AINEWS
A coding agent — an AI assistant you direct in plain English to write and revise code — has collapsed the time and psychological cost of tinkering with the undocumented APIs inside robot vacuums, smart plugs, and other connected devices, and
On a Saturday morning, a hobbyist points a coding agent at the network traffic of a robot vacuum and asks it to find the commands the vendor never published. By Sunday, the vacuum is running on a schedule the app does not support. The weekend is the story, and the maker is not unusually skilled. The cost of reverse-engineering a home device has dropped below the cost of emailing support.
That is the mechanism Simon Willison named in a 20 July 2026 post on his personal blog, and it is bigger than one maker. The post collects "anecdotes from people" — a first-person aggregation of user reports, not a measured study — and the pattern is the same in each: a hobbyist intercepts the traffic between a phone app and a connected device, asks a coding agent to make sense of it, and ships a small automation the vendor never shipped. Smart plugs get toggled by a calendar. Garage doors open from a dashboard. Printer ink levels surface in Home Assistant. None of this is new in the abstract; the novel part is how it feels.
Before coding agents, the same project was possible. A developer could MITM a phone app, replay captured requests, and build a local API for the device. The work was not hard. It was long, and it was commitment. An undocumented API is, by definition, unstable: the vendor can change the encryption, retire the endpoint, or ship a firmware update that breaks every custom integration overnight. Anyone who had ever maintained a brittle scraper knew the score. The question was not "can I do it," it was "do I want to spend a week on something I will probably have to redo in six months." Most people answered no. That answer is the barrier that fell.
A coding agent changes the work in three concrete ways. It writes the boilerplate — the SSL pinning bypass, the protobuf parser, the request signer — in seconds, so the hobbyist spends their attention on the device instead of the plumbing. It fails cheaply: a wrong guess costs a paragraph of prompt, not a Saturday. And, most underappreciated, it makes the throwaway version cheap to throw away. If the vendor pushes a firmware update in November and breaks the integration, the rebuild is another evening, not another weekend. The maintenance penalty that used to scare people off has shrunk to the point where Willison argues the psychological baggage no longer dominates the decision.
The cost-threshold framing matters because it is falsifiable. "AI is changing the smart home" is a vibe. "Reverse-engineering has moved from a multi-week commitment to an evening throwaway" is a claim a reader can check against their own to-do list. It also gives the reader a tool they did not have before: a way to price the vendor-dependency risk of any new connected device they consider buying. A $300 robot vacuum that exposes a documented local API is now competing with a $200 one whose undocumented API is a weekend project. The hidden maintenance cost has moved, not disappeared.
It has not disappeared, and the honest version of the story has to say so. Vendors can break reverse-engineered automations on purpose, and a few will, especially when the bypass touches a paid feature or a safety surface. Security researchers have reasonable concerns about a world where the protocol of every connected device is one prompt away from a working client; the same tool that helps a tinkerer's vacuum follow a calendar helps a less benign actor fingerprint a network. And "cheap to maintain" is not "free to maintain." The hobbyist who ships the integration is signing up for a low-grade subscription of firmware-watching and patch-when-it-breaks, paid in evenings instead of weekends. Anyone who has run a home server for ten years knows the second number is bigger than it looks.
The buyer's question, then, is not whether the device can be reverse-engineered. As of this week, the answer for most mainstream connected devices is yes, cheaply. The buyer's question is whether the vendor will make the workaround cheap to keep, and the realistic answer right now is: only as long as nobody important notices.