Guide
A robot with a camera, at home.
A robot that moves through your home sees more than a fixed camera: rooms, people, papers on the table, the bathroom door left open. Two real cases show what can go wrong, and European law now sets rules for connected devices. Before you let one in, these are the questions worth asking, and how we are designing Alkyon to answer them.
In short. In 2022, MIT Technology Review found that photos taken by development versions of a Roomba, among them a woman on the toilet, had been posted online by contract workers labelling them for AI training. In 2024, researchers showed that several Ecovacs robots could be taken over from a distance, cameras included, and hijacked robots in the US shouted abuse at their owners. In the EU, certain wireless devices have had to meet cybersecurity rules since August 2025, and the Cyber Resilience Act adds security updates for a stated period from December 2027. Ask where the pictures go, who can see them, and how long the maker will fix flaws.
When training photos leaked
In December 2022, MIT Technology Review published fifteen screenshots from development versions of iRobot’s Roomba J7 series: rooms in homes in the United States, Japan, France, Germany and Spain, a boy lying on a hallway floor, and a woman sitting on the toilet. iRobot said the photos came from special development robots with modified hardware and software, used in 2020 by paid data collectors and employees who had signed agreements, with a green sticker on each robot saying it was recording video. The photos had been sent to Scale AI, whose remote workers label images to train AI; gig workers in Venezuela shared some in private groups on Facebook and Discord. iRobot said the sharing broke its agreement with the labelling company, and ended the contract.
A follow-up in January 2023 found that the testers’ agreements allowed the data to be used for machine learning but did not say plainly that other people would look at the pictures. The lesson reaches beyond one company: training a robot to see means people somewhere may see what it saw, and one person signing a form does not speak for everyone in the home.
When robots were taken over
In August 2024 the security researchers Dennis Giese and Braelynn Luedtke showed that a range of Ecovacs robot vacuums and lawn mowers could be taken over through Bluetooth from a phone, from as far as about 130 metres, and that the attacker could then reach the cameras and microphones; the robots showed no light when that happened. Ecovacs first said it would not fix the flaws, then that it would. In October 2024 an ABC News reporter, with the owner’s consent, watched live through a Deebot X2’s camera from a park outside. ABC also reported that in May that year hijacked Deebot X2 robots in Minnesota, Los Angeles and El Paso had been driven remotely and had shouted abuse at their owners. The four-digit PIN meant to guard the camera was checked only in the app; Ecovacs said that flaw had been fixed and that the owner’s password had likely been stolen elsewhere. The X2 held a TÜV Rheinland certificate for a consumer IoT security standard, and TÜV said attacks like these were outside what it examined.
What EU law now requires
- Since 1 August 2025. Certain categories of wireless devices placed on the EU market must meet cybersecurity, personal data and privacy requirements under the Radio Equipment Directive.
- Since 11 September 2026. Under the Cyber Resilience Act, makers must report actively exploited vulnerabilities and severe incidents, with an early warning within 24 hours.
- From 11 December 2027. Products with digital elements must be secure by design and by default, and makers must handle vulnerabilities and supply security updates, free of charge, for a support period that should normally be at least five years. The end of that period, month and year, must be stated at the time of purchase.
- Your data. If pictures or a map of your home leave the house, the GDPR lets you ask for a copy and for deletion: your data rights.
Questions to ask any home robot
- Where are the pictures processed: at home, or in someone’s cloud?
- Does the maker use pictures from homes to train its AI? If so, is it opt-in, who labels them, and are faces blurred first?
- Is anything recorded by default, and for how long is it kept?
- Does it show when the camera is live, in a way that cannot be switched off remotely?
- Can you mark rooms or areas it must not enter?
- Can you see what it saw, and delete it? Is your data deleted when you delete the account?
- Does the account offer a second login step, so a stolen password is not enough?
- Until when will it get security updates?
- Can anyone in the room stop it at once?
- Who else could see through it: support staff, partners, anyone else?
How Alkyon is being designed to answer them Concept
- At home, not in the cloud. The camera, raw sound and the map of your home are processed and kept at home, on its dock.
- Trained on public photos, not your home. Its camera model has been trained on openly licensed photographs, not on pictures from anyone’s home: how we teach it to see.
- Places it does not go. No-go areas you draw on the map in our app are planned; doors to a balcony or to the outside are no-go by design.
- Distance from people. It is designed to keep a metre from anyone in the room.
- A stop anyone can use. Two presses on Lychnos Ring stop it.
- Updates with an end date you know. We plan to state the support period at purchase, as the Cyber Resilience Act will require.
What is not decided yet
How long anything is kept, and what you can see and delete in the app, will be set before Alkyon is offered, and written in its own privacy notice. Until then, these are design goals, not promises about a product you can buy. More about what leaves your home in privacy by design, and the rules we build into Alkyon in rules for a robot at home.
Sources, read 4 November 2026: Eileen Guo, MIT Technology Review, a Roomba recorded a woman on the toilet. How did screenshots end up on Facebook?, 19 December 2022, and Roomba testers feel misled after intimate images ended up on Facebook, 10 January 2023; Lorenzo Franceschi-Bicchierai, TechCrunch, Ecovacs home robots can be hacked to spy on their owners, researchers say, 9 August 2024; Julian Fell, ABC News, we hacked a robot vacuum and could watch live through its camera, 4 October 2024, and hackers take control of robot vacuums in multiple cities, 11 October 2024; European Commission, Cyber Resilience Act and its summary and FAQ, and Radio Equipment Directive.
Questions
Can a robot vacuum be hacked?
Some have been. In 2024 researchers showed that several Ecovacs robots could be taken over through Bluetooth from more than 100 metres away, cameras included, and that year hijacked Ecovacs Deebot X2 robots in the US were driven remotely and shouted abuse at their owners. Ecovacs later said it would fix the flaws.
Do robot vacuums send pictures to the cloud?
It depends on the model and its settings. In the iRobot case, photos from development robots used by paid data collectors and employees were sent out for labelling to train its AI, and some were leaked by contract workers. Most makers that answered MIT Technology Review said they do not use customer data for training. Ask, and read the privacy notice.
What does EU law require of a connected home robot?
Since 1 August 2025, certain wireless devices sold in the EU must meet cybersecurity and privacy requirements under the Radio Equipment Directive. From 11 December 2027 the Cyber Resilience Act requires products with digital elements to be secure by design and to get security updates for a support period, normally at least five years, whose end date is stated at purchase.
Does Alkyon recognise faces?
Its camera model is trained to notice people, cats, dogs and curtains, so it can keep its distance. Recognising who someone is, is not part of the concept.