Claude Code Reverse-Engineers DJI Vacuum — Accidentally Exposes 7,000 Devices Across 24 Countries

— A hobbyist used Claude Code to decompile DJI's mobile app, extract MQTT authentication tokens, and build a PS5-controller client. Due to missing topic-level access controls on DJI's MQTT broker, he gained access to live camera feeds, microphones, and floor plans of 7,000 robot vacuums worldwide. DJI patched but additional vulnerabilities remain. This is the highest-profile demonstration that AI coding tools lower the security research barrier from "expert" to "weekend hobbyist." (Tom's Hardware, Malwarebytes)