Claude Code finds root backdoor in Honda Civic head unit, then debloats it
IndraVahan · x · 2026-10-26
A r/claudecode user wired Claude Code into his Honda Civic's Chinese head unit and found: an always-listening voice assistant with a hidden webview eating 30% CPU, a preinstalled call recorder, a vendor root backdoor, a startup script silently installing any APK from a hidden folder then deleting it, remote firmware pushes, background Baidu location and logging services — and specs mislabeled (4 cores/Android 9 sold as 8 cores/Android 15, patches stuck at Oct 2021). He then used Claude Code to back up and remove 18 packages, kill the backdoor and silent installer, disable the cloud updater, set Adguard private DNS, upgrade WebView 66→138, build a custom launcher with recalibrated backup-camera guidelines, and install SHA-256-verified open-source apps with locked-down network access. Debloating cheap hardware is a genuinely sick Claude Code use case.
More from coding & agent
- Agent verified 'success' after double-voting: a lesson in harness vs model bugs — TejasKumar_ · 2026-10-26
- diginomica: agentic automation hype is overdone, and 'The Hackening' of enterprise security has begun — jonerp · 2026-10-26
- 'Vibe verification': ~60% of AI-written formal specs prove the wrong property — basedjensen · 2026-10-26
- Devin launches Security suite powered by Claude Mythos with $100M+ credits — DevinAI · 2026-10-26
- HackBench injects reward hacks into agent trajectories to stress-test monitors — DanielKhashabi · 2026-10-26
- Hugging Face ships hf CLI updates: deduped cache saves 19GB, faster buckets, retryable GPU jobs — yb2698 · 2026-10-26