IoT devices and smart home appliances help us make our lives more comfortable, but in the age of AI, they can also turn into scary "monsters" at any time.

A refrigerator can be controlled by hackers to spoil billions of dollars of food. A seemingly harmless coffee maker suddenly generates about 1 TB of network traffic in 10 days, enough to overload the home Wi-Fi system. These incidents are exposing a little-noticed risk: smart devices in our homes and offices can become a gateway for bad actors to infiltrate our networks.

What's more worrying is that in the age of AI, finding and analyzing security vulnerabilities can be automated at a greater speed and scale than before. Devices that are rarely tested and whose software is not updated regularly run the risk of becoming an easily overlooked target.

Devices that few people think about can become weaknesses

In October, hundreds of supermarkets in France had their cooling systems attacked by hackers. Refrigerators and freezers at many stores were adjusted to temperatures up to 50 degrees Celsius, causing food to spoil and causing millions of euros in damage. Less than a month later, refrigeration systems at supermarkets in 7 European countries continued to be attacked.

On a family scale, a user once discovered that his parents' Keurig coffee maker generated about 1 TB of network traffic in 10 days. Most of the data seems to only circulate within the internal network, there is no evidence that the machine sends this amount of data to the Internet. The cause is likely to be a software or network communication error, but the owner still decided to disconnect the device.

The two incidents have very different levels of severity, but show the same problem: when home appliances are connected to the Internet and can be controlled remotely, they are no longer simply passive objects.

One reason why this risk is difficult to identify lies in the characteristics of the IoT ecosystem. Many devices use proprietary, closed-source software and firmware, making it difficult for the outside community to test and detect vulnerabilities. While popular platforms such as Windows or Android attract a large number of security experts, controllers for refrigerators, washing machines or household robots receive less attention.

Not every low-use device has poor security, but limited interest from the community can cause vulnerabilities to go undetected for a long time. The situation is even more worrying when some manufacturers do not maintain software updates throughout the product life cycle. The device still functions normally, but internal weaknesses may never have been patched.

AI can make finding vulnerabilities easier

If IoT vulnerabilities are pre-existing, AI can change the speed and scale of their discovery. This technology supports source code analysis, reviewing unusual processing segments and finding relationships between errors, significantly reducing the effort that experts have to spend.

A notable example appeared in October 2026 with PHP2Shell, the name for a group of serious vulnerabilities in the core of the PHP programming language. Researchers at Calif and Wiz used AI in the analysis process, detecting errors that existed for many years. Some vulnerabilities could allow attackers to execute remote code without authentication, with severity levels up to 9.2 on the CVSS scale.

Notably, AI not only supports finding bugs but also helps research exploitability and verify patches. The fact that serious weaknesses still exist in a major software platform, which has been tested by many experts, shows that AI can help significantly shorten the process of finding vulnerabilities.

From there, the risks to IoT become more serious. In principle, similar tools can be used to analyze the firmware, connection protocols and control software of smart devices. Products that receive little attention from the research community may become subject to larger-scale review.

Even though AI has not necessarily been used in refrigerator attacks in Europe, it can automatically find every vulnerability on every device. However, as analytics capabilities become more widespread, products with little security updates and testing may face greater risk.

When a cyber vulnerability has real-world consequences

Unlike computers or phones, many IoT devices have the ability to directly impact the physical environment. When hackers take control of the refrigerator, they can change the storage temperature. When they infiltrate cameras, they can turn security devices into surveillance tools. With household robots, image data and spatial plans can reveal the internal structure of a home.

The risk is even more severe when network-connected devices are used in factories or infrastructure. Researchers have discovered many vulnerabilities in Bosch's network-connected industrial wrench. If exploited, the device can be turned off en masse or the torque adjusted incorrectly, making the assembled product dangerous.

That's why smart devices can be compared to "monsters" sleeping peacefully in the home or office. They are not necessarily controlled by hackers, but may contain weaknesses and capabilities that the owner is not aware of.

Should we continue to use smart home appliances?

This does not mean users have to abandon all IoT devices. The problem is that not all devices really need an Internet connection. A coffee maker can still do its job without Wi-Fi, while security cameras need a network for users to monitor remotely.

Before buying a smart device, users should consider whether the connectivity feature is really useful, how long the manufacturer commits to security updates, and what functions the device can still operate when the online server is down. With purchased products, updating the firmware, changing the default password and separating IoT devices from the network containing important computers and phones also helps limit risks.

For users with technical knowledge, AI can also become a defense tool. They can leverage this technology to analyze firmware, review configurations, examine network traffic, and compare devices to published vulnerability databases. If a problem is detected, users can find patches, adjust configurations or disconnect unnecessary connections. However, the results provided by AI need to be verified, and testing should only be performed on devices owned or managed.