DJI Romo leaks via Claude Code, NVIDIA's Cosmos 3 on Jetson, Grabette at €490

Sources

Reverse-engineering is cheap now simonwillison.net

I keep hearing anecdotes from people who used coding agents to reverse-engineer and automate devices in their homes. I think this is an interesting illustration of the impact of the reduced cost of writing code. Prior to agents, it was entirely possible to reverse-engineer home devices. The problem was the ROI - was it really worth all of that effort? More importantly, any experienced programmer knows that undocumented, unstable APIs like that may well change or break in the future. Is that ini…

Introducing Cosmos 3 Edge huggingface.co

Grabette: an open system to record robot-manipulation data huggingface.co

Beyond grep: The case for a context-rich AI coding harness arstechnica.com

Augment Code engineer Vinay Perneti makes the case that AI coding tools live or die on the harness feeding them context, not the underlying model. The interview contrasts grep-style retrieval with richer indexing pipelines that let agents like Claude Code reason across large codebases.

References

hckrnews aggregation of Sammy Azdoufal writeup hckrnews.com

Azdoufal used Claude Code to reverse-engineer the MQTT protocol of a DJI Romo robot vacuum… because the manufacturer lacked proper topic-level access controls, [he] found he could inadvertently access live camera feeds and microphones for thousands of other vacuums globally.

WindowsForum thread on Surface firmware bricking windowsforum.com

an AI-generated script—initially intended for a mundane task like backlight control—sent raw, malformed packets to a device’s embedded controller. This bypassed traditional userland safety guardrails and rendered the hardware unbootable.

Norton Law, DMCA §1201 analysis nortonlaw.com

allowing AI-driven circumvention would facilitate widespread IP theft and piracy… automating this process at ‘machine speed’ through AI agents transforms a narrow legal right into a tool for mass unauthorized access.

algustionesa.com, ‘The Rise of Code Comprehension Debt’ algustionesa.com

immediate gains in velocity are offset by the future cost of humans trying to debug machine-generated logic they did not write and do not fully understand.

dev.to, ‘The Hidden Cost of AI-Generated Code’ dev.to

AI agents excel at the visible 80% of a feature (functional CRUD logic) but systematically omit the ‘invisible’ 20%, such as error handling, observability, and architectural consistency.

Academic paper on the ‘Revelation’ / TracePcap LLM protocol-reconstruction agents vertexaisearch.cloud.google.com

an LLM-powered agent designed to convert raw IoT packet captures (PCAPs) into ‘semantically enriched’ representations… identifying device types with up to 98.25% accuracy.

Jon Peddie Research jonpeddie.com

the T3000 lacks Multi-Instance GPU (MIG) support… forces a reliance on software-based scheduling, which may introduce jitter and prevent the system from reaching its 15Hz theoretical peak in multi-tasking scenarios

r/LocalLLaMA discussion reddit.com

The model utilizes a specific NVFP4 precision that requires the latest Blackwell-era (5000-series) GPUs or high-end Jetson modules; running it on older hardware often requires casting up to FP8, which doubles VRAM requirements

Towards AI — LeCun/JEPA vs Cosmos analysis pub.towardsai.net

forcing a model to generate every pixel wastes capacity on ‘unpredictable noise,’ hindering its ability to learn high-level causal dynamics… V-JEPA 2 has demonstrated a reported 80% success rate in zero-shot robotic pick-and-place tasks

r/robotics — Pi0/foundation-model thread reddit.com

Pi0 achieved 65 units per hour (UPH)—a leading score among models—but still trailed human performance of 1,331 UPH by a factor of 20… current top models like GR00T and Pi0 require human intervention roughly every four minutes in real-world settings

VANTAGE-Bench (Clemson University) vantage-bench.org

70% of the data was collected with explicit informed consent… All assets undergo automated PII obfuscation followed by human-in-the-loop verification… the dataset is released under a specific license that strictly prohibits its use for biometric identification or demographic profiling

NVIDIA Open Model License terms nvidia.com

if a user bypasses or disables technical safety limitations… without implementing a substantially similar replacement, the license terminates automatically… any product… utilizing Cosmos 3 must display ‘Built on NVIDIA Cosmos’ credit

UMI paper (Chi et al., RSS 2024) umi-gripper.github.io

UMI achieves mean Absolute Trajectory Error of ~6.1 mm position / 3.5° rotation via ORB-SLAM3 on GoPro footage, but authors describe ORB-SLAM3 as ‘the most fragile part’ of the pipeline.

DexWild (Sriram et al., RSS 2025) mohansrirama.com

DexWild’s co-training on human handheld data plus robot data yields 68.5% success in unseen environments and 5.8× better cross-embodiment generalization than robot-only training.

The Robot Report — ‘How to avoid the teleoperation trap’ therobotreport.com

Handheld demonstrations are a ‘middle layer’ of the data pyramid — useful for trajectories but inferior to robot-in-the-loop data that captures execution failures and recovery.

RAI Institute — robotic data collection explainer rai-inst.com

Handheld rigs suffer an embodiment gap: human wrists produce trajectories that exceed robot joint limits, and lack of force feedback loses the force-modulated strategy needed for contact-rich tasks.

Forbes — Janakiram MSV on HF/Pollen acquisition forbes.com

Hugging Face acquired Pollen Robotics in April 2025 to vertically integrate hardware with LeRobot (12k+ GitHub stars) and standardize how robotics data is collected, shared, and trained.

The Hacker News — CVE-2026-25874 in LeRobot thehackernews.com

Critical CVSS 9.3 flaw in LeRobot’s async inference pipeline via unsafe pickle deserialization over unauthenticated gRPC — same transport Grabette/Gripette services rely on.