“Watch Me”: researcher hacks borrowed Meta smart glasses and runs her own code

A security researcher bypassed Meta’s security protections and achieved arbitrary code execution on Ray-Ban Meta smart glasses, enabling app sideloading or the execution of unapproved commands. The discovery sparked a wider debate – why hardware owners can’t run their own code in the first place?

Vulnerability researcher Paula (@pamoutaf) discovered that Meta’s smart glasses didn’t verify signatures of its own software for developers – the Device Access Toolkit (DAT) app.

She exploited the now-patched vulnerability to replace the official DAT with a self-signed, modified app, ultimately gaining shell access to the glasses.

“Up until and including firmware 126, the firmware did not verify that the DAT APK was signed by Meta. So it was theoretically possible to install any app on the glasses,” the researcher detailed the hack in a blog post.

Meta relies on a locked-down operating system and software to control the glasses, which have embedded cameras and microphones. Cybernews previously reported on users attempting to physically modify the glasses, including by drilling into them, to disable the LED and secretly record others.

Arbitrary code execution could allow tinkerers to bypass privacy and safety protections, add unofficial modifications and features, change how the device operates, and more.

“The glasses have a camera, microphones, and a wireless connection, and they sit on your face all day. A wearable that can be made to run unapproved code goes beyond a privacy-policy question. It becomes a security question about who controls the device,” said Pieter Arntz, Malware Intelligence Researcher at Malwarebytes.

Paula said she reported the vulnerability to Meta and agreed to a bug bounty.

Android powers the smartglasses

The researcher began investigating Meta’s glasses in July 2026. After reverse-engineering the Meta AI app, Paula found a way to fetch the firmware via the over-the-air (OTA) update.

“I was then able to retrieve the zip from the CDN. Unzipping it showed me that this was an Android update, including the payload.bin,” the report reads.

Meta lets developers build apps that work with the glasses. The Meta AI app makes this work – it installs a helper app (DAT) on the glasses, which the researcher was able to exploit.

Paula used Frida, an open-source tool that lets users inject custom code.

I could run any app on the glasses,

the researcher said.

Because glasses have no screens, the researcher used audio signals (beeps) to hear what her code was doing.

The researcher’s implant app joined the same WiFi Direct link Meta uses to sync photos and videos from the glasses. When the researcher connected from her phone, she could type commands straight into the shell on the glasses.

The access was unprivileged, but Paula still described it as “uncontrollable power.” After 5 days, the shell access was disabled, likely due to a patch.

“Firmware 127 started enforcing signature verification of the DAT APK, so self-signing my own DAT APK wasn’t working anymore,” Paula said. “My response: Watch me.”

The researcher found another way to bypass the signature verification by flipping a single byte in a MobileConfig file. The phone fetches this configuration file from Meta’s servers and passes it to the glasses without verifying that it hasn’t been tampered with. The byte flip essentially disabled signature verification again, allowing her to reinstall the exploit. This workaround now seems to be patched as well.

“Now that I had shell access, it was a lot easier to start mapping the attack surface,” the researcher said, hinting at more to come.

Should users be allowed to run their code?

The findings sparked a wider discussion on the Hacker News tech forum – many users now claim that having shell access to their own hardware should be a basic right of ownership.

“It’s really sad that getting a shell on a device you own is now considered a vulnerability,” the top comment reads.

Other commenters also argue that device owners should have the freedom to install their own code or modify the firmware, even if that means losing warranty coverage or support.

Opponents, however, warned of safety risks, even reminding people that guns have also special rules attached.

“Smart glasses are an appliance category where this categorically needs to be considered a vulnerability. The main thing that currently stands between them being truly amazing and useful and a spying/peeping tool is the firmware on the device,” one of the responses read.

Malwarebytes warns that the person running the code would have complete control of the device, and that malicious software could exfiltrate stored recordings to an attacker’s server.

Meta’s Ray-Ban glasses have already been under heavy scrutiny. Privacy advocates and consumer groups have raised concerns and pushed bans. Hans Anders, a major Dutch eyewear chain, suspended sales of the glasses due to concerns about covert filming. New York banned Meta and other smart glasses from over 1,240 state courts.