Yarbo shows what happens when a security flaw gets cameras, tracks and blades

Andreas Makris wasn’t just demonstrating a theoretical vulnerability when he hacked into a Yarbo robot lawn mower from halfway across the world. He was proving a point: these machines are dangerously exposed. The 200-pound robot, designed to autonomously trim lawns, nearly dragged its spinning blades across Makris’s body as he lay on the ground—all while he was 6,000 miles away, unable to hit the emergency stop button.

The incident, first reported by The Verge, wasn’t an accident. It was a controlled test of Yarbo’s security flaws, and the results were alarming.

The core issue? A hardcoded root password shared across every Yarbo device. Makris exploited this backdoor to gain full control, overriding safety protocols and spinning up the blades at will. "I can do whatever I want with all the bots," he told researchers. The implications extend far beyond a single lawn mower. With an estimated 5,000 Yarbo units in use—many equipped with modular attachments for snow blowing and leaf clearing—the vulnerability turns a household tool into a potential weapon.

The source material also shows that yarbo’s robots are marketed as all-in-one yard care solutions, but their security architecture tells a different story. The company, founded in 2015 as a robot snowblower manufacturer, has expanded its lineup without addressing fundamental flaws. The MQTT protocol used for remote communication, for example, lacks basic encryption, making it trivial for attackers to intercept or spoof commands.

Worse, the robots’ safety features—like obstacle detection and emergency stops—can be disabled with a few lines of code. This isn’t just a software bug; it’s a design failure that prioritizes convenience over security.

The real-world risks are stark. A hacker could reprogram a fleet of Yarbo robots to ignore property boundaries, target specific individuals, or even coordinate attacks. The 11,000-strong user base, spread across residential and commercial properties, provides ample opportunity for exploitation. While Makris’s demo was a controlled experiment, the next intrusion might not be. Regulators have yet to weigh in, but the clock is ticking. Yarbo’s response—whether a recall, a firmware update, or silence—will determine whether these robots remain a threat or become a cautionary tale in IoT security.