi credentials and GPS locations. Despite responsible disclosure, Yarbo downplayed the risks and avoided fixing the core firmware issues, leaving users exposed. Many owners unplugged their devices out of fear. The incident exposed Yarbo's prioritization of remote support over security and highlighted broader IoT vulnerabilities, prompting calls for stronger regulations and better security practices across the industry.