I got run over by a robot lawn mower controlled by a hacker.

I’m sprawled out on the ground, and the robot lawn mower is closing in on me. With a sudden jolt, it’s climbing up my chest. If Andreas Makris doesn’t hit the emergency stop soon, this 200-pound machine could slice right through me. The catch? Makris is nearly 6,000 miles away, remotely controlling this mower to showcase the glaring security flaws in Yarbo’s robotic lawn mowers. And here I am, lying in its path to test just how far he can push it.

By the time the mower makes contact, Makris has already made his point: Yarbo’s $5,000 robot lawn mowers are riddled with security vulnerabilities, allowing a hacker from anywhere in the world to take control of these dangerous machines. And it’s not just one mower; thousands of them are at his command. Every Yarbo robot, whether it’s mowing grass, clearing snow, or tackling weeds, is potentially under his control.

“I can do whatever I want with all the bots,” Makris states. “It’s completely unsecured.”

And that’s just scratching the surface. Much like Sammy Azdoufal, who gained notoriety for commandeering thousands of DJI Romo robot vacuums, Makris found that Yarbo’s robots operate similarly. Gain access to one, and you can access them all.

But these aren’t just harmless vacuums; they come equipped with blades, and hackers can exploit the robot’s commands to bypass safety features. Even if you hit the emergency stop button, a hacker can send a command to unlock it, according to Makris.

Since the Yarbo runs on a full Linux system, complete with a backdoor and a hardcoded root password, hackers could reprogram it to do anything: activate the blades, probe your home network, or even turn the robot into a botnet for malicious activities.

Yarbo, founded in 2015 as a snowblower company, now offers versatile yard robots that can switch between mowing, leaf blowing, snow clearing, trimming, and edging. Each attachment is powered by the same core robot, which uses tank treads for mobility — making all of them susceptible to hacking.

Makris shows me a color-coded map displaying the locations of nearly every Yarbo robot in the U.S. and Europe, totaling around 5,400 devices (he’s tracking over 11,000 globally). Then, during a video stream, he takes control of a robot in upstate New York.

This mower is already working in a field, with a white house in the background. We interrupt its task, and as Makris moves a virtual joystick, I watch the robot’s camera pivot in response. There’s nothing stopping him from driving it anywhere, potentially spying on the family living there and tracking their comings and goings.

The implications are serious; a malicious actor could easily monitor sensitive locations, like troop movements near a nuclear facility. Makris has already identified 12 Yarbo robots within 3 kilometers of a major power plant, one registered to a nuclear security analyst.

Then, he reveals something that leaves me stunned: he can access owners’ email addresses, Wi-Fi passwords, and precise GPS coordinates of their homes. When I look up one address on Google Maps, I see a satellite view that matches what we saw through the robot’s camera.

Days later, I’m driving through the Silicon Valley foothills, searching for evidence. At the first house on my list, my heart races. Peering into a backyard, I spot a Yarbo robot exactly where Makris indicated it would be. Scanning for local Wi-Fi networks, I find the same private access points he discovered.

After emailing the owner using the email address obtained from the robot, I get a response. Wayne Yu, a self-proclaimed gadget enthusiast, wants to know how his robot lawn mower led me to him. He’s not worried about the robot revealing images of his house. “People are always hacking into devices, so I’m not surprised,” he says.

He’s also unconcerned about someone stealing his mower: “It’s heavy, and it’s uphill — you can see that, right? For me to walk down to the lawn mower, it’s hurting my legs already,” he laughs, explaining that the steep terrain is why he bought a Yarbo in the first place. But when I mention that a hacker halfway around the world led me to his door and provided his email and Wi-Fi passwords, he admits he feels uneasy. “Not good. Not good,” he repeats.

When I show him the Wi-Fi passwords, he confirms they’re accurate. It’s all too real.

Matt Petach, a retired network architect and Yarbo owner, is less surprised by my visit. He remains unfazed even when I reveal his Wi-Fi password, explaining it’s an isolated guest network that rejects unknown devices, and the guest password is just his publicly listed phone number.

Petach believes everyone should treat gadgets like these as potential threats. “It is unfortunate that in the name of convenience, homeowners and other users are really invited to treat technology as their best friend, their confident helper,” he tells me. He likens poor security to a power tool missing safety features: “This is a lot more like a chainsaw without a handguard, without a brake, with a loose chain that’s ready to take your leg off at a moment’s notice.”

Even Petach is taken aback by Yarbo’s security practices. Makris explains that not only does each Yarbo robot have the same hardcoded root password, but owners can’t simply set a better password. Every time Yarbo updates the firmware, it resets the root password to the default. Hackers can waltz right back in. “Wow, that’s even worse than I thought,” Petach remarks.

It seems Yarbo has intentionally created a remote-access backdoor that allows hackers to exploit the system. “It is deployed automatically to every robot, cannot be disabled by the owner, and is actively restored if removed,” Makris notes.

That’s why Makris has chosen to publish his findings, including official vulnerability disclosures, without giving Yarbo a chance to fix the issues first. When he initially contacted Yarbo about the vulnerabilities, he couldn’t find a security contact or bug bounty program, and the company’s customer support dismissed remote access as a harmless feature for diagnosing customer issues.

Based on this and what he’s observed about Yarbo’s security practices — “either they don’t care enough or it’s a skill issue,” he says — Makris fears that companies like Yarbo won’t address these problems unless they face public scrutiny. “It’s the right thing to do, and that’s what we’re trying to do here: warning people and getting the information out for people to understand that this is by design bad and nobody seems to care,” he explains.

There are also reasons to question Yarbo’s credibility. The company claims its “corporate headquarters” is in New York, showcasing images of upscale offices on its Kickstarter page and website. However, Google Maps reveals its actual New York address is a single-story building that also houses two auto detailers, an insurance agency, and an Etsy shop selling spiked leather bracelets. In reality, Yarbo is just another name for Hanyang Tech, based in Shenzhen, China.

Attempts to review Yarbo’s lawn mowers have been met with unusual requests. The company’s PR contacts have repeatedly sought assurances against negative reviews and once asked for a “Cooperation Agreement” that included a non-disparagement clause, requiring us to “create and share a dedicated review article within 21 business days.” (We declined.) More recently, they suggested that if the product didn’t meet expectations during testing, we should anticipate not including Yarbo in the final article. (Again, we did not agree.)

In response to Makris’ research, Yarbo has stated it will take action. Initially, the company claimed its “diagnostic environment is not publicly accessible” and downplayed concerns, but a senior PR manager later acknowledged that Yarbo has identified a fix for at least one issue.

“Following our internal review of the concerns brought to our attention, we identified an issue related to permission handling within part of the communication process between the Yarbo app and backend services. A fix has already been developed, and we are currently preparing the rollout. We expect the update to be deployed very soon,” he stated, adding that the company is continuing its investigation.

(Note that many of the issues are in the robot’s firmware, not just in app-to-server communication.)

Yarbo is also “actively implementing an in-app customer approval mechanism, clearer session visibility, stronger audit logging, and customer-facing access history so that remote diagnostic access is transparent, limited, and revocable,” he added, and the company is “actively planning a dedicated Security Response Center on our website to provide a clearer channel for vulnerability reporting and researcher engagement.” They’re also considering a bug bounty program.

“We understand the seriousness of the concerns raised, and we are treating this as a priority matter,” he said.

When Makris first alerted the company that remote access posed a significant security risk, Yarbo insisted that “your Yarbo remains completely secure and under your exclusive control.”

That’s why I find myself lying beneath a Yarbo mower — as part of a controlled test to assess just how safe and “secure” this machine really is. I’ve learned that the risks extend far beyond the blades; we’re living in a digital wild west where modern gadgets can reveal your exact GPS location, stream live video of your home, and compromise your home network in an instant.

Conversations with researchers like Makris reveal that Yarbo is just one glaring example in a sea of insecure devices. But a case like Yarbo helps illustrate just how dire the situation has become.

One Friday, with permission, I arrive at Petach’s house. We connect via video call: Makris in Germany, Petach in Southern California, and me as the only one physically present. With a few clicks, Makris takes control of the Yarbo right before my eyes, both while it’s idle and during its mowing sessions. I can see that he sees me through the robot’s cameras.

It’s time to test if the Yarbo has any built-in safety features, like obstacle avoidance. I lie down on the ground.

I’m not reckless. The blades aren’t spinning, and we’re running the robot in reverse — so its tank treads, not its blades, will hit me first.

But as the first hundred pounds of metal, plastic, and far-too-hackable computer pin me to the ground — and thankfully, Makris eventually backs off — I realize this experiment isn’t as safe as I had hoped.