Don't buy smart glasses after a hack without checks

How they compare side by side

What you are choosing on	Buy only with vendor security assurances	Wait or choose another device
Patchability and update delivery	Vendor must show a documented OTA process, signed firmware and visible release notes before purchase	You avoid immediate risk until an independent party confirms the vendor actually patches
Default authentication and safe defaults	Requires no hardcoded/default passwords and forced credential creation	You can select alternatives that already enforce safe defaults
Transparency and disclosure	Pick a vendor with a public bugtracker/CVE entries and a security contact	Waiting lets you choose a vendor who already published post‑exploit proofs
Risk six months after exploit	If vendor follows through, risk falls quickly; if not, you may be stuck with vulnerable hardware	Waiting reduces the chance you own a device left unpatched or unsupported
Migration and operational effort	Lower if vendor is good; costly if you must replace hardware or change apps later	Upfront delay avoids replacement later but may force you into a different app ecosystem
Suitability for sensitive use	Suitable only after verification of signed updates and security measures	Often better: you can choose an enterprise or mature consumer product already validated
Vendor accountability	Requires explicit commitments (bugtracker, security contact, signed firmware) to be acceptable	Higher chance of accountability in established alternatives with published security records

Who each option is actually for

• Buy only with vendor security assurancesbuyers who need the device for sensitive work (journalists, enterprise users) or who can verify vendor promises before purchasePricing: hardware purchase model with optional cloud or enterprise management subscriptions that drive ongoing charges
• Wait or choose another devicebuyers who cannot verify the vendor’s security claims, casual users who prefer low risk, or those who can postpone use until fixes are provenPricing: one‑time hardware purchase for alternatives; enterprise replacements often add management or support licensing

Should I buy smart glasses after a hacking report

No. Only buy after a public exploit if the vendor proves documented OTA patchability, signed firmware and a verifiable signature method, secure defaults (no hardcoded passwords), and a public bugtracker or CVE disclosure. Treat devices that lack those as high risk. Apply the same rules to enterprise purchases with stricter SLAs.

What the 'no password' / remote‑access vulnerability actually allows

A device that accepts unauthenticated remote connections lets an attacker stream or copy camera and microphone feeds, steal photos and logs, and use the glasses as a bridge to other devices on your local network or a paired phone. That can expose cloud tokens and private files when companion apps or networks reuse credentials.

• Camera and microphone takeover — real-time spying and recorded media exfiltration.
• Data exfiltration — photos, logs and cached tokens can be copied off the device.
• Network pivoting — attacker uses the glasses to reach other devices on your LAN or a companion phone.
• Cloud account compromise — reused credentials or long‑lived tokens in the companion app can be exposed.

Buyer threat‑model checklist: who can realistically attack you and which features matter

Decide which attacker matters to you, then map the features they can exploit. A random scanner targets open ports; a nearby attacker exploits Bluetooth discoverability; a stalker needs persistent access and cloud tokens; a corporate adversary looks for supply‑chain or firmware signing gaps. Use that mapping to prioritise dealbreakers when vetting a seller.

• Random scanner (low target): unauthenticated remote access, open Wi‑Fi ports matter.
• Nearby attacker (Bluetooth/Wi‑Fi range): pairing policies, discoverability defaults and camera LED indicators matter.
• Targeted stalker: physical access, persistent malware and cloud token reuse matter.
• Corporate/industrial espionage: signed firmware, audited OS and supply‑chain assurances matter.

Dealbreakers the seller must meet before you buy

Do not buy for sensitive use unless the seller meets these minimum commitments: a visible OTA update process with release notes, a public security contact and bugtracker or CVEs, no hardcoded/default passwords, encrypted data in transit and at rest for sensitive media or tokens, signed firmware you can verify, and the ability to opt out of cloud backup and wipe stored media.

• Documented firmware/OTA update process with visible release notes.
• A public security contact plus a bugtracker or CVE entries for serious issues.
• No hardcoded or default passwords; forced credential creation on first use.
• Encryption of sensitive media and tokens both in transit and at rest.
• Signed firmware with a published verification method or hash.
• Ability to disable cloud backup and to wipe stored media locally and remotely.

Exact questions to ask the seller and how to verify their answers

Ask for evidence, not marketing. During a demo or pre‑purchase call, get links to the bugtracker/CVE list, firmware release notes, the firmware signing key and verification steps, a named security contact with a response commitment, and documentation showing how to disable backups and wipe data. Verify each item on the device or in the companion app.

• "Where is your public bugtracker or CVE disclosure?" — Accept a link to a public issue tracker or CVE list; open it and find the reported issue or other resolved reports.
• "Show me your firmware update process and release notes." — Accept published release notes with version numbers; verify the device reports its current firmware and match that to a changelog entry.
• "Do you sign firmware images and how can I verify a signature?" — Accept a description of signing, a published signing key and verification steps; ask for a sample signed image hash and follow their verification process.
• "Who is your security contact and what is your SLA for serious vulnerabilities?" — Accept a named security email/contact and a written response commitment; check prior advisories and release notes for timely updates.
• "Can I disable cloud backups and delete stored media remotely?" — Accept documented steps; confirm the option in the companion app or device settings during the demo.

How this fails in practice: the sequence that turns a report into lasting risk

The common failure chain is slow acknowledgement, sparse technical detail, optional or manual patches, unsigned firmware and persistent insecure defaults. Each step increases how long vulnerable code runs in the field and widens supply‑chain or token‑reuse risk. Press sellers for verifiable updates and watch for continuing enabled services.

• Step 1: Public report appears and consumers see headlines.
• Step 2: Vendor issues a PR statement but publishes no technical details or bugtracker entry.
• Step 3: A patch requires manual installation or is optional; many users never apply it.
• Step 4: Firmware is unsigned or the update process is not verifiable, raising supply‑chain risk.
• Step 5: Companion apps retain cloud tokens or auto‑reconnect with insecure defaults, letting attackers re‑establish access.
• Outcome: Months later, phones and glasses still run vulnerable code while the vendor claims the issue is fixed.

Low‑risk buying options and mitigations if you decide to buy anyway

If you must buy now, pick an enterprise model or an established vendor that publishes security documentation, supports signed firmware and offers device management. Otherwise, apply mitigations: keep the device offline where possible, use guest Wi‑Fi, disable cloud sync, turn off camera/mic and cover the lens if needed. These steps limit exposure but do not replace vendor fixes.

• Prefer enterprise or established vendors with security pages (see /devices/vuzix-shield and /devices/xreal-air-2-ultra for examples).
• Use the device offline and disable cloud backup and sync features.
• Isolate the glasses on a guest Wi‑Fi network or VLAN; do not share your primary network.
• Turn off camera and microphone in settings when not in use and physically cover the camera for absolute assurance.
• Run the practical checks in /articles/10-minute-smart-glasses-test and follow /articles/after-smart-glasses-advisory for post‑advisory steps.
• When choosing apps, prefer those listed in our directory and that state local‑first processing (see /apps).

How long to wait and when to walk away

A responsible vendor should acknowledge a public exploit promptly and publish a clear patch plan. If you see only PR statements, vague timelines or no verifiable updates, treat that as a reason not to buy. Also walk away if the seller lacks a transparent return policy or a reachable support channel for security issues.

• Acceptable behaviour: a public bugtracker/CVE entries, clear update steps, signed firmware and a reachable security contact.
• Red flags: silence, only marketing statements, "we're investigating" for months, no OTA update path, or no way to opt out of cloud services.
• Return policy watch: an absence of returns or no support for security issues is a dealbreaker.

Next step: do the 10‑minute test before you decide

Run the /articles/10-minute-smart-glasses-test before you use the device for anything sensitive. The test verifies the device reports its firmware version, that you can disable cloud features, and whether the companion app exposes tokens or open ports. If the test finds gaps the seller could not prove before purchase, return the device.

Related reading

• the smart glasses app directory
• 10 minute smart glasses test
• After smart glasses advisory

Sources and further reading

• [$60 Smart Glasses Hacked Without a Password [2026]](https://news.google.com/rss/articles/CBMigAFBVV95cUxOUC1jaVdsZzdhVnd5OFFLRDhic0ExR3hBZ2pzaVdJblJFUFRnRG5PTjFnbVA4c2NtbVNiUmxwWVlSZFV5MTZTbkE3VUdhMUFOSkcyWWxpbnIwWGpTX0g2Wlg2SGFjSTZHdTlfeERWYV9nMEhRZ3F6R0xvLV9SckF5eg?oc=5) — Google News

What we would pick, by situation

If this is you	What we would pick
You are a journalist or handle sensitive sources	Buy only with vendor security assurances — You need provable patchability and signed firmware before using glasses for sensitive work.
You want glasses for media and casual use while commuting	Wait or choose another device — The convenience is not worth owning a device that the vendor cannot prove is patched and secure.
Your company wants to deploy glasses at scale for field staff	Buy only with vendor security assurances — Enterprise deployments require management, auditability and an SLA—only vendors who can demonstrate those should be considered.
You are an early adopter who tolerates some risk	Wait or choose another device — If you accept risk, prefer vendors that already publish signatures and release notes; otherwise the ongoing exposure is likely to be disruptive.

Switch if, stay if

Frequently asked questions