DJI Romo leaks via Claude Code, NVIDIA’s Cosmos 3 on Jetson, Grabette at €490

TL;DR

• Claude Code hack exposes DJI Romo camera and mic feeds from thousands of vacuums.
• NVIDIA’s Cosmos 3 Edge runs a 4B pixel-space world model at 15 Hz on Jetson Thor.
• Pollen’s Grabette records 6-DoF robot demos with a €490 handheld gripper.
• LeCun’s V-JEPA camp calls pixel-space prediction a computational dead end.
• Augment’s Perneti argues agent harnesses matter more than the underlying model.

Today’s three AI-tech leads sit in genuinely different worlds — IoT firmware, edge robotics silicon, and consumer robot-demo rigs — and any tidy synthesis would stretch at least one of them. What they share is a shipping cadence that keeps naming its own critics in the same breath as its wins.

Simon Willison’s DJI Romo writeup crystallizes the coding-agent thesis: rewriting a proprietary API is cheap enough now that a weekend hack accidentally streamed camera and mic feeds from thousands of vacuums. NVIDIA’s Cosmos 3 Edge squeezes a 4B pixel-space world model onto Jetson Thor at 15 Hz — and picks a fight with Yann LeCun’s V-JEPA 2 camp over whether pixels are the right substrate at all. Pollen Robotics’ Grabette turns a €490 handheld gripper into a demo-collection rig that trains a Diffusion Policy on one consumer GPU, while independent critics flag the embodiment gap and a CVSS 9.3 flaw in the shared LeRobot bus.

Coding agents collapse the cost of reverse-engineering

Source: simon-willison · published 2026-07-20

TL;DR

• DJI Romo hack: a hobbyist’s Claude Code session accidentally exposed live camera and mic feeds from thousands of vacuums.
• Willison’s thesis: coding agents collapse reverse-engineering ROI — cheap to write, cheap to regenerate when APIs break.
• Academic tooling formalizes it: LLM agents like Revelation fingerprint IoT device types from raw PCAPs at 98.25% accuracy.
• Disposable code leaks: an AI-generated backlight script bricked a device via malformed firmware packets.

The exemplar everyone’s citing

Sammy Azdoufal’s Claude Code session on a DJI Romo robot vacuum is the case study doing the rounds. What started as a project to bind a PS5 controller to the vacuum ended with Azdoufal reverse-engineering the MQTT protocol and discovering that DJI’s broker lacked topic-level access controls — meaning he could pull live camera feeds and microphone audio from thousands of other people’s vacuums ¹. The security story is its own scandal, but the methodological story is Simon Willison’s: a single developer, with an agent, chewed through a proprietary IoT protocol in an afternoon.

This isn’t just hobbyist tinkering anymore. Research groups are packaging the same workflow — one recent LLM agent, wrapped around Zeek and RAG, converts raw packet captures into “semantically enriched” protocol descriptions and fingerprints device types at 98.25% accuracy ². The capability is generalizing.

The thesis

Willison’s post is short and the claim is narrow: reverse-engineering undocumented home devices was always possible, just rarely worth it. The math was labor in, fragile integration out, plus an open-ended maintenance tax when the vendor shipped a firmware update. Coding agents change every term. Time-to-first-working-script drops from a weekend to a coffee break, failed attempts cost almost nothing, and “the API broke, regenerate the client” is a five-minute problem instead of a resentment-building one.

That’s a real shift, and the anecdote pile backing it is now deep enough to take seriously.

Where the “cheap” framing leaks

Willison treats maintenance debt as neutralized because regeneration is free. That holds for a five-line Home Assistant shim. It holds less well elsewhere.

Practitioners writing about production AI code have flagged two systematic gaps. The “comprehension debt” argument: velocity gains today are paid back by future humans debugging machine-written logic they never authored ³. The 80/20 critique: agents ship the visible CRUD surface reliably but skip error handling, observability, and architectural consistency ⁴. Home-automation glue is probably fine. The same reflex applied to anything with a blast radius is not.

And there is a blast radius. A documented 2026 incident had an AI-generated script — meant to adjust backlight — send malformed packets to an embedded controller and brick the machine, because the script had bypassed the userland guardrails a human author would have known were load-bearing ⁵. Cheap code plus root-adjacent hardware access is a new failure mode.

The legal overhang

The other thing Willison’s framing omits is DMCA §1201. Rights-holders are already arguing to the Copyright Office that agent-driven circumvention “at machine speed” turns the narrow interoperability exemption into de facto mass unauthorized access ⁶. The 2026-2027 triennial rulemaking is contested for exactly this reason: when reverse-engineering was expensive, §1201 exemptions were a hobbyist safety valve. When it’s cheap, they’re a scaling vector, and the incumbents have noticed.

The directional call is right — the ROI really has collapsed. The unpriced externalities are what to watch.

---

NVIDIA’s Cosmos 3 Edge bets pixels beat latents for robots

Source: huggingface-blog · published 2026-07-20

TL;DR

• 4B Cosmos 3 Edge sustains 15 Hz control on Jetson Thor at 640×360 resolution.
• Ships in NVFP4 precision, natively executable only on Blackwell-generation silicon.
• Older hardware pays a 2× VRAM tax via FP8 casting.
• LeCun’s V-JEPA 2 camp calls pixel-space prediction a “computational dead end.”

What NVIDIA shipped

Cosmos 3 Edge is a 4B-parameter open world model with a dual-tower transformer: an autoregressive tower for vision-text reasoning feeds a diffusion tower that predicts future video and actions, tied together by shared multimodal attention. On Jetson Thor at 640×360, it sustains 15 Hz control and emits 32 actions per inference — the numbers NVIDIA needs to claim “data-center-level performance” on an edge module. A companion “Super 4-Step Distillation” checkpoint collapses the diffusion loop from 50 steps to 4 for the larger 64B sibling, quoted at up to 25× faster inference.

The unified action representation is the more interesting piece: industrial arms, grippers, AVs, and pan-tilt cameras all get mapped to the same compact geometric vector space (translation, rotation, manipulation state), with per-embodiment normalization and MLP heads. That’s the architectural move that lets one checkpoint underwrite pick-and-place (the Cosmos 3 Edge Policy DROID variant), warehouse logistics, and smart-infrastructure vision from a shared backbone.

The hardware asterisk

“Edge” is doing work in the branding. Cosmos 3 Edge ships in NVFP4, a precision Blackwell-generation GPUs and high-end Jetsons execute natively; on anything older, you cast up to FP8 and eat a 2× VRAM penalty that pushes the “compact” model off consumer cards ⁷. The Jetson T3000 — the module pitched for mass robotics — lacks Multi-Instance GPU support, so perception, planning, and interaction models must share the GPU via software scheduling. Independent analysis warns that jitter can prevent the advertised 15 Hz loop under realistic multi-model workloads ⁸. The headline number is a single-model, single-tenant figure; on a real robot stack it is contested.

Pixels vs. latents

NVIDIA’s decision to have the diffusion tower literally paint future pixels puts Cosmos on a direct collision course with Yann LeCun’s JEPA program, which raised over $1B this year on the opposite thesis: pixel-space prediction wastes capacity on “unpredictable noise,” and latent embeddings are enough for control. V-JEPA 2 backers point to a reported 80% zero-shot pick-and-place success rate as proof ⁹.

Framing Cosmos 3 Edge as the world model glosses over an actively disputed architectural bet that a well-funded counter-effort is spending the next 18 months trying to refute.

Benchmarks vs. shift-length autonomy

VANTAGE-Bench #1 in the 4B class is real, but the benchmark is a Clemson-built fixed-camera evaluation with strict anti-biometric licensing — narrower than “vision analytics” suggests ¹⁰. And leaderboard wins do not equal deployable robots: peer VLA policies like Pi0 clock ~65 units/hour against a 1,331 UPH human baseline, and top models including GR00T and Pi0 still need human intervention roughly every four minutes in the field ¹¹.

The license fine print

The OpenMDW-1.1 release is more permissive than prior NVIDIA grants, but two clauses matter. Any product built on Cosmos 3 must surface a “Built on NVIDIA Cosmos” credit in its UI. Separately, the license auto-terminates if a deployer bypasses or weakens the built-in safety limits without a substantially similar replacement ¹². Read plainly: open weights with an enforced safety envelope, not an unconditional grant.

---

Hugging Face’s Grabette records robot demos for €490

Source: huggingface-blog · published 2026-07-21

TL;DR

• Pollen Robotics’ Grabette records 6-DoF manipulation demos with a €490 handheld gripper, replacing teleop rigs costing far more.
• A €120 motorized twin called Gripette mounts on the robot arm at execution.
• The reference stack — 200 cup-grasp demos → Diffusion Policy → OpenArm 7-DoF — trains on one consumer GPU and exports natively to LeRobot.
• Independent critics flag the embodiment gap and no force feedback as unresolved.
• A CVSS 9.3 flaw in LeRobot’s gRPC pipeline shadows the shared-bus strategy.

A cheaper, better-integrated UMI

Grabette is the productization of an idea Stanford and TRI shipped in 2024 with the Universal Manipulation Interface (UMI): put a fisheye camera and a passive gripper in a human’s hand, recover the 6-DoF trajectory with visual-inertial SLAM, and treat the result as robot-ready training data. UMI hit ~6.1 mm absolute trajectory error using ORB-SLAM3 on GoPro footage, but its own authors called ORB-SLAM3 “the most fragile part” of the pipeline ¹³.

Grabette swaps that stack out. The €490 handheld pairs a wide fisheye (for policy context) with an OAK-D RGBD camera and an IMU, then runs RTAB-MAP for SLAM inside a browser-based Hugging Face Space that verifies trajectories and exports LeRobot episodes. The €120 Gripette is the same jaw geometry, motorized, that bolts onto the robot at execution time — so the observation the policy learned from a human hand is roughly the observation the robot sees.

flowchart LR
    A[Human holds Grabette<br/>€490 BOM] -->|fisheye + RGBD + IMU| B[RTAB-MAP SLAM<br/>HF Space]
    B --> C[LeRobot dataset<br/>6-DoF camera-local poses]
    C --> D[Diffusion Policy<br/>ResNet18 + spatial softmax]
    D --> E[OpenArm 7-DoF<br/>+ Gripette €120]

The reference run is deliberately modest: 200 demonstrations of grasping a cup, a Diffusion Policy with a ResNet18 encoder trained on one consumer GPU, deployed on an OpenArm 7-DoF. That’s not a benchmark, it’s an existence proof — the point is the €610 total hardware cost and the one-button recording loop.

What the handheld-rig crowd is arguing about

The critique is not that Grabette is worse than UMI — it’s cheaper and easier — but that the whole handheld lineage may not carry as far as its proponents claim. The RAI Institute points out that human wrists produce trajectories that routinely exceed robot joint limits, and that no handheld rig captures the force-modulated strategy contact-rich tasks depend on ¹⁴. The Robot Report calls handheld data a “middle layer” of the data pyramid: fine for kinematic trajectories, inferior to robot-in-the-loop collection that logs execution failures and recoveries ¹⁵. Gripette’s motorized twin answers the kinematic-mismatch complaint at the fingertips, but neither device has force sensing.

CMU’s DexWild (RSS 2025) is the target Grabette will be measured against next. Co-training on human handheld data plus a smaller robot dataset delivered 68.5% success in unseen environments and 5.8× better cross-embodiment generalization than robot-only training ¹⁶. Grabette has published no comparable number.

The platform bet and its new risk

The launch is the first visible output of Hugging Face’s April 2025 acquisition of Pollen Robotics — a move Forbes read as a bid to vertically integrate hardware with the 12k-star LeRobot library and become the “GitHub of physical AI” ¹⁷. That strategy has a fresh liability: CVE-2026-25874, disclosed in April, is a CVSS 9.3 RCE in LeRobot’s async inference server, caused by unsafe pickle deserialization over unauthenticated gRPC — the same transport Gripette’s motor and camera services rely on ¹⁸. A community-scale, crowdsourced data bus makes that surface bigger, not smaller.

The bet is that lowering data-collection cost by orders of magnitude recruits enough hobbyists to out-scale the labs. The unresolved question is whether trajectories without force are the data the field actually needs.

Round-ups

Augment Code’s Perneti argues coding agents need harnesses, not just grep

Source: ars-technica-ai

Augment Code engineer Vinay Perneti makes the case that AI coding tools live or die on the harness feeding them context, not the underlying model. The interview contrasts grep-style retrieval with richer indexing pipelines that let agents like Claude Code reason across large codebases.

Footnotes

1. hckrnews aggregation of Sammy Azdoufal writeup — https://hckrnews.com/

   Azdoufal used Claude Code to reverse-engineer the MQTT protocol of a DJI Romo robot vacuum… because the manufacturer lacked proper topic-level access controls, [he] found he could inadvertently access live camera feeds and microphones for thousands of other vacuums globally.

   ↩

2. Academic paper on the ‘Revelation’ / TracePcap LLM protocol-reconstruction agents — https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQG3DnxmsoGeEdlVPPMZw0SSKr4bhEVN5I5yWU2bDu90xlrwQu8u-sKFAsdQ0j00sy2Ps7Zm9Mn7WQmA8RExjoWPAhmt8a-JrQh8V5i1ox9OoqrYiAYS3GDZJl01K1FR-fU_r2m7sb-xKV7kzXd2hwsoVv2Hyzulzs7qob706xg=

   an LLM-powered agent designed to convert raw IoT packet captures (PCAPs) into ‘semantically enriched’ representations… identifying device types with up to 98.25% accuracy.

   ↩

3. algustionesa.com, ‘The Rise of Code Comprehension Debt’ — https://algustionesa.com/the-rise-of-code-comprehension-debt/

   immediate gains in velocity are offset by the future cost of humans trying to debug machine-generated logic they did not write and do not fully understand.

   ↩

4. dev.to, ‘The Hidden Cost of AI-Generated Code’ — https://dev.to/elysiumquill/the-hidden-cost-of-ai-generated-code-what-nobody-tells-you-about-maintenance-3om

   AI agents excel at the visible 80% of a feature (functional CRUD logic) but systematically omit the ‘invisible’ 20%, such as error handling, observability, and architectural consistency.

   ↩

5. WindowsForum thread on Surface firmware bricking — https://windowsforum.com/threads/surface-firmware-bricking-bug-how-ai-generated-scripts-expose-pc-trust-gaps.425605/

   an AI-generated script—initially intended for a mundane task like backlight control—sent raw, malformed packets to a device’s embedded controller. This bypassed traditional userland safety guardrails and rendered the hardware unbootable.

   ↩

6. Norton Law, DMCA §1201 analysis — https://nortonlaw.com/2026/05/14/dmca-section-1201-claims-the-new-battleground-for-ai-and-data-scraping-litigation/

   allowing AI-driven circumvention would facilitate widespread IP theft and piracy… automating this process at ‘machine speed’ through AI agents transforms a narrow legal right into a tool for mass unauthorized access.

   ↩

7. r/LocalLLaMA discussion — https://www.reddit.com/r/LocalLLaMA/comments/1rue6tn/nvidia_updated_the_nemotron_super_3_122b_a12b/

   The model utilizes a specific NVFP4 precision that requires the latest Blackwell-era (5000-series) GPUs or high-end Jetson modules; running it on older hardware often requires casting up to FP8, which doubles VRAM requirements

   ↩

8. Jon Peddie Research — https://www.jonpeddie.com/news/nvidia-shrinks-blackwell-for-mass-robotics/

   the T3000 lacks Multi-Instance GPU (MIG) support… forces a reliance on software-based scheduling, which may introduce jitter and prevent the system from reaching its 15Hz theoretical peak in multi-tasking scenarios

   ↩

9. Towards AI — LeCun/JEPA vs Cosmos analysis — https://pub.towardsai.net/ai-in-2026-will-get-smarter-by-getting-constrained-017667480e1f

   forcing a model to generate every pixel wastes capacity on ‘unpredictable noise,’ hindering its ability to learn high-level causal dynamics… V-JEPA 2 has demonstrated a reported 80% success rate in zero-shot robotic pick-and-place tasks

   ↩

10. VANTAGE-Bench (Clemson University) — https://vantage-bench.org/

    70% of the data was collected with explicit informed consent… All assets undergo automated PII obfuscation followed by human-in-the-loop verification… the dataset is released under a specific license that strictly prohibits its use for biometric identification or demographic profiling

    ↩

11. r/robotics — Pi0/foundation-model thread — https://www.reddit.com/r/robotics/comments/1n1wiqo/how_good_is_pi0_the_robotic_foundational_model/

    Pi0 achieved 65 units per hour (UPH)—a leading score among models—but still trailed human performance of 1,331 UPH by a factor of 20… current top models like GR00T and Pi0 require human intervention roughly every four minutes in real-world settings

    ↩

12. NVIDIA Open Model License terms — https://www.nvidia.com/en-us/agreements/enterprise-software/nvidia-open-model-license/

    if a user bypasses or disables technical safety limitations… without implementing a substantially similar replacement, the license terminates automatically… any product… utilizing Cosmos 3 must display ‘Built on NVIDIA Cosmos’ credit

    ↩

13. UMI paper (Chi et al., RSS 2024) — https://umi-gripper.github.io/umi.pdf

    UMI achieves mean Absolute Trajectory Error of ~6.1 mm position / 3.5° rotation via ORB-SLAM3 on GoPro footage, but authors describe ORB-SLAM3 as ‘the most fragile part’ of the pipeline.

    ↩

14. RAI Institute — robotic data collection explainer — https://rai-inst.com/resources/videos/robotic-data-collection-explained/

    Handheld rigs suffer an embodiment gap: human wrists produce trajectories that exceed robot joint limits, and lack of force feedback loses the force-modulated strategy needed for contact-rich tasks.

    ↩

15. The Robot Report — ‘How to avoid the teleoperation trap’ — https://www.therobotreport.com/how-to-avoid-teleoperation-trap-robotics-development/

    Handheld demonstrations are a ‘middle layer’ of the data pyramid — useful for trajectories but inferior to robot-in-the-loop data that captures execution failures and recovery.

    ↩

16. DexWild (Sriram et al., RSS 2025) — https://www.mohansrirama.com/publication/dexwild/

    DexWild’s co-training on human handheld data plus robot data yields 68.5% success in unseen environments and 5.8× better cross-embodiment generalization than robot-only training.

    ↩

17. Forbes — Janakiram MSV on HF/Pollen acquisition — https://www.forbes.com/sites/janakirammsv/2025/06/02/the-strategy-behind-hugging-faces-acquisition-of-pollen-robotics/

    Hugging Face acquired Pollen Robotics in April 2025 to vertically integrate hardware with LeRobot (12k+ GitHub stars) and standardize how robotics data is collected, shared, and trained.

    ↩

18. The Hacker News — CVE-2026-25874 in LeRobot — https://thehackernews.com/2026/04/critical-cve-2026-25874-leaves-hugging.html

    Critical CVSS 9.3 flaw in LeRobot’s async inference pipeline via unsafe pickle deserialization over unauthenticated gRPC — same transport Grabette/Gripette services rely on.

    ↩