📰 Full Story
Security researcher Andreas Makris published on May 7–9, 2026 findings that thousands of internet-connected Yarbo lawn mowers worldwide contain critical vulnerabilities that allow remote takeover, data exfiltration and persistent backdoor access.
Makris said he could view telemetry, camera feeds, GPS coordinates and owners’ Wi‑Fi credentials from roughly 11,000 devices across more than 30 countries, including about 5,000 in the United States.
He demonstrated remote control of a mower while a reporter from The Verge lay beneath it; the device’s identical default root password across units, firmware resets and an apparently undeletable diagnostic tunnel were central to the exploit.
Yarbo has acknowledged the core findings, temporarily cut off remote access, and pledged remediation including device‑level credentials and other fixes to roll out within about a week, but stopped short of removing the remote access tunnel entirely — saying it will remain for “authorized internal personnel” under tighter controls and auditing.
Reporting also linked aspects of Yarbo’s software and telemetry to companies in China, which Yarbo disputes while saying it is establishing a dedicated security response team.







💬 Commentary