Here is Yarbo’s promise to fix the robot mower that ran me over
I’m writing this directly because the issues raised in the recent security report deserve a direct response, not a corporate response.
On May 7, 2026, security researcher Andreas Makris published a detailed report identifying serious vulnerabilities in Yarbo’s remote diagnostics, credential management, and data processing systems. The main technical conclusions are correct. I would like to thank Mr. Andreas Makris for his work in identifying these issues and for his persistence in bringing them to our attention. I also recognize that our initial response did not adequately reflect the seriousness of the issues he identified. As a co-founder, I am responsible for what ships on our products and I am responsible for the response.
Our engineering, product, legal, and customer support teams are working on the resolution as a priority. What follows is my account of what was found, what we have already fixed, what we are actively fixing, and what we are committed to changing in the way we operate going forward.
Based on our preliminary review, the issues primarily relate to historical design choices in parts of Yarbo’s remote diagnostics, access management, and data processing systems.
Specifically, some existing support and maintenance features did not provide users with sufficient visibility or control, and some authentication and credential management mechanisms did not meet the security standards we expect for current products.
We also identified areas where access permissions, backend system configurations, and data flows between devices and cloud services require stronger protections and stricter controls.
We recognize the seriousness of these issues and the concerns they may have caused among our customers and our community. We sincerely apologize for the impact this situation has created and are committed to resolving these issues in a transparent and responsible manner.
We’re strengthening system security by reducing legacy paths, strengthening permissions, and moving toward fully verifiable credentials at the device level. To make the progress of our rehabilitation clear, we separate the actions already undertaken from the work currently in progress.
What we have already done
What we are currently working on
Existing legacy servers and access channels will continue to be removed one by one as part of this remediation process.
We’re also accelerating OTA security updates and additional server-side protections. The first wave of updates should start rolling out within a week. Important: A security firmware update is rolling out to all Yarbo devices. To receive this update, please connect your Yarbo to the Internet. Once the update is applied, you can return to your preferred network settings. If you prefer to keep your device offline in the meantime, you can do so without affecting your warranty or service coverage. We’ll let you know when the update is ready so you can log in briefly to apply it.
This remediation effort is not limited to a single patch or software update. We use this process to strengthen the long-term security architecture and governance standards behind our products.
These efforts include strengthening access control standards, improving authentication and authorization models, increasing user visibility and control over remote diagnostic capabilities, and further reducing unnecessary legacy support mechanisms in associated systems and infrastructure.
We will also continue to expand our internal security review, remediation, and governance processes to support stronger long-term security practices. Our goal is to ensure that security, transparency and user trust form the basis of future Yarbo systems and services.
Some elements of the external report describe real security issues, while others require clarification because they do not apply to currently shipping Yarbo products or represent independent security vulnerabilities.
Auto restart and FRP persistence
The report also mentions that the FRP client can restart via scheduled tasks or service recovery mechanisms. We recognize that this can make manually disabling remote access channels more difficult, but the main problem lies in the existence, permissions, and policy of the remote tunnel itself. Our remediation measures focus on disabling or restricting tunnels, introducing allowlists and auditability, and removing unnecessary persistent remote access paths.
File monitoring and automatic recovery
The report mentions file monitoring behavior that can restore some deleted files or services. This mechanism was originally designed as a defensive reliability measure to prevent critical service files from being accidentally deleted or corrupted. By itself, it was not intended to function as a remote access feature.
That said, we recognize that any mechanism that makes it difficult for users to remove remote access components can create trust issues. We examine which files should continue to be protected and which components should be removed, simplified or placed under user control.
Historical or non-production configurations
Some findings relate to legacy infrastructure, existing cloud services, dealer-specific customizations, or internal testing setups. These remain under investigation and are cleaned up as necessary, but should be distinguished from the default behavior of currently shipping production units.
Our goal is to be specific: we won’t downplay confirmed security issues, but we also want users to understand which findings apply to production devices, which apply only to historical or custom configurations, and which are addressed as part of broader hardening efforts.
To improve security reporting in the future, we are launching a dedicated security response channel and security contact process for vulnerability reporting and responsible disclosure:
security@yarbo.com
The public will also be able to find our security details on the Yarbo Security Center page in the “Explore” section of our official website.
We are also exploring the possibility of establishing a formal bug bounty program as part of our broader long-term security initiatives.
We value the role that independent security researchers play in responsibly identifying potential issues, and we remain committed to strengthening the security, transparency, and reliability of our products.
As investigation and remediation work continues, I will provide further updates as they become available.
Kenneth Kohlmann
Co-founder, Yarbo
new York
