![\"Yep,](\"https:\/\/platform.theverge.com\/wp-content\/uploads\/sites\/2\/2026\/05\/robot-lawnmower.webp?quality=90&strip=all&crop=0,0,100,100\")
<\/a><\/p>\nYep, that\u2019s me. Animation by Sean Hollister \/ The Verge<\/p>\n
By the time the mower touches my body, Makris has already proven his point: the $5,000 robot lawn mowers from Yarbo have such ridiculous security vulnerabilities that a foreign hacker can easily hijack a bladed gadget in the United States. And not just one. Thousands upon thousands of bladed Chinese robots at his beck and call. Every Yarbo robot around the world, whether configured to churn through grass, snow, or weeds, is theoretically reporting to him now.<\/p>\n
\u201cI can do whatever I want with all the bots,\u201d Makris tells The Verge. \u201cIt\u2019s completely unsecured.\u201d<\/p>\n
And believe it or not, remote control is just the tip of the iceberg.<\/p>\n
Like Sammy Azdoufal, who made headlines worldwide when The Verge exclusively revealed how he made thousands of DJI Romo robot vacuum cleaners<\/a> identify themselves and begin following his commands, Makris discovered that Yarbo\u2019s robots do much the same thing. If you have access to one robot, you have access to them all.<\/p>\n But these robots have blades \u2014 and hackers can use the robot\u2019s built-in commands to override its safety features. Even if you press that big red emergency stop button on the mower itself, a hacker can send another command to unlock it, Makris says.<\/p>\n And because the Yarbo is a full Linux computer, one with its own backdoor and where the root password is always the same, hackers could remotely reprogram it to do anything: spin up the blades, probe your home network, turn your robot into part of a botnet to harass targets on the internet.<\/p>\n The Yarbo robot can power a snowblower attachment, too. Video: Yarbo<\/p>\n Founded in 2015 as a robot snowblower company, Yarbo sells all-in-one yard robots with modular attachments that let it become a lawn mower, leaf blower, snowblower, trimmer, and edger. Each attachment is pushed or pulled by the same \u201ccore\u201d robot that uses tank treads to drive and climb \u2014 which is why all of them may be vulnerable to hackers.<\/p>\n Makris begins by showing me a vibe-coded map with the locations of ostensibly every Yarbo robot in the United States and Europe, around 5,400 devices. (He\u2019s tracking over 11,000 of them worldwide.) Then, as I watch his video stream, he presses a button to take control of a robot in upstate New York.<\/p>\n This robot was already mowing a field, a white house visible in the background. But we interrupt its regularly scheduled programming. Makris drags a little onscreen joystick with his mouse, and I watch as the robot\u2019s camera turns to reflect each of those moves. There\u2019s little to keep him from driving anywhere he likes, spying on this family, figuring out when they come and go.<\/p>\n Similarly, there might be nothing keeping a bad actor from spying on, say, troop movements near a nuclear power plant. Makris has already identified 12 different Yarbo robots within 3 kilometers of a major power plant \u2014 one of which is seemingly registered to a nuclear security analyst.<\/p>\n Then, Makris makes my jaw drop yet again: He shows me he can pull owners\u2019 email addresses, their Wi-Fi passwords, and the exact GPS coordinates of their houses. When I look up an address on Google Maps, I see a satellite view of what appears to be the same property we saw through the robot\u2019s cameras.<\/p>\n Four days later, I\u2019m driving through the Silicon Valley foothills in search of proof. At the very first house on my itinerary, my heart skips a beat. Looking down into one person\u2019s hilly backyard from the sidewalk above, I see a Yarbo robot exactly where Makris pinpointed it would be. When I whip out my phone to scan for local Wi-Fi networks, I see the same private access points that Makris found in his scan.<\/p>\n When I later email the owner, using the same email address Yarbo\u2019s robot coughed up, I get a reply. He agrees to meet in person.<\/p>\n Wayne Yu wants to know how his robot lawn mower led me straight to his door. A self-described gadget enthusiast, he says he\u2019s not concerned that the Yarbo gave us photos of his house. \u201cPeople are always hacking into devices, so I\u2019m not surprised,\u201d he tells me.<\/p>\n Nor is he concerned about someone stealing his lawn mower: \u201cIt\u2019s heavy, and it\u2019s uphill \u2014 you can see that, right? For me to walk down to the lawn mower, it\u2019s hurting my legs already,\u201d he laughs, adding that difficulty mowing the steep grade is why he bought a Yarbo in the first place. But when I ask him how he feels that the hacker is halfway across the planet, led me straight to his door, and gave me his email and Wi-Fi passwords, he says he\u2019s uncomfortable. \u201cNot good. Not good,\u201d Yu repeats.<\/p>\n When I show him the Wi-Fi passwords, he confirms they\u2019re his.<\/p>\n Matt Petach, retired network architect and Yarbo owner. Both Petach and Yu agreed that I could name them in the story. Photo by Sean Hollister \/ The Verge<\/p>\n Matt Petach is less surprised that I wound up on his doorstep. Nothing seems to faze the retired Yahoo and Microsoft network architect, even when I show him his own Wi-Fi password. He says it\u2019s an isolated guest network, one set to automatically reject unknown devices<\/a>, and that the guest password is just his publicly listed phone number.<\/p>\n Everyone should treat gadgets like these as hostile agents, Petach says. \u201cIt is unfortunate that in the name of convenience, homeowners and other users are really invited to treat technology as their best friend, their confident helper,\u201d he tells me.<\/p>\n You should think of bad security like missing safety features on a power tool, he suggests: \u201cThis is a lot more like a chainsaw without a handguard, without a brake, with a loose chain that\u2019s ready to take your leg off at a moment\u2019s notice.\u201d<\/p>\n But even Petach seems slightly taken aback at Yarbo\u2019s security practices.<\/p>\n Makris explains that not only does each Yarbo robot have the same hardcoded root password, but owners can\u2019t defend themselves just by manually setting a better password. Every time Yarbo updates a robot\u2019s firmware, it changes the robot\u2019s root password right back to its default password. Hackers can come right back in. \u201cWow, that\u2019s even worse than I thought,\u201d Petach says.<\/p>\n It also appears that Yarbo intentionally created the remote-access backdoor that allows for the very worst that hackers could do. \u201cIt is deployed automatically to every robot, cannot be disabled by the owner, and is actively restored if removed,\u201d Makris writes.<\/p>\n In emails, Yarbo tries to assure Makris that the remote backdoor into every robot can\u2019t be abused.<\/p>\n You can tap these emails to zoom in and read them. Images: Andreas Makris<\/p>\n That\u2019s why Makris decided to do something that security researchers generally avoid: Today, he\u2019s publishing his research<\/a>, including official CVE<\/a> vulnerability<\/a> disclosures<\/a>, without giving Yarbo time to fix the problem first. When he first reached out to Yarbo to alert the firm to the issue, he couldn\u2019t find a security contact or bug bounty program, and the company\u2019s customer support tried to explain away remote access as a safe, useful feature that Yarbo\u2019s engineers would only use to remotely diagnose customer problems.<\/p>\n Based on that and what he\u2019s seen of Yarbo\u2019s security practices \u2014 \u201ceither they don\u2019t care enough or it\u2019s a skill issue,\u201d he says \u2014 Makris worries that Yarbo and other companies won\u2019t learn the lesson and fix these problems unless they\u2019re publicly shamed. \u201cIt\u2019s the right thing to do, and that\u2019s what we\u2019re trying to do here: warning people and getting the information out for people to understand that this is by design bad and nobody seems to care,\u201d he says.<\/p>\n There are other reasons to believe that Yarbo might not be the most trustworthy entity out there. Yarbo says its \u201ccorporate headquarters\u201d is in New York \u2014 its Kickstarter page<\/a> and website<\/a> contain photos of fancy mid-rise offices. But Google Maps suggests its actual New York address<\/a> is a single-story building that also houses two auto detailers, an insurance agency, and an Etsy shop<\/a> specializing in spiked leather bracelets. In fact, Yarbo is actually just another name for Hanyang Tech<\/a>, which is based in Shenzhen, China.<\/p>\n In a Kickstarter campaign, Yarbo claims to be headquartered in New York\u2026 Image: Yarbo<\/p>\n \u2026but its New York office may be a single unit in this one-story building. Image: Google<\/p>\n We\u2019ve also tried to review Yarbo\u2019s lawn mowers more than once over the last few years only to be met with unusual requests. The company\u2019s PR contacts have repeatedly asked for assurances that we won\u2019t publish a negative review, and once asked us to sign a \u201cCooperation Agreement\u201d that included a non-disparagement clause and would have required us to \u201ccreate and share a dedicated review article within 21 business days.\u201d (We declined.) More recently, the company suggested: \u201cif the product does not meet expectations during testing, we would anticipate your decision not to include Yarbo in the final article.\u201d (Again, we did not agree to that.)<\/p>\n In emails to The Verge, Yarbo says it will take actions based on Makris\u2019 research.<\/p>\n While the company initially claimed to us, too, that its \u201cdiagnostic environment is not publicly accessible\u201d and suggested there was little to worry about, Yarbo senior PR manager Showan Hou told us Thursday that Yarbo has identified a fix for one issue, at least.<\/p>\n \u201cFollowing our internal review of the concerns brought to our attention, we identified an issue related to permission handling within part of the communication process between the Yarbo app and backend services. A fix has already been developed, and we are currently preparing the rollout. We expect the update to be deployed very soon,\u201d he writes, adding that Yarbo is continuing to investigate.<\/p>\n (Note that many of the issues are in the robot\u2019s firmware, not just in app-to-server communication.)<\/p>\n Yarbo is also \u201cactively implementing an in-app customer approval mechanism, clearer session visibility, stronger audit logging, and customer-facing access history so that remote diagnostic access is transparent, limited, and revocable,\u201d he says, and the company is \u201cactively planning a dedicated Security Response Center on our website to provide a clearer channel for vulnerability reporting and researcher engagement.\u201d It\u2019s also considering a bug bounty program.<\/p>\n \u201cWe understand the seriousness of the concerns raised, and we are treating this as a priority matter,\u201d he says.<\/p>\n When Makris originally told the company that remote access was a huge security risk, Yarbo claimed that \u201cyour Yarbo remains completely secure and under your exclusive control.\u201d<\/p>\n That\u2019s why I eventually end up beneath a Yarbo mower \u2014 as part of a controlled test to see just how safe and \u201csecure\u201d the machine really is. I\u2019ve already learned that the danger goes far beyond the blades; that we live in a wild west where modern gadgets can expose your exact GPS location, remote-control live video of your home, and compromise your home network in one fell swoop.<\/p>\n When I talk to researchers like Makris, it\u2019s clear that Yarbo is just one particularly egregious example in an ocean of insecure devices. But an example like Yarbo can help us understand how bad things have gotten.<\/p>\n One Friday, with his permission, I roll up to Petach\u2019s house. We hop onto a video call: Makris in Germany, Petach in Southern California, myself as the only one physically at the house. With a few clicks, Makris hijacks the Yarbo right in front of my eyes, both while idle and while it\u2019s already in the middle of mowing sessions. I see that he sees me through the Yarbo\u2019s cameras.<\/p>\n It\u2019s time to see if the Yarbo has any built-in safety mechanisms, like, say, obstacle avoidance<\/a>. I lie down on the ground.<\/p>\n I\u2019m not a complete idiot. The blades aren\u2019t spinning, and we\u2019re running the robot in reverse \u2014 so its tank treads, not its blades, hit me first.<\/p>\n But as the first hundred pounds of metal, plastic, and far-too-hackable computer pin my body to the ground \u2014 and Makris eventually, thankfully, backs off \u2014 I realize this science experiment wasn\u2019t quite as safe as I thought.<\/p>\n Update, May 7th: Added Yarbo\u2019s additional comment.<\/p>\n Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.Sean HollisterClose Sean Hollister<\/p>\n Posts from this author will be added to your daily email digest and your homepage feed.<\/p>\n FollowFollow<\/p>\n See All by Sean Hollister<\/a><\/p>\n NewsClose<\/p>\n News<\/p>\n Posts from this topic will be added to your daily email digest and your homepage feed.<\/p>\n FollowFollow<\/p>\n See All News<\/a><\/p>\n ReportClose<\/p>\n Report<\/p>\n Posts from this topic will be added to your daily email digest and your homepage feed.<\/p>\n FollowFollow<\/p>\n See All Report<\/a><\/p>\n SecurityClose<\/p>\n Security<\/p>\n Posts from this topic will be added to your daily email digest and your homepage feed.<\/p>\n FollowFollow<\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/p>\n