Agent-driven reverse engineering lays bare five everyday peripherals

Security researcher Chaz Schlarp spent two weeks reverse engineering five peripherals within arm's reach, using an agent running Claude Opus 5. According to his post, the five devices together took roughly 13 hours of agent work and 98 typed prompts.

What the devices gave up

The Insta360 Link webcam runs a ThreadX real-time OS from Ambarella and hosts small vision models for face tracking and gesture detection. An Extension Unit command over USB Video Class switches the camera into a mass-storage mode where a staged firmware update can be written to its internal FAT filesystem and applied on reboot. A separate USB vendor-class channel exposes arbitrary file read/write plus a reboot command. Firmware integrity rests on an appended MD5 hash. Patching the indicator-light table entry for camera activity stopped the green recording LED from lighting up.

On the ASUS ROG Swift PG42UQ monitor, the goal was killing the pixel-cleaning warning that appears after eight hours of runtime. The firmware has an A/B slot scheme and a simple checksum but effectively no protection, and updates travel over an I2C bus bridged over USB. The DDC/CI control channel yielded a shell script that drives the hardware crosshair, FPS counter and countdown timer.

The Shure MV7 microphone hid its firmware inside the Windows app MOTIV Mix, which was installed under Wine so the update server could be found and the firmware pulled down. Its update protocol runs over a USB HID vendor class that implements a full plaintext command shell with 48 commands, reachable over WebHID from a Chrome page. Available controls include a dozen DSP knobs, arbitrary memory read/write, LED control and a four-tier privilege system whose entire authentication is a string comparison against the tier name. The top tier can disable the touch panel and drive the mute LED independently of the actual mute state.

The Elgato Cam Link 4K capture device was analysed fully unattended: the run started before sleep and produced a teardown plus a working firmware updater by morning. Its firmware contains an MCU image and an FPGA bitstream for HDMI handling, with no protection on the update path.

The Elgato Key Light Mini was the only Wi-Fi device and the only one with meaningful integrity protection: updates are signed with Ed25519 over a SHA-512 hash and invalid firmware is rejected. But that check runs only during an update, not at boot. The agent found an HTTP POST that drops a payload into the device's UART, including a memory poke: a single ATSE=0200ED94,0E001009 request turns the signature check into a no-op.

Why it matters

The author calls the trend good for interoperability but worrying for security: any device attached to a computer could now carry a malicious firmware implant, an effort that once demanded per-model investment and belonged to state-level actors. Operating systems are not equipped to ensure a microphone stays a microphone, and a single accepted WebUSB or WebHID permission prompt can backdoor a device. He also mentions getting a root shell on a commercial Dell display and remote code execution on an Eaton UPS, and warns about what an AI-equipped, self-replicating reverse-engineering worm could do.