Amazon security engineer uses Claude Opus to hack PC peripherals in hours, raising alarm

Chaz Schlarp, a senior security engineer at Amazon, detailed the experiments in a blog post reported by TechRadar. He targeted an Insta360 webcam, a Shure microphone, an Asus monitor, an Elgato video capture stick and an Elgato mini-light. His process was nearly identical for each device: download the firmware and associated update tool from the manufacturer, load it into his reverse engineering environment, tell Claude Opus 5 what he wanted to accomplish, and let the AI do the work. In total, the effort took about 13 hours of mostly hands-off machine-driven labor and fewer than 100 prompts.

Schlarp found that most of the devices had no solid firmware integrity protection to prevent modifications. Only the Elgato light had any defenses, and they were easy enough to bypass. He demonstrated practical tricks, including removing an annoying pop-up on an Asus ROG Swift PG42UQ monitor that periodically asked the owner to run a pixel cleaning process, and getting features from the Windows utility DisplayWidget to run on his Linux system through a shell script that could toggle hardware crosshair or FPS counter functions.

He also managed to disable the webcam's recording light so the user would not know if the camera was secretly recording, in the style of surveillance malware. With the microphone, he made the mute LED stay on while the mic was actually not muted, using a full plaintext command shell. Additionally, Schlarp said he obtained a root shell on a commercial Dell display.

Schlarp acknowledged the darker side of his work. "As a security professional, this scares me," he wrote. Previously, malicious firmware implants required significant per-model investment and were stereotyped as state-actor activity. Now, with AI able to do the heavy lifting, such attacks could become far more prevalent. "Peripherals have proven to be an ideal target for agentic reverse engineering," he said, noting they are tiny computers connected to a host with firmware update mechanisms. The speed and scale at which these modifications can be executed makes the risk much higher, he added.