Watch Me. The Glasses Ran Her Code Anyway.

She borrowed a pair of Ray-Ban Meta smart glasses and set out to see who really controls them. By the end, vulnerability researcher Paula — known online as pamoutaf — could run her own code on the glasses, type commands into a shell on them from her phone, and, after Meta patched her first way in, get back in by flipping a single byte. “My response: Watch me.”

The glasses are a computer you wear on your face — camera, microphones, wireless connection, Android under the hood, controlled by the Meta AI app on the owner’s phone. Meta keeps the system locked down: only its own software is supposed to run on it. Paula started digging in July 2026. She reverse-engineered the Meta AI app, fetched the firmware through the over-the-air update, and pulled the package from Meta’s content delivery network: an Android update, payload.bin included.

The first way in

Developers can build apps for the glasses. The Meta AI app installs a helper app on them called the Device Access Toolkit — DAT — which connects phone apps to the glasses. Paula found that, up to and including firmware 126, the glasses never checked whether the DAT app was actually signed by Meta. So she swapped in her own self-signed, modified version of it.

She used Frida, an open-source tool for injecting custom code. “I could run any app on the glasses,” she said. With no screen on the glasses, she used audio beeps to hear what her code was doing.

Her implant app joined the same Wi-Fi Direct link Meta uses to sync photos and videos. From her paired phone, she could type commands straight into a shell on the glasses. The access was unprivileged — no root — but Paula still described it as “uncontrollable power.” After five days, the shell access stopped working, most likely because of a patch.

One byte undid the patch

Firmware 127 started enforcing signature verification of the DAT app, so self-signing no longer worked. Paula’s response was the title of her write-up: “Watch me.” She found a second way in.

The on-off switch for the signature check lives in a MobileConfig file — a settings file the phone fetches from Meta’s servers and passes to the glasses. The glasses checked that the file was properly formed, but never checked whether its contents had been tampered with. One flipped byte turned the check off, and she could install her self-signed app again. That workaround now seems patched as well.

“Now that I had shell access, it was a lot easier to start mapping the attack surface,” Paula said. She reported the findings to Meta, agreed to a bug bounty, and has hinted there is more to come.

Why a pair of glasses is different

Running your own code on a laptop is normal. On glasses with a camera and microphones that sit on your face all day, it is a different question. Malwarebytes researcher Pieter Arntz put it plainly: “The glasses have a camera, microphones, and a wireless connection, and they sit on your face all day. A wearable that can be made to run unapproved code goes beyond a privacy-policy question. It becomes a security question about who controls the device.” Malwarebytes warns that whoever runs the code would have complete control of the device — and that malicious software could send stored recordings to an attacker’s server.

Keep the limits in view. Paula’s demonstration needed the paired phone and the glasses in her hands — she worked on a borrowed pair. Nothing in the research shows a stranger remotely taking over someone else’s glasses. There is no CVE, and no exploitation in the wild has been reported. What it proves is narrower and still important: the lock that decides what code runs on the glasses could be picked — twice — by someone holding the device and the phone.

The context matters too. These glasses were already under heavy scrutiny: Dutch eyewear chain Hans Anders suspended sales over covert-filming concerns, and New York banned Meta and other smart glasses from more than 1,240 state courts. Cybernews previously reported on people drilling into the glasses to disable the recording light and film in secret.

What to do about it

Update. Make sure the glasses and the Meta AI app are on the latest firmware — past 127, with both of Paula’s bypasses closed. Do not pair the glasses with a phone you do not control, and do not install developer tools or sideloaded apps on them from anyone but Meta.

And remember the ownership debate this research kicked off. On the Hacker News forum, the top comment read, “It’s really sad that getting a shell on a device you own is now considered a vulnerability” — while others argued that for a camera on your face, the firmware is the only thing standing between a useful device and a spying tool. The glasses are yours. The question is who else’s code gets to run on them.

Paula has promised more research into the glasses’ attack surface.

Source: Cybernews, based on researcher Paula’s write-up, with analysis from Malwarebytes. Related: an extension that talked Claude into running code, and the backdoor built into 1.3 million TV boxes at the factory.