Company that reportedly supplied DOGE and Elon Musk with sleeping solutions found to have huge vulnerability in its...beds??

Eight Sleep Pod bed
(Image credit: Eight Sleep)

  • High-tech Eight Sleep pods allow Elon Musk and DOGE staff to rest at work
  • But a researcher found security flaws, including an AWS key and remote access
  • Hackers could exploit the beds to infiltrate home networks and connected devices

Whatever you think about Elon Musk, and his role heading up DOGE (Department of Government Expenses), he’s certainly not slacking off. According to Wired, the divisive billionaire has reportedly been working long hours (as have his staff who are apparently putting in 120-hour weeks) and is so committed to the cause of cutting costs, he’s been sleeping in the DOGE headquarters at the Eisenhower Executive Office Building, just down the road from the White House.

To help everyone with the inevitable fatigue, Musk has accepted a consignment of Eight Sleep pods. These smart beds offer sleeping, reading and custom positioning, snoring mitigation, and come with a hub to keep the sleeper cool or cosy, depending on their preference. These beds appear to have been supplied FOC, but they aren't cheap if you want to buy them – the top of the range Cali King Pod 4 Ultra costs $5,000 and requires a monthly subscription of $17 or $25 – not a problem if you’re a billionaire of course.

For such a big outlay you’d expect the beds to be safe to sleep in, but now, a top security researcher has claimed the pods have a worrying flaw.

An active AWS key

Dylan Ayrey of Truffle Security uncovered a major vulnerability in his smart bed, exposing critical security flaws in Eight Sleep's internet-connected mattress. The researcher says he found an active AWS key within the bed’s firmware that seemed to be streaming data directly to Amazon.

Digging deeper, he also discovered a remote backdoor that he says gives Eight Sleep engineers SSH access to every customer’s bed, allowing them to run arbitrary code without oversight. He says employees could theoretically track sleep patterns, detect occupancy, or even control bed functions remotely.

Beyond personal privacy, the security implications extend to entire home networks. With unrestricted SSH access, hackers or malicious insiders could pivot through the bed to infiltrate smart fridges, laptops, or other connected devices. Ayrey compared the access level to Uber’s controversial "God Mode," a tool the ride-hailing company was found to have misused to monitor users without consent.

The AWS key was revoked shortly after Ayrey reported it, so its exact purpose isn’t known. “We can tell from the surrounding context that the key had write access to Kenises, but beyond that, it’s unclear,” Ayrey says. “What we do know though, is an attacker could have used that key to send 5,000 `PUT` requests per second into Kinesis and racked up a $100,000 per month bill for Eight Sleep.”

Unhappy with what he found, Ayrey came up with his own, safer, alternative to the smart bed using an aquarium chiller, which he said provides the same temperature control with “none of the apps, subscriptions, internet connectivity, backdoors, and security liabilities of an Eight Sleep”.

You might also like

Wayne Williams
Editor

Wayne Williams is a freelancer writing news for TechRadar Pro. He has been writing about computers, technology, and the web for 30 years. In that time he wrote for most of the UK’s PC magazines, and launched, edited and published a number of them too.

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.

Read more
US President Donald Trump speaks to the press as he signs an executive order to create a US sovereign wealth fund, in the Oval Office of the White House on February 3, 2025, in Washington, DC.
The US privacy nightmare? What's changed after 30 days of President Trump's new administration
Elon Musk joins U.S. President Donald Trump during an executive order signing in the Oval Office at the White House on February 11, 2025 in Washington, DC.
Elon Musk's Department of Government Efficiency hit by another privacy lawsuit with millions impacted
President-elect Donald Trump and Elon Musk pose for a photo during the UFC 309 event at Madison Square Garden on November 16, 2024 in New York City.
Trump 2.0 is a win for Big Tech – but it may not be for encryption
Elon Musk joins U.S. President Donald Trump during an executive order signing in the Oval Office at the White House on February 11, 2025 in Washington, DC.
US government cuts key software division without warning
Elon Musk
Elon Musk and DOGE are using Slack, Salesforce CEO Benioff says
Bluetooth
Top Bluetooth chip security flaw could put a billion devices at risk worldwide
Latest in Security
DeepSeek on a mobile phone
More US government departments ban controversial AI model DeepSeek
Ransomware
Fortinet firewall bugs are being targeted by LockBit ransomware hackers
Trojan
Microsoft warns of a devious new RAT malware which can avoid detection with apparent ease
NordProtect logo
Standalone identity theft protection from Nord Security is now available
A man holds a smartphone iPhone screen showing various social media apps including YouTube, TikTok, Facebook, Threads, Instagram and X
Ofcom cracks down on UK tech firms, will issue sanctions for illegal content
A fish hook is lying across a computer keyboard, representing a phishing attack on a computer system
These fake GitHub "security alerts" could actually let hackers hijack your account
Latest in News
Lego Pokemon
Pokemon and Lego announce the most electrifying collaboration of all time and I’m going to be first in line
Apple Watch app health
Apple Watch blood pressure monitoring tech revealed in patent
Using Zipped files and folders in Windows 11
Hidden clues suggest Microsoft is moving another part of Windows 11’s Control Panel to the Settings app – and this time it’s mouse options
an image of the Samsung Galaxy S24 Ultra
Finally! One UI 7 has a release date - here are the Samsung phones that’ll get it first
Google Cloud logo
Google to acquire cloud security platform Wiz in $32 billion deal
GIMP 3.0 interface from the website
Our favorite free photo editor finally got the update it deserves - and these are the top 5 features designers should know about