Yes, the reports were real—but the vacuums were not “randomly” swearing. In October 2024, owners in several U.S. cities said hackers took control of Ecovacs DEEBOT X2-series robot vacuums, making them move without permission and broadcast racist abuse or obscenities through their speakers. The same security weaknesses raised more serious concerns about unauthorized camera, microphone, and live-video access.
The exact intrusion route has not been publicly established for every reported victim. However, independent researchers demonstrated major Ecovacs security flaws, ABC News reproduced control of an X2-series robot, and Ecovacs later published firmware fixes.
As an Amazon Associate I earn from qualifying purchases.
What happened?
Several U.S. owners reported that their Ecovacs DEEBOT X2-series vacuums began moving on their own and speaking through their built-in speakers. One reported victim, Minnesota lawyer Daniel Swenson, said someone appeared to access the robot’s live camera and controls before the device began broadcasting abuse.
ABC News reported multiple incidents and independently demonstrated that an X2-series robot could be hacked. The reports involved Ecovacs DEEBOT X2-family machines—not every robot vacuum, and not every Ecovacs owner.
#1 Best Overall
- 【2-in-1 Mopping and Vacuuming】 The ROPVACNIC Robot S1 integrates advanced electronically controlled mopping technology, significantly enhancing both cleaning efficiency and effectiveness, which makes your floors remain free from footprints, dirt, and dust throughout the day. It features an upgraded high-capacity water tank with a four-stage personalized water adjustment system, enabling it to address various stains across different settings according to user requirements.
- 【Comprehensive Intelligent Control】 Multiple Cleaning Modes, combined with personalized settings, allow you to easily accomplish various household cleaning tasks with zero effort from your smartphone. Moreover, by voice commands, you can start your cleaning while kicking back and relaxing (compatible with Alexa or Google Assistant). Enjoy an utterly hands-free cleaning experience.
- 【5200Pa Powerful Suction】A 3-point cleaning system coupled with strong suction ensures your floors are free from all dirt, dust, and crumbs for a thorough, superior clean. The highly passable compact design combined with 3-level suction facilitates cleaning in hard-to-reach areas where you can't, making it suitable for a wide range of surfaces from wood, and hard floors to low pile carpets.
- 【Smarter High Automation & Self-Recharge】 The robot aspiradora is equipped with an advanced high-coverage sensing system and multiple algorithmic data points, enabling autonomous completion of cleaning tasks—from scheduled starting, detecting obstacles, adjusting direction, and switching modes, to automatically returning to recharge. This hassle-free operation ensures a clean home when you return.
- 【Engineered for Pet Owner】 The exclusive no-entanglement design negates the need for your dirty hands to clean up tangled dog or cat hair, unlike traditional roller brushes. Its dual rotating electric side brushes sweep and collect hidden pet hair more efficiently throughout the house, saving you the hassle.
The accurate description is therefore unauthorized hijacking of vulnerable connected robots, not a software malfunction that caused the machines to develop offensive speech.
Which Ecovacs models were involved?
The reported racial-slur incidents centered on the DEEBOT X2 and X2S family. Ecovacs’ broader vulnerability advisory covered additional products:
- DEEBOT X2 OMNI
- DEEBOT X2S
- DEEBOT X2 COMBO
- DEEBOT X5 PRO, X5 PRO PLUS, and X5 PRO ULTRA
- DEEBOT T30 OMNI and T30S
- GOAT G1 variants and GOAT GX-600 robotic lawnmowers
This broader list identifies products covered by the security advisory. It does not prove that every listed model was used in the reported harassment incidents.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →How could someone take control?
Security researchers Dennis Giese and Braelynn Luedtke presented their Ecovacs reverse-engineering research at DEF CON 32 in August 2024. Their work documented weaknesses involving Bluetooth communications and device authentication that could enable unauthorized control and access to sensitive functions. The DEF CON presentation describes the technical findings.
The vulnerability later recorded as CVE-2024-52325 involves command injection through the SetNetPin() function over an unauthenticated Bluetooth Low Energy connection. CISA’s assessment rates the issue as critical under CVSS 3.1.
There is an important limitation: the CVSS vector includes AV:A, or adjacent attack position. In practical terms, exploitation of the Bluetooth flaw generally requires an attacker to be nearby or to occupy a relevant nearby network position. It should not automatically be described as an internet-wide attack in which any stranger anywhere can seize any vacuum.
Rank #2
- 5000Pa Strong Suction: Robot Vacuum With 5000Pa suction power, it effortlessly removes pet hair, dust, and debris from all types of floors. It can also easily clean on short-pile & medium-pile carpets
- Vacuum & Mop in One Go: G8000 Max robot vacuum is equipped with 450 ml dustbin and 300 ml water tank combo, it supports simultaneous vacuuming and mopping in one go. The innovative design reduces cleaning time by 50%, enhancing household efficiency
- Long Battery Life, Always Ready: Up to 150 minutes in quiet mode, meeting daily cleaning needs and automatically recharging when the battery is low, always ready for the next cleaning task
- 4 Control Ways & 4 Cleaning Modes: Supports 4 control methods: App, Remote, Voice, and Button, making it ideal for wives, seniors, and parents. Choose from 4 cleaning modes(Spot, Edge, Zig-zag, and Manual cleaning) to meet your daily cleaning needs. The Zig-zag mode ensures maximum coverage and cleaning efficiency
- Ultra-Slim Design, Smart Sensors: The robot cleaner is 2.99 inches in height, it easily reaches under beds, sofas, and cabinets for thorough cleaning. With anti-collision and anti-fall sensor technology, it intelligently navigates around obstacles, walls, and stairs
Another possible route discussed in reporting was compromised app credentials or credential-stuffing attacks. Ecovacs reportedly said it found no evidence that its own systems had been breached to obtain user credentials. These possibilities are distinct, and the public evidence does not establish that one method caused every reported incident.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What could an attacker do besides make the vacuum speak?
The offensive audio attracted attention, but it was not the most serious capability at stake. Depending on the model and the access obtained, an attacker could potentially:
- Drive or redirect the robot.
- Operate its speakers or other controls.
- Access camera functions on camera-equipped models.
- Use or access microphones.
- View live video or observe activity inside the home.
- Use the robot as a foothold for attacks against other smart-home devices.
TechCrunch reported on researchers’ concerns about camera and microphone access. Ecovacs also published a later advisory about insufficient PIN validation for live video-feed access in its app.
A robot with a camera, microphone, cloud account, and remote-control features is effectively a mobile networked sensor inside the home. That makes its security and privacy exposure substantially greater than that of a basic vacuum operated only with physical controls.
What was verified—and what was not?
Reported victim incidents
ABC News reported accounts from multiple owners in different U.S. cities and identified the devices as Ecovacs DEEBOT X2s. Those accounts establish that the incidents were reported and investigated, but there is no publicly released forensic report proving the precise intrusion path for every affected machine.
Independent demonstrations
ABC said it was able to hack an X2-series robot for its investigation. The DEF CON research independently demonstrated serious control and privacy weaknesses in Ecovacs robots. Together, those demonstrations show that the reported behavior was technically plausible and that the products had significant security problems.
Rank #3
- Fits Pet Owners and Hard Floors: With a tangle-free suction port, V2 robot vacuum focuses on picking up hair without tangle; It also tackles dirt, crumbs and debris effectively on hardwood, tile, laminate, stone and low pile carpet
- Ultra-Slim Design: The 2.99-inch low profile allows the V2 robot vacuum cleaner to easily clean under beds, sofas, and other furniture
- Friendly Remote Control: The V2 vacuum robot equipped a physical remote control, no Wi-Fi connection is required for operation. Start cleaning easily via the remote or one-touch button, simple to operate for all family members
- Multiple Cleaning Modes: The V2 robot vacuum cleaner features multiple cleaning modes including auto clean, spot clean, and edge clean for thorough coverage
- Schedule Cleaning & Automatic Charging: V2 vacuum robot can run routine cleaning automatically based on preset schedule, it cleans up to 120 minutes on a single charge and automatically returns to the charging dock when the battery is low
Vendor remediation
Ecovacs published security advisories and fixed firmware versions. That confirms the company recognized relevant vulnerabilities and released remediation. It does not, by itself, prove that every reported incident was caused by CVE-2024-52325 or that every device worldwide has been updated.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Ecovacs firmware fixes
In its November 19, 2024 advisory, Ecovacs listed these fixed versions:
| Product | Fixed version listed by Ecovacs |
|---|---|
| DEEBOT X2 OMNI | 1.76.6 |
| DEEBOT X2 COMBO | 1.81.10 |
| DEEBOT X2S | 1.49.0 |
| DEEBOT X5 PRO | 1.70.0 |
| DEEBOT X5 PRO PLUS | 1.38.0 |
| DEEBOT X5 PRO ULTRA | 1.17.0 |
| DEEBOT T30 OMNI | 1.93.0 |
| DEEBOT T30S | 1.95.0 |
| GOAT G1 variants | 1.36.187 |
| GOAT GX-600 | 1.2.120 |
These are the versions listed as fixes in the Ecovacs advisory and NVD record. They should not be treated as the latest available firmware in 2026; check the ECOVACS HOME app for the current version offered to your exact model.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What owners should do now
- Identify the exact model. Check the label, app, or product page rather than assuming that all Ecovacs devices are covered in the same way.
- Check for firmware updates. In the app, the general path is Enter → Settings → Robot Advanced Settings → About Your Robot → Upgrade. Some DEEBOT interfaces instead use Smart Cleaning → Settings → About DEEBOT → Update DEEBOT. Ecovacs’ firmware instructions may vary by region and model.
- Keep the robot charging. Make sure it has enough battery and a stable Wi-Fi connection while updating.
- Use a unique account password. Do not reuse the Ecovacs password on another service. Sign out of other sessions if the app provides that option.
- Disable unnecessary features. Turn off camera, microphone, live-video, or remote-control functions when you do not need them.
- Consider network isolation. A separate guest or IoT network can limit how a compromised robot interacts with computers and other smart-home devices, although it does not repair the robot itself.
- Preserve evidence if behavior is suspicious. Record dates, screenshots, app alerts, firmware details, and video. Then power the robot down, remove it from the network, and contact Ecovacs support.
If an update fails
Keep the robot docked and charging, verify that your phone and robot are using the correct Wi-Fi network, and retry through the model-specific support page or app. Do not install unofficial firmware or attempt to test the vulnerability on a device you do not own. If the update still fails, use Ecovacs’ failed-update guidance and contact support.
Should you avoid connected robot vacuums?
This incident does not prove that every connected vacuum is unsafe, and it does not prove that every current Ecovacs model remains vulnerable. It does show why a robot’s security features matter as much as its cleaning performance.
Before buying, ask:
- Does it have a camera or microphone, and do you need them?
- Can it clean using local controls without a cloud account?
- Does the manufacturer publish security advisories and fixed versions?
- How long is firmware support expected to last?
- Does the account support multifactor authentication?
- Can the robot be placed on an isolated IoT or guest network?
- Is there a physical camera shutter or hardware microphone switch?
- Can remote viewing and two-way audio be disabled?
For readers who want to minimize cyber risk, the lowest-exposure option may be a simpler robot without a camera or microphone, a model that works without cloud-dependent features, or a conventional non-connected vacuum. That is a risk-based choice—not a claim that any particular competitor is automatically safer.
The bottom line
The viral story was real: reported owners’ Ecovacs DEEBOT X2-series vacuums were allegedly hijacked and used to broadcast abuse. The machines were not randomly malfunctioning. Researchers and journalists demonstrated serious Ecovacs control and privacy weaknesses, and Ecovacs later listed patched firmware versions. Owners should identify their model, install every available update, secure their account, and disable camera, microphone, and remote-access features they do not need.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
