A robot mower sounds like the kind of yard tool that should make life easier. It cuts the grass, saves you time and quietly handles a chore most people would rather avoid.
But a new independent security report raises a bigger concern about what may be happening behind the scenes. Security researcher Andreas Makris says Yarbo robots, which include autonomous lawn mowers and snow blowers, contained serious flaws that could expose owners to remote access, live camera viewing and Wi-Fi credential theft. The report says roughly 6,000 robots are currently affected.
Yarbo has since responded through its Security Center, saying the core technical findings are accurate and that it has started rolling out security fixes. Still, the report raises important questions about how much access smart yard devices should have inside your home network.
Sign up for my FREE CyberGuy Report
SMART HOME HACKING FEARS: WHAT’S REAL AND WHAT’S HYPE
Makris says Yarbo robots ship with a persistent remote access setup that uses a tunnel to reach the robot over the internet. According to the report, the robots also include a hardcoded root password shared across the fleet and a remote connection method tied to the robot’s serial number. That is important because “root” access gives someone deep control over the device. In simple terms, it can mean administrator-level access to the system inside the robot. The report also says the remote tunnel runs automatically, can restart itself if stopped and may return if removed. That raises a major concern for owners because they may not have a simple switch in the app to shut it off.
Smart devices often need internet access to work. App controls, software updates, diagnostics and support all depend on that connection. However, Makris claims Yarbo’s setup creates a much riskier situation. He says remote access appears to be built into every robot, rather than turned on only when an owner asks for help. The report says an attacker with the right information could potentially reach a robot remotely, access internal functions and use it as a foothold on the owner’s network. So while a robot mower may seem harmless as it cuts grass, rolls through the yard or parks near the garage, that same machine can also connect to your Wi-Fi, carry cameras and sit close to your home every day.
5 WORRISOME PRIVACY CLAUSES HIDDEN IN SMART HOME DEVICES
According to the report, Yarbo robots can have multiple camera feeds. Makris says that if someone gained root access through the remote tunnel, they could potentially view the robot’s surroundings remotely. That could include a driveway, backyard, entryway, garage area or outdoor space where your family spends time. For homeowners, this concern goes beyond a glitch. A camera-equipped device outside your home deserves the same scrutiny as a camera inside your home.
The report also says an attacker with root access could retrieve saved Wi-Fi credentials from the robot’s system. That would be a serious issue because many homes use one main Wi-Fi network for phones, laptops, tablets, smart TVs, security devices and more. Once someone has your Wi-Fi password, the risk can spread. They may try to reach other connected devices or look for weak spots that were never meant to face the internet. This is why connected outdoor equipment should never get a free pass. A lawn robot may be housed outside or in the garage, but its network access can reach inside.
After Makris published his report, Yarbo posted a response to its Security Center page on its website. The company said the report identified serious vulnerabilities in its remote diagnostic, credential management and data-handling systems. Yarbo co-founder Kenneth Kohlmann also said the “core technical findings are accurate” and acknowledged that the company’s initial response did not reflect the seriousness of the issues.
Yarbo says the problems primarily involved historical design choices in parts of its remote diagnostic, access management and data-handling systems. The company also said some legacy support tools did not give users enough visibility or control. Yarbo said some authentication and credential systems did not meet its current security expectations.
A NEW SECURITY SEAL OF APPROVAL IS COMING TO YOUR SMART HOME GADGETS
Yarbo says it has taken several remediation steps since the report was published. According to the company, it has retired historical fleet-level root credentials, revoked shared FRP remote-access credentials and disabled related FRP server-side connection paths.
The company also says updated versions of the Yarbo mobile app no longer contain static credentials or embedded access mechanisms capable of directly authenticating against backend services. Yarbo says it has removed reporting scripts, legacy dependencies and non-essential network configurations that no longer served a necessary product function.
However, Yarbo says more work remains. The company says it is rebuilding its credential management system so any remaining shared-credential models can be replaced with individually scoped, per-device credentials. Each credential would support independent rotation and revocation.
The report also points to connections involving Hanyangtech, Yarbo’s Shenzhen-based parent company, along with ByteDance Feishu, Tencent TDMQ and Chinese DNS resolvers. Makris says some robot telemetry can be sent to ByteDance’s Feishu platform and that certain infrastructure choices are built into the firmware.
Yarbo now says it has removed reporting scripts, legacy dependencies and non-essential network configurations that no longer served a necessary operational or product function. The company also says historical servers and legacy access channels will continue to be phased out as part of its remediation work.
The core issue is transparency. Owners should know where their devices send data, which companies can access it and whether those connections are essential for normal use. That level of clarity matters even more for devices with cameras, location data and access to home networks.
If you own a Yarbo robot, this report means you should treat it like any other connected device with cameras, location data and access to your home Wi-Fi. Yarbo says it is pushing security updates automatically to connected devices. That means owners should connect their Yarbo long enough to receive the latest security update. After that, consider moving it back to a guest network or an isolated smart-device network.
CyberGuy reached out to Yarbo, and a representative said the company encouraged readers to refer to the Security Center at yarbo.com/pages/yarbo-security-center for the latest verified information and ongoing updates.
You may not be able to control everything happening inside the robot, but you can take a few practical steps to limit what it can reach on your home network.
Do not keep your robot mower on the same network as your laptop, phone or security cameras. Use a guest network or a separate smart-device network if your router supports it.
If your robot has connected to your main Wi-Fi and you are worried about exposure, change the Wi-Fi password. Use a strong, unique password and store it in a trusted password manager so you do not have to reuse or remember it. Then reconnect only trusted devices. Check out the best expert-reviewed password managers of 2026 at Cyberguy.com
Open your router app or admin page and review connected devices. Look for anything unfamiliar. Remove devices you do not recognize.
Some routers let you isolate guest devices. Turn that on when available. This can keep the robot from seeing other devices on your network.
Owners should ask what remote diagnostic access remains, whether credentials are now unique per robot and whether the company will provide a true off switch for remote diagnostics.
Yarbo says security updates are delivered automatically once devices connect to the internet. Connect the robot through a guest network or an isolated smart-device network so it can receive the latest update without giving it access to your main devices.
Your phone holds your email, passwords, photos, banking apps and personal data. In this free, live online class, Kurt the CyberGuy will walk you step by step through simple phone security fixes you can do in real time. You’ll learn how to improve your privacy settings, spot the latest phone scams, use trusted security tools and walk away with a simple checklist to stay protected. Register here: CyberGuyLive.com
The Yarbo report is a reminder that convenience can come with hidden access. A robot mower may seem like a helpful yard tool, but under the hood, it can act like a connected computer with cameras, location data and a path into your network. The biggest concern is control. Owners need to know who can reach their devices, when remote access turns on and whether they can shut it off. A company should not expect you to trust a black box sitting on your Wi-Fi. If you own one of these robots, isolate it from your main network and push Yarbo for clear answers. If you are shopping for any smart yard device, ask about security before you ask about battery life.
Would you let a smart yard robot onto your Wi-Fi if the company could not clearly explain who can access it and when? Let us know by writing to us at Cyberguy.com
Sign up for my FREE CyberGuy Report
Copyright 2026 CyberGuy.com. All rights reserved.
