LC-3 · Consumer Risk Bulletins

Kinematic Risk Consumer Bulletin

# Kinematic Risk Consumer Bulletin

**LRRK Watch / Open-Source Intelligence** — Five current signals across consumer systems that sense, move, and act in homes and yards.

**Issue type.** Decade retrospective — trust, privacy, and control fabric (companion to the physical-harm issue).

| Field | Value |
| --- | --- |
| Collection cutoff | 19 August 2026 |
| Window | 1 August 2016 – 19 August 2026 |
| Data label | Open-source intelligence // LRRK analytic product |
| Handling | Public-source material. Image rights require separate verification before publication. |
| Spine | SEC, CMA, FTC, CISA, vendor notices, named newsrooms, dockets. |
| Color | Forums annotated only. Reddit `site:` returned no threads in collection; color is limited to pages actually opened. |

## Executive read

### BLUF

The decade’s consumer-robot trust failure is a three-step: maps and cameras made the home a data object, a Big Tech buyer was waved off, and the category leader still ended up owned by its Chinese OEM. Companion robots died twice — at shutdown, then again if a “savior” took preorders. Home humanoids are already taking money under no dedicated CPSC rule, with a stranger on a headset as the safety story.

### Key judgments

1. **[Assessment — High confidence]** Amazon–iRobot was treated as a marketplace-plus-data merger, not a vacuum deal. The CMA cleared it. The EU and FTC made the path politically unwalkable. iRobot then went through Chapter 11 to Shenzhen Picea (23 January 2026) with an “iRobot Safe” US data subsidiary.
2. **[Assessment — High confidence]** Camera robots failed basic hygiene: outsourced annotators saw J7 development footage (including minors’ faces, which iRobot did not treat as sensitive), and Ecovacs shipped BLE / token / indicator failures that later drew CISA ICSA-25-135-19.
3. **[Inference — Moderate confidence]** The live home-humanoid risk at cutoff is **teleoperated stranger-in-the-house** (1X NEO) and **unset internal safety culture** (Gruendel v. Figure, allegations unadjudicated), not a filed consumer injury.

### Analytic labels
- **Fact** — verified reporting or primary record
- **Assessment** — analytic judgment
- **Inference** — reasoned but not directly observed
- **Uncertainty** — unresolved information gap

### Source grades
- **A1** — authoritative primary record / directly confirmed
- **B1–B2** — generally reliable and corroborated
- **C3** — useful but requires caution

---

## 01. Amazon walks away; Picea walks in

*Event / publication dates: merger agreement 4 August 2022; CMA clearance 16 June 2023; EC Phase II 6 July 2023; termination 29 January 2024; Chapter 11 RSA 14 December 2025; emergence 23 January 2026*

**Product class.** Robot vacuums / mop combos

**Verified record — [Fact — A1 / B1]** Amazon agreed to buy iRobot at $61/share, about $1.7B including net debt (SEC EX-2.1, 4 August 2022). The UK CMA **cleared** Phase 1 on 16 June 2023: iRobot UK share “modest”; RVC data “generally not considered to be an important input” to UK smart-home platforms. [CMA](https://www.gov.uk/government/news/amazon-s-purchase-of-roomba-maker-cleared-by-cma). The European Commission opened Phase II (case M.10920) and, on 27 November 2023, a Statement of Objections that Amazon could delist, demote, or starve ads of rival robot vacs; EC HTML press pages did not render in this collection (B2 via contemporaneous reporting). On 29 January 2024 the parties terminated: Amazon said there was “no path to regulatory approval in the European Union.” [Amazon](https://press.aboutamazon.com/2024/1/amazon-and-irobot-agree-to-terminate-pending-acquisition). FTC Associate Director Nathan Soderstrom the same week: the probe “focused on Amazon’s ability and incentive to favor its own products and disfavor rivals’, and associated effects on innovation, entry barriers, and **consumer privacy**.” [FTC](https://www.ftc.gov/news-events/news/press-releases/2024/01/statement-regarding-termination-amazons-proposed-acquisition-irobot). **FTC did not sue. EU did not issue a prohibition. CMA approved.**

On 14 December 2025 iRobot announced a restructuring support agreement with Shenzhen Picea and a pre-pack Chapter 11 in Delaware. On 23 January 2026 it emerged private, wholly owned by Picea; common stock cancelled; “iRobot Safe Corporation” created for US consumer data; HQ stays Bedford, MA. [SEC exhibit 99.1](https://www.sec.gov/Archives/edgar/data/1159167/000115916726000006/exhibit991.htm). iRobot media page for 14 December 2025 timed out in collection; Reuters/AP covered the filing.

**Threat landscape.** Blocking a US/EU platform buyer did not preserve an independent Western robot-vac champion. The residual owner is the contract manufacturer / secured lender. “Safe Corp” is the first post-bankruptcy data-governance theater in this class. The physical robot did not change; the trust path did.

**Forum / community notes.** Mashable (August 2022) alludes to a 2021 r/Roomba post on camera reach; **the thread was not opened**. [Mashable](https://mashable.com/article/amazon-roomba-acquisition-impact-on-consumers) — C3, unverified.

**Intelligence assessment.** [Assessment — High confidence] This is the decade’s market-structure precedent. [Inference — Moderate confidence] Home-map and camera politics will now attach to a PRC OEM owner whether or not any data actually moves. [Uncertainty] How “iRobot Safe” is ring-fenced in practice is not established from the exhibit alone.

**Opportunity.** The first privacy complaint or CFIUS-equivalent review of Picea-era telemetry would test whether Safe Corp is a control or a label.

**LRRK relevance.** Passport and Control Fabric. Campaign: who owns the map. Watch: Picea-era privacy notices and any Safe Corp filing.

**Confidence.** High on CMA/FTC/Amazon termination and on the 23 January 2026 emergence exhibit. Moderate on EC SO detail (HTML not rendered). Low on Safe Corp effectiveness.

---

## 02. The bathroom was a training set

*Event / publication dates: images June–November 2020; MIT Technology Review 19 December 2022; CEO “sell the maps” week 24–28 July 2017*

**Product class.** Robot vacuums (camera SKUs)

**Verified record — [Fact — A1 / B1]** MIT Technology Review obtained 15 screenshots posted by Venezuelan Scale AI gig workers in closed Facebook/Discord groups. Images came from **development J7-series** units, June–November 2020, US/Japan/France/Germany/Spain. iRobot: devices had green “video recording in progress” stickers; paid collectors signed consent; units “not and never were present on iRobot consumer products for purchase.” About **2 million** images shared with Scale; Scale confirmed 13 of 15 from an R&D project. CEO Colin Angle said iRobot terminated the leaking provider. iRobot does **not** treat faces, including minors, as sensitive because it says it must train human-avoidance. [MIT TR](https://www.technologyreview.com/2022/12/19/1065306/roomba-irobot-robot-vacuums-artificial-intelligence-training-data-privacy/).

The 2017 frame that made this land: Reuters-summarized remarks that iRobot “could reach a deal to sell its maps” to Apple, Amazon, or Google. Reuters later corrected to “share maps for free with customer consent.” iRobot: “does not sell customer data.” Reuters original returned 401 in this collection. [CNBC](https://www.cnbc.com/2017/07/24/roomba-maker-irobot-may-start-selling-the-maps-it-makes-of-your-home.html), [BBC](https://www.bbc.co.uk/news/technology-40714398), [TechCrunch](https://techcrunch.com/2017/07/28/irobots-ceo-says-the-company-never-planned-to-sell-roomba-home-mapping-data/).

**Do not write:** retail Roombas photographed a woman on the toilet and iRobot leaked it. That is the viral version. The record is development / paid-tester units and a crowdsourced annotator.

**Threat landscape.** A camera on the floor plus an outsourced labeling chain. “We don’t sell maps” does not answer “a stranger saw the bathroom.” This is the case that taught consumers the difference.

**Forum / community notes.** None independently opened. Secondary accounts of owner split (“Amazon already has Alexa” vs “this is the line”) remain C3.

**Intelligence assessment.** [Assessment — High confidence] This is the canonical camera-on-the-floor + annotator case. [Inference — Moderate confidence] It supplied the privacy clause in the FTC’s later Amazon–iRobot sentence. [Uncertainty] Whether any retail firmware path ever sent equivalent frames is not established.

**Opportunity.** A regulator finding on human-in-the-loop annotation of home-robot video, or a change in iRobot’s “faces are not sensitive” policy under Picea.

**LRRK relevance.** Sense / Move / Act and Kestrel (training data as a trust path). Passport: who sees the frame.

**Confidence.** High on the MIT TR facts and iRobot’s on-record responses. Low on retail-unit equivalence.

---

## 03. Ecovacs: first home-robot ICS advisory

*Event / publication dates: DEF CON 32 / TechCrunch 9 August 2024; vendor “we will fix” 22 August 2024; Ecovacs advisory 19 November 2024 (page timed out); CISA ICSA-25-135-19 initial 15 May 2025, Update A 10 July 2025*

**Product class.** Robot vacuums; robotic lawn mowers (Goat G1); air-cleaning robots

**Verified record — [Fact — A1 / B1]** Dennis Giese and Braelynn Luedtke showed Ecovacs home robots could be abused to spy on owners. Devices named in press: Deebot 900/N8/T8/N9/T9/N10/T10/X1/T20/X2, Goat G1, Airbot Z1/AVA/ANDY. First vendor line: users “do not need to worry excessively.” [TechCrunch 9 Aug 2024](https://techcrunch.com/2024/08/09/ecovacs-home-robots-can-be-hacked-to-spy-on-their-owners-researchers-say/). Two weeks later Martin Ma said December 2023 emails were “inadvertently overlooked”; fixes for Goat G1, X1, and the app. Ecovacs advisory URL `ecovacs.com/global/userhelp/dsa20241119` timed out in collection.

**CISA ICSA-25-135-19** (opened): hard-coded WPA2-PSK and AES keys derivable from serial (CVE-2025-30198, CVE-2025-30200); unsigned OTA to the base station (CVE-2025-30199, CVSS v4 8.6). Affected X1 / T10 / T20 / T30 families below listed versions. Researchers: Giese, Luedtke, Chris Anderson. “No known public exploitation” at publication. [CISA](https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19).

This bulletin states impact only. It does not reproduce exploit steps.

**Threat landscape.** A market-leading camera robot with no trustworthy camera-on indicator and leftover cloud tokens after account deletion is a covert-camera problem whether or not anyone “sold the footage.” Vendor sequence: deny → press → “we overlooked the email” → advisory → CISA.

**Forum / community notes.** No owner-forum thread was opened. Do not invent r/Ecovacs reaction.

**Intelligence assessment.** [Assessment — High confidence] Best-documented home-robot-as-covert-camera case with a US government ICS advisory. [Inference — Moderate confidence] Serial-derived keys and unsigned dock OTA will recur in other white-label docks. [Uncertainty] Patch uptake in the installed base is unpublished.

**Opportunity.** A known-exploited listing, or a consumer class action that survives on the leftover-token and indicator facts.

**LRRK relevance.** Control Fabric, Kestrel, Lab. Watch: ICSA-25-135-19 updates and any CISA “known exploited.”

**Confidence.** High on TechCrunch-on-record and on the opened CISA advisory. Moderate on the November 2024 vendor advisory (page timed out).

---

## 04. Companion robots die twice

*Event / publication dates: Kuri 2018; Jibo ~4 March 2019; Anki 1 May 2019 / DDL Dec 2019; PA AG Sep 2024; Moxie ~10 December 2024; Astro for Business cease-function 25 September 2024; Neato cloud 6 October 2025*

**Product class.** Social / desk companions; toy / entertainment; security / home patrol; robot vacuums (Neato)

**Verified record — [Fact — A1 / B1]**

**Jibo.** Servers limited function ~4 March 2019 after IP sale to SQN. The unit delivered its own eulogy. No AG or class action found. [The Verge](https://www.theverge.com/circuitbreaker/2019/3/4/18250104/jibo-social-robot-server-shutdown-offline-dead).

**Anki → Digital Dream Labs.** Anki closed 1 May 2019; Vector had a “notable cloud component”; contracted engineers were to keep it up. DDL took IP and servers in December 2019. Hanchar: owners no longer had to worry about Vector dying. Original Vectors were **not** mass-bricked in April 2019. PA AG (filed ~18 September 2024, Allegheny CCP GD-24-010283) alleges ~**14,000** prepaid Vector 2.0 / Cozmo 2.0 / Butter orders, most unfulfilled, **$147–$655**, **>$4 million**, Mail Order Rule + UTPCPL. No judgment found through cutoff. A live attorneygeneral.gov release was not found; CBS Pittsburgh quotes the AG. [CBS](https://www.cbsnews.com/pittsburgh/news/pa-attorney-general-lawsuit-digital-dream-labs/).

**Moxie.** Cloud killed ~10 December 2024, no refunds except a non-guarantee for 30-day buyers, two weeks after the FTC staff paper on undisclosed software-support duration. Covered in the physical-harm issue as the legal-theory pair.

**Amazon Astro for Business.** Wound down 3 July 2024; units **stop functioning 25 September 2024**; full hardware refund + unused subscription + $300 credit. **Home Astro was not this brick.** [Reuters](https://www.reuters.com/technology/amazon-wind-down-its-astro-business-security-robot-2024-07-03/).

**Neato.** Vorwerk shut the company ~1 May 2023 and promised five years of support. Vendor notice **6 October 2025**: cloud “phasing out now” because “cybersecurity standards, compliance obligations, and regulatory frameworks have advanced”; “Updating this environment would not be technically meaningful.” Manual button still starts a full-house run. Warranty intact. [Neato](https://support.neatorobotics.com/support/solutions/articles/204000073686-announcement-6th-oct-2025). The five-year promise broke at about year two.

**Sony aibo ERS-1000.** Personality, memories, photos, app, OTA are rented. Non-renewal erases cloud memories; repair after lapse factory-resets the body. [Sony FAQ](https://www.sony.com/electronics/support/articles/00249669). No global ERS-1000 shutdown found through cutoff. 2006/2014 Aibo deaths are outside this window.

**Threat landscape.** Hardware can survive. The robot-as-companion cannot. The second harm is the rescuer who sells the next body as a prepaid future (DDL), or the parent who uses “cybersecurity compliance” to pull a working cloud (Neato). Amazon’s refund is the remediation baseline.

**Forum / community notes.**
- Neato owners, OpenPetition after 6 October 2025: demand Vorwerk stop “destroying working hardware,” keep the cloud or release a local path — [openpetition.org](https://www.openpetition.org/us/petition/online/vorwerk-need-to-stop-destroying-working-hardware-keep-neato-robotics-cloud-alive) (C3).
- Home Assistant alert 20 October 2025: official Neato integration will die — [alerts.home-assistant.io](https://alerts.home-assistant.io/alerts/neato/) (C3/ops).
- Anki owners, January 2020, quoted in The Verge: Vector as “family”; relief that DDL took the cloud — [The Verge](https://www.theverge.com/2020/1/5/21050378/anki-vector-saved-shutdown-servers-assets-bought) (C3 via B1).
- Jibo owners filmed the goodbye dance (TechCrunch/Verge, March 2019). Hobbyist relay notes: [ghc.wtf](https://ghc.wtf/writing/freedom-for-jibo/) (C3).
- Vector fan blog 11 July 2026 claims a Pittsburgh receiver over DDL assets; treat as C3, not Fact — [thedroidyouarelookingfor](https://vector.thedroidyouarelookingfor.info/2026/07/11/digital-dream-labs-a-pittsburgh-court-has-put-vectors-infrastructure-under-a-receiver/).

**Intelligence assessment.** [Assessment — High confidence] No court has yet held a maker liable for bricking a companion. The AG case is non-delivery, not bricking. [Inference — Moderate confidence] The next prepaid humanoid drop will be argued against DDL and against Amazon’s Astro refund. [Uncertainty] Whether a 9 July 2026 DDL receiver exists is not established from a primary order.

**Opportunity.** A Mail Order Rule judgment, or an FTC §5 / Magnuson-Moss complaint that cites Moxie and the November 2024 staff paper.

**LRRK relevance.** Control Fabric and Campaign. Passport: prepaid SKU and support-duration disclosure. Watch: GD-24-010283.

**Confidence.** High on Jibo/Anki/Moxie/Astro/Neato vendor and press facts. Moderate on AG case posture (no gov release opened). Low on the receiver.

---

## 05. Humanoids take money before anyone writes the home rule

*Event / publication dates: 1X NEO 28 October 2025; Figure 03 intro 9 October 2025; Gruendel v. Figure filed 21 November 2025; FCC Covered List 28 July 2026; CVE-2025-35027 published 26 September 2025*

**Product class.** Emerging general-purpose / humanoid home robots; consumer quadrupeds

**Verified record — [Fact — A1 / B1]** **1X NEO**, Palo Alto, 28 October 2025: “world’s first consumer-ready humanoid.” 66 lb, lift >150 lb, carry 55 lb, Wi-Fi/BT/5G. US deliveries 2026, other markets 2027. $20,000 Early Access or $499/month. Soft tendon drive is the vendor safety story. **No UL/CPSC certificate cited on the opened page.** [1X](https://www.1x.tech/discover/neo-home-robot). Secondary reporting (C): complex chores use remote “1X Expert” teleoperators; ears go blue when an operator is in. That is a stranger-in-the-house fact if confirmed, not a finding of injury.

**Figure** is **not** a consumer SKU. Figure 03 (9 October 2025) is soft-goods and UN38.3 marketing, no price, no pre-order. [Figure](https://www.figure.ai/news/introducing-figure-03). *Gruendel v. Figure*, N.D. Cal. 5:25-cv-10094, filed 21 November 2025: former head of product safety, fired 2 September 2025, alleges robots “powerful enough to fracture a human skull” and a ¼-inch gash in a steel fridge (CA Labor Code 1102.5). Figure: terminated for poor performance; allegations “falsehoods.” [Complaint](https://storage.courtlistener.com/recap/gov.uscourts.cand.460223/gov.uscourts.cand.460223.1.0.pdf). Allegations are **not findings**.

**Unitree Go2 / G1 / H1 / B2.** CVE-2025-35027 (NVD 26 September 2025): command injection via BLE Wi-Fi config to root on named firmware ceilings. [NVD](https://nvd.nist.gov/vuln/detail/cve-2025-35027). Impact only; no exploit steps here. **FCC PSHSB DA 26-786 (28 July 2026)** adds foreign-produced “advanced robotic devices” to the Covered List unless DoW Conditional Approval. Category-wide (mobile ground robots including humanoids and quadrupeds, >4.4 lb, sensor + ≥200 kbps + autonomy/C2), **not** “Unitree banned.” Already-authorized models remain importable. Official FCC HTML timed out; law-firm explainers are B2.

**ISO 13482 / ISO 10218** were not written for a 30 kg biped carrying a pan past a toddler. No published ASTM/ISO home-humanoid standard as of cutoff. No Figure / 1X / Optimus consumer-injury case.

**Threat landscape.** Money is being collected for unsupervised-looking home bodies while the actual control may be a remote expert and the actual safety file may be an employment dispute. Consumer quadrupeds already sit in NVD and in a national-security comms regime.

**Forum / community notes.** None independently opened on 1X/Figure.

**Intelligence assessment.** [Assessment — High confidence] There is no dedicated CPSC home-humanoid rule as of cutoff. [Inference — Moderate confidence] The first real home-humanoid incident will be argued as a teleop-consent and sensor-gap case, not as “the robot woke up.” [Uncertainty] 2026 NEO deliveries were still planned, not a confirmed unsupervised fleet, in mid-2026 secondaries.

**Opportunity.** First NEO delivery photograph that is not a stage demo; any CPSC inquiry; Gruendel adjudication; FCC Conditional Approval practice on Go2-class SKUs.

**LRRK relevance.** Sense / Move / Act, Passport, Watch, Lab. Kestrel: teleop as a hidden operator.

**Confidence.** High on the opened 1X page, the Figure complaint, and NVD. Moderate on FCC listing detail (official HTML timed out). Low on NEO delivery status.

---

## Forward indicators

1. Picea-era iRobot telemetry, Safe Corp substance, and any privacy complaint.
2. CISA ICSA-25-135-19 known-exploited status and Ecovacs patch uptake.
3. PA AG v. DDL judgment or a primary receivership order.
4. First FTC or state-AG brick/support-duration case (Moxie is the exhibit; Neato is the “cybersecurity” exhibit).
5. 1X NEO first US delivery, Gruendel v. Figure, and FCC Conditional Approval practice. ISO 13482 revision remains the missing home-humanoid standard.

> **Collection integrity.** Reddit and iRobot Community were not retrievable in this pass; forum color is only pages that opened. EC press HTML and several vendor pages timed out or 401’d (EC SO PDF 502; iRobot IR 401; Ecovacs advisory timeout; FCC document timeout; Reuters 2017 401). Those gaps are marked, not filled. Killed: iRobot sold consumer maps; FTC or CMA blocked Amazon–iRobot; retail toilet-photo leak; Anki mass-brick April 2019; Jibo AG win; Neato “won’t clean”; Sony killed ERS-1000; Whisker privacy class action; FCC banned Unitree in November 2025 or made existing Go2s illegal; Figure is taking $20,000 pre-orders; Figure 03 is certified safe or has a finding of injury; Ecovacs “sells all camera footage to China.”

*LRRK — security assurance for systems that sense, move, and act.*

<p align="right"><span style="opacity:0.35;letter-spacing:0.18em;font-size:0.8em">L-C3</span></p>