A security researcher, Chaz Schlarp, got fed up with constant prompts from an OLED monitor to run “pixel cleaning.” The cyber pro reverse-engineered the monitor's firmware and then hacked all other peripherals using Claude, highlighting how easily devices can be compromised by attackers.

Webcams, microphones, video capture devices, lighting devices, and other regular accessories are “tiny computers” attached to a computer and have virtually no firmware protection.

A “morbid curiosity” drove Schlarp’s experiment, called “Everything I own, owned,” which shows how quickly hackers can reverse-engineer device firmware using AI, and potentially reflash vulnerable accessories without any user interaction.

And it started with a general annoyance – the ASUS ROG Swift PG42UQ monitor showing “pixel cleaning” prompts every 8 hours.

“I have never intentionally run pixel cleaning on this monitor, and I never will, I don’t care, and I would like for that overlay to go away forever,” the blog post reads.

Thirteen prompts and 1.2 hours of Claude run later, the researcher had a GitHub repo with the monitor’s firmware reverse-engineered.

“Claude found that the firmware has effectively no protection whatsoever – there’s a 2-slot A/B scheme and a simple checksum, but ultimately we can write whatever we want to the thing,” Schlarp said.

AI agent found the bits to flip and get rid of the annoying prompts. However, the researcher didn’t dare to reflash the modified firmware yet – it’s a pretty expensive monitor.

But Schlarp turned to other devices on the desk – hacking into them uncovers a repeating pattern.

Bring your own firmware

Schlarp wanted to verify whether the “iSeeYou” exploit – disabling the webcam indicator LED on older MacBooks – could be replicated on their modern Insta360 Link webcam.

Claude took longer – 3.7 hours and 33 prompts, because the device is complex, includes advanced face recognition and tracking features, runs a high-performance real-time operating system (RTOS), ThreadX.

By leveraging an exposed USB command that allows arbitrary file read and write, the webcam can be reflashed without any user interaction. No effective anti-tamper mechanism was found, and Claude wrote a patch.

“A quick test showed that the green LED that normally illuminates while recording no longer turned on. Horrifying!” the researcher said.

The microphone – Shure MV7 – connects over USB, and its firmware flashing also had “no real security.”

The researcher discovered that websites can communicate directly with devices via WebHID. 48 available commands included arbitrary memory read/write and LED control. It was possible to disable the mute function while the LED indicator misled the user into believing the device was muted.

“Operating systems aren’t really equipped to work with the user to ensure that a microphone stays a microphone, and doesn’t spontaneously turn into a keyboard that hits Win+R and drops a payload to steal all your data when the room is quiet enough,” the researcher warns.

Similarly, the Elgato Cam Link 4K video capture device didn’t put up much of a fight. The researcher tasked Claude with reverse-engineering it before going to sleep and woke up to a working firmware updater.

One device didn’t even connect over USB – Elgato Key Light Mini uses WiFi.

“This one turned out to be way more interesting than I expected: it’s the only one with meaningful firmware integrity protection,” the researcher noted.

However, all it took was a single HTTP POST request to bypass the firmware signature check and drop the payload without a valid signature. The researcher only changed the device's name, but potential attackers can devise many nefarious exploits.

Hardware is almost universally ‘open’ for tinkering at this point,

Schlarp concludes.

“Hardware is almost universally ‘open’ for tinkering at this point,“ Schlarp concludes.

This means malicious firmware can be implanted and devices compromised with relative ease. AI agents are turning cyberattacks, previously reserved for well-funded state actors, into something that vibe-coding script kiddies could attempt.

The researcher warns that network-connected devices “seem near universally f***ed” and can be accessed remotely via WebUSB, WebHID, and WebBluetooth if a user accidentally grants permission to a malicious site.

“I’ve gotten a root shell on a commercial Dell display, and RCE on an Eaton UPS,” Schlarp said.

In the future, such exploits can be completely automated by AI-equipped malware.

The post received a lot of traction on Hacker News, Silicon Valley’s premier tech forum. Many users found the experiment exciting, because AI can help owners to tailor their hardware to their own needs or revive abandoned hardware by writing drivers, patching firmware, and breaking vendor lock-in.