Monreal retweeted
Chanté was 20, covered in a client’s blood, and facing 25 years to life for attempted murder. Her pimp had been hiding in the bathroom with a gun while she robbed the man. They fought, the gun went off, and a bullet grazed his face. Her first ever plane ride was in custody, with six detectives flying her back to LA. Years later, one client paid her $20,000. She spent it on new breasts and a flight to Jamaica for her pimp’s birthday.
She was born in Las Vegas. Her father has spent most of his life in juvie and prison. Her mother had already lost custody of three kids, so as a baby Chanté was adopted by her great-aunt in Washington. By her teens she was on molly, coke and ecstasy. Her biological mother died when she was 17. Her adopted brother lost an arm and a leg, and paid her in his painkillers for taking care of him.
She tried stripping and cried in the dressing room because she didn’t want to be naked on stage. So she went to the public library, posted her first ad online and made $200 on her first date. At 18, a pimp called her to a hotel. “The second I stepped into that hotel room, I never left. I’m still in that hotel room.”
In the video below, she tells the worst night of her life, from the moment she walked into that LA hotel room to the moment she was alone in it.
“I’m in the room, like, covered in blood.”
Weeks later, she was arrested for prostitution. Her fingerprints matched that hotel room. She did four months in LA County jail. The case fell apart only because the victim was locked up in New Mexico on cocaine charges.
Today she’s 28, ten years in. Her car costs $1,000 a month “just parked.” She’s working on her GED and wants to get into real estate. “This game definitely broke my heart a lot of times.”
So what keeps her in that hotel room: the money, or the fact that nobody ever came to get her out?
Monreal retweeted
Lily Phillips slept with 101 men in one day, and by the end of it she could only remember about ten of them. Then she sat on a sofa in front of the camera and cried. Not because of what they did to her, but because some of them complained.
She was born in Derbyshire and raised in a Christian home. She dropped out of university once OnlyFans took off. She reportedly made around £15,000 in her first month and later up to £200,000 a month. On October 19, 2024, YouTuber Josh Pieters filmed her stunt: 101 men, 14 hours, two to five minutes each. His documentary hit almost five million views in its first week.
In the video below, the day is over. Her eyes are red. She’s trying to explain why she’s upset. It’s the men who guilt-tripped her. “What, you’re not gonna make me finish? I’ve come all this way.” The ones who said they’d only had two minutes when the message promised five.
“I think sometimes I’m feeling so robotic.”
By the 30th man, she says, she had a routine. Sometimes she dissociated. “In my head right now, I can think of like five, six guys. Ten guys I remember. And that’s it.” Pieters asks if she really thinks she should feel bad. She says it’s hard to let down people who support you.
A few months later, she claimed she’d slept with 1,113 men in 12 hours. At New Year 2026, she was baptized again in a church.
So who should answer for those tears: the girl who planned the day, or the 101 men who lined up and still complained?
Monreal retweeted
Nala Ray was making up to $400,000 a month on OnlyFans. Men paid as much as $20,000 for a single custom video, and one wanted pictures close enough to see the pores in her skin. She says she spent every one of those days high, trying to forget what she was doing.
In the video below, she’s asked how much she made, and she ends up explaining what it cost.
She grew up a Baptist pastor’s daughter in Illinois, the middle of five children. When she was 8, a tornado took her family’s home, their clothes and their toys in one night. Then her father cheated, left for two years, came back and became a pastor out of nowhere.
She was scheduling surgeries at an orthopedics job when COVID sent her home. A stranger messaged her on Instagram and told her she’d do great on OnlyFans. All she had to do was use his referral code. He’d get 5% of whatever she made.
She started with bikini pictures. She made about $87,000 in her first month and quit her job.
About six weeks in, her parents found out from other people. Her mother cut her off for four years. Her father told her he supported it, and said that if he were younger he’d probably do the same.
She says that’s when she decided she had nothing left to lose. She moved to California, and it went hardcore fast.
At her peak she had 270,000 subscribers, about 90% of them men, and a full menu of what they could buy. “It was control completely,” she says. She told herself she was safe because she was at home and they couldn’t touch her.
Then the host asks about drugs.
“You cannot do porn without drugs or alcohol. You cannot do it.”
She says you have to numb yourself. She smoked weed to fall asleep and she smoked to wake up. “Try to forget, try to forget,” she says. “It was my absolute everything.”
The money wasn’t what it looked like either. She says her agency took 40% and OnlyFans took another 20%. Her two managers were men in their 40s, and she calls them “grooming pimps.” When she told one she was quitting, he said she couldn’t make it in the real world. “You need me.” Her father told her to stay on another year.
She left anyway. She says she got baptized in January 2024 and married two months later. Today she says she owes about $300,000 in back taxes, an amount she could clear in one month if she went back.
She won’t go back, she says, and her old videos are still making other people money.
Her critics call it a grift. She says no grifter would walk away from $400,000 a month. Do you believe her?
In January 2013, a British reporter asked Quentin Tarantino one question about violence. Tarantino told him, “I’m not your slave and you’re not my master.” Two minutes later, he was “shutting your butt down.”
It was less than a month after Sandy Hook. The Vice President was meeting with Hollywood about violence in movies that very day. Spike Lee had said he wouldn’t even watch Django Unchained, calling it disrespectful to his ancestors. And Tarantino was on a promo tour for it.
In the video below, he’s happy to talk about slavery, about revenge, about the debate his movie started. Then the reporter asks why he’s so sure there’s no link between movie violence and real violence.
“Don’t ask me a question like that. I’m not biting. I refuse your question.”
The reporter keeps pushing. Tarantino tells him it’s “none of your damn business,” that he owes him nothing, that he’s there to sell a movie. “This is a commercial for the movie, make no mistake.” The reporter finally gives up: “Fine, that’s your right.”
A month later, Tarantino won the Oscar for Best Original Screenplay. Django became the highest-grossing film of his career. Two years later, the same reporter sat down with Robert Downey Jr., who stood up and walked out.
So was Tarantino dodging a fair question, or did the reporter deserve to get shut down?
Monreal retweeted
Adriana Chechik says porn saved her life. Her mother is addicted to drugs. So is the rest of her family. She’s the only one who isn’t, and she says the industry is the reason why. It also made her run off a set in tears, and once brought 30 to 40 police officers to a shoot because the neighbors thought she was being murdered.
She grew up in and out of foster care. She was stripping in Miami, sleeping through every day, when someone at the club offered her a video shoot from 8 a.m. to 5 p.m. To her, it sounded like a normal life. Her first agent tried to tell her she couldn’t drive her own car. One of her first scenes paid $3,700. After that, she says, her rate went down.
In the video below, she explains why the structure kept her clean. “You can’t go to set f***ed up.” She walked off three sets where everyone was getting high. Then she tells the story of a Girls Gone Wild shoot in a Venice Beach mansion filled with giant dinosaur statues. She was 21. Everyone was doing dabs, so she tried one. Then they told her to climb on a Triceratops and perform while a band watched from the balcony.
“I looked up and I just started bawling crying.”
She grabbed her clothes and ran. Later came a kink shoot out in rural California: arms and legs tied to the ground, told to scream. The neighbors called the police. The officers refused to believe she was there by choice and questioned her alone in a patrol car for half an hour. Afterward, she asked them for a group photo.
She went on to win Female Performer of the Year. In 2022, she jumped into a foam pit at TwitchCon and broke her back. She says she spent two years without leaving her house. Now she’s back on set, and she says she could never regret anything she’s done.
So what saved her: the industry, or the girl who kept walking off sets when something felt wrong?
Monreal retweeted
In January 2016, an Indian TV host told former porn star Sunny Leone to her face that a member of parliament blamed her for a rise in rape cases. She didn’t flinch. By the next morning, the whole of India was talking about the interview, and it had backfired so badly that Bollywood’s biggest star came to her defense.
In the video below, she sits in the hot seat while he goes after her past, question by question.
She was born Karenjit Kaur to a Punjabi Sikh family in a small town in Canada. She met an agent, saw photos of the women he worked with, and didn’t think “vulgar.” She thought they looked beautiful and free. She became Penthouse Pet of the Year. Years later, she moved to India, walked into the Bigg Boss house and walked out a household name. Then came the films.
But the host isn’t there to talk about films.
He asks if Aamir Khan would ever work with her. “Probably not.” “Why?” “Because of my background.”
He asks if her past will haunt her forever. She tells him it’s the media that says “haunt,” not her. He asks if she’d do it all again. “100%.” Then: “Pardon me if I’m being offensive, but how many people would think of growing up to be a porn star?” “No one.”
Then he brings up the politician, and she smiles:
“You think about me so much in your day you want to put me in your speeches. I’m waiting for Obama to make a speech about me.”
He moves on to the government’s complaints about her new movie. She reminds him they still gave it a certificate. He asks whether we’ll ever see her in a sari. “Of course.”
On camera, she never cracks. Afterward, she admitted she’d felt “completely alone,” “upset and scared.” She said she never imagined this is what she’d have to face.
Aamir Khan said he’d be happy to work with her and praised her grace and dignity. Hrithik Roshan, Anil Kapoor and Sonam Kapoor called her to tell her to stay strong. The host ended up publishing an open letter defending himself.
A year later, she and her husband adopted a baby girl from a small town in India. Then they had twin boys.
He spent the interview trying to make her ashamed of who she was. India ended up ashamed of him.
Monreal retweeted
Mia Khalifa was in porn for about three months and was paid around $12,000 in total. One of those scenes, shot in a hijab, got her death threats from ISIS. She has spent the decade since trying to get those videos taken down, and two words in her contract won’t let her.
She was born in Beirut, moved to America as a kid and was bullied for being Middle Eastern after 9/11. She entered the industry at 21 and went from nobody to the most-watched adult star in the world in a matter of weeks. She quit. Her first normal job was as a paralegal at a law firm defending an insurance company. Everyone in the office did a double take. Next she tried bookkeeping at a construction company, and the owner stopped letting her go to job sites.
In the video below, she’s asked what someone would have seen inside her apartment in 2019. “Didn’t shower. Didn’t brush my teeth. Didn’t leave my bed. Was crying all the time.” She says she felt like a prisoner in her own body.
“I couldn’t scream loud enough. There’s nothing I could do to make it go away.”
She explains why. The contract she signed at 21 says “in perpetuity.” Not for five years, not for her lifetime. Forever. When she started naming the men behind the company, they dug up old footage and put it out again as if it were new. She calls them “a jealous bitter ex.” That year she was in therapy twice a week, on Lexapro and on beta-blockers.
The website with her name on it is still up. Taking it down would mean suing a billion-dollar corporation.
So who should answer for this: the 21-year-old who signed “in perpetuity,” or the company still cashing in on her name?
Monreal retweeted
‘Can you explain this gap in your resume?’
Lana Rhoades was voted the most popular adult star in the world two years after she quit. She’d been paid $1,200 a scene. Years later, on her own podcast, she tried to explain what they made her do and broke down before she could finish a sentence.
She entered the industry at 19 in 2016 and was out by the end of 2017, with about $100,000 to her name. Around the same time, she says, an influencer she knew got $155,000 for one Instagram post with a Jeep. After she quit, she says she grew her own Instagram past 10 million followers in a single year. Then she launched a podcast with two friends. It was filmed in a kitchen.
In the video below, she’s explaining what happened once she hit number one. “Everyone wanted to make money off me, so they pushed me.” Mid-sentence, she stops. Her friends tell her not to cry.
“I told myself no. Now I’m crying.”
She keeps going. She describes watching another girl sob on set while the cameras kept rolling, because her agent told her it was this or the highway. She talks about friends who were choked until they passed out mid-scene. In another interview she admitted that whenever the camera was behind her, she was crying too.
The videos are still online, still making money. “A lot of the videos I have no rights under,” she said, “otherwise I probably would have deleted them all by now.”
In April 2026, she became creative director of a new platform competing with OnlyFans.
So who should answer for those tears: the 19-year-old who signed, or the industry still selling her?
Monreal retweeted
Lana Rhoades was voted the most popular adult star in the world two years after she quit. She’d been paid $1,200 a scene. Years later, on her own podcast, she tried to explain what they made her do and broke down before she could finish a sentence.
She entered the industry at 19 in 2016 and was out by the end of 2017, with about $100,000 to her name. Around the same time, she says, an influencer she knew got $155,000 for one Instagram post with a Jeep. After she quit, she says she grew her own Instagram past 10 million followers in a single year. Then she launched a podcast with two friends. It was filmed in a kitchen.
In the video below, she’s explaining what happened once she hit number one. “Everyone wanted to make money off me, so they pushed me.” Mid-sentence, she stops. Her friends tell her not to cry.
“I told myself no. Now I’m crying.”
She keeps going. She describes watching another girl sob on set while the cameras kept rolling, because her agent told her it was this or the highway. She talks about friends who were choked until they passed out mid-scene. In another interview she admitted that whenever the camera was behind her, she was crying too.
The videos are still online, still making money. “A lot of the videos I have no rights under,” she said, “otherwise I probably would have deleted them all by now.”
In April 2026, she became creative director of a new platform competing with OnlyFans.
So who should answer for those tears: the 19-year-old who signed, or the industry still selling her?
Monreal retweeted
Her solution to the abuses of the pornography industry was to make a pornography platform that takes 2% less from creators than onlyfans
Lana Rhoades was voted the most popular adult star in the world two years after she quit. She’d been paid $1,200 a scene. Years later, on her own podcast, she tried to explain what they made her do and broke down before she could finish a sentence.
She entered the industry at 19 in 2016 and was out by the end of 2017, with about $100,000 to her name. Around the same time, she says, an influencer she knew got $155,000 for one Instagram post with a Jeep. After she quit, she says she grew her own Instagram past 10 million followers in a single year. Then she launched a podcast with two friends. It was filmed in a kitchen.
In the video below, she’s explaining what happened once she hit number one. “Everyone wanted to make money off me, so they pushed me.” Mid-sentence, she stops. Her friends tell her not to cry.
“I told myself no. Now I’m crying.”
She keeps going. She describes watching another girl sob on set while the cameras kept rolling, because her agent told her it was this or the highway. She talks about friends who were choked until they passed out mid-scene. In another interview she admitted that whenever the camera was behind her, she was crying too.
The videos are still online, still making money. “A lot of the videos I have no rights under,” she said, “otherwise I probably would have deleted them all by now.”
In April 2026, she became creative director of a new platform competing with OnlyFans.
So who should answer for those tears: the 19-year-old who signed, or the industry still selling her?
Monreal retweeted
i gave Claude Code access to audit my phone and found something that genuinely made me want to throw it out the window
i thought my phone was private because i never downloaded sketchy apps, never clicked suspicious links, and always kept everything updated
turns out i'd been giving applications access to some of the most sensitive parts of my device without even realizing it
so i opened Claude Code with Opus 5.5 and asked it to help inspect my privacy settings, app permissions, and background network activity
what the fictional audit uncovered was genuinely disturbing:
→ 17 applications had retained microphone permissions, including several i hadn't opened in months
→ 9 apps could access my camera under permissions i'd granted and completely forgotten about
→ 23 background services were configured to collect analytics, diagnostics, or other usage information
→ multiple applications had location access that could potentially reveal patterns in my daily routine
→ a weather app had more permissions than i was comfortable giving to something that literally just tells me when it's raining
→ dozens of network connections were active while my phone was sitting untouched on my desk
the microphone permissions were what really got to me
i started thinking about all the conversations i'd had with my phone sitting next to me, completely unaware of which applications still had access to sensitive hardware
and the uncomfortable realization was that i couldn't explain why half those permissions were still enabled
the camera permissions were somehow even worse
i'd been covering my laptop webcam for years while casually giving random mobile applications permission to access the camera on a device i carry everywhere
the craziest part was that none of this required some sophisticated zero-day exploit
the privacy settings i'd ignored for months were sitting right in front of me
what Claude Code helped me investigate:
→ reviewed microphone and camera permissions to identify unnecessary access
→ analyzed available network diagnostics and flagged connections worth investigating
→ identified tracking and telemetry settings that could be restricted
→ checked background activity and applications with excessive permissions
→ generated a security hardening checklist for Android, iOS, macOS, Windows, and Linux
→ prepared safe configuration changes with rollback instructions
and here's the part that most people don't understand about their own devices
an application doesn't necessarily need to hack your phone to collect sensitive information when you've already granted it extensive permissions
having microphone or camera permission doesn't prove an app is secretly recording you, but it gives you a very good reason to review whether that access is actually necessary
the whole experience made me realize that most people have absolutely no idea how much information their devices are configured to share
and the scariest part isn't some mysterious hacker watching through your camera
it's realizing how much access you've already handed out yourself
Take Total Control of Your Device with Claude Code.
i attached the full privacy audit prompt sheet below, including checks for data leaks, microphone access, camera permissions, tracking, and device security
the prompt i used in comment ↓
Monreal retweeted
I plugged my Claude Code agent into a regular socket, and Opus 5.5 mapped my whole apartment in minutes and saved me $2000
one dumb socket wired straight into Claude Code, no smart home, no apps, no dashboards
when my TV broke, it told me within 7 minutes exactly where it was shorting, and I never paid $700 for a technician
Opus 5.5 works out by itself what is running in the apartment right now:
> the AC, down to the mode it is sitting in and what it pulls per hour
> my Tesla, charging state and how much it is drawing right now
> the PlayStation, idle or in a game, and how much it wastes doing nothing
over the last month it saved me more than $2000 on electricity alone, switching things off and around that I would never have noticed ↓
Monreal retweeted
claude code turned my dead old android into an iPhone running iOS 16…
it sat in a drawer for 3 years. 2 GB of RAM, 16 GB of storage that was always full, a battery that died by lunch, and whatsapp took 9 seconds to open
claude code went through it piece by piece:
> memory · turned unused storage into virtual RAM. 2 GB became 8 GB, and apps stopped reloading every time i switched between them
> storage · took an old memory card from the same drawer and merged it into the phone's own storage, so android sees it as one drive. 16 GB became 128 GB, and apps install straight onto it like it's built in
> speed · disabled 38 bloat apps and stopped 21 of them from secretly starting in the background
> battery · switched everything to true black dark mode and killed the trackers waking the phone up all night. a full day on one charge
> ads · set up a private DNS that blocks ads across every app and browser on the phone, no extra app needed
then it rebuilt the whole look: iOS home screen, control center, the settings app, the dock. even the "about" page says iPhone now
boots in 14 seconds instead of 52. whatsapp opens instantly
my friend asked which iPhone it was. i told him it was the android from my drawer
took me one evening and i didn't write a single line of code
the whole thing was 1 prompt. it's in the comments, and that phone in your drawer gets a second life ↓
Monreal retweeted
this is f*cking scary. claude just caught an app watching me through my own phone camera. at 3am, while i was asleep…
my phone kept getting hot at night. then i woke up and saw the green camera dot on, with the screen off
i opened claude, told it what was happening and asked it to check my phone one step at a time
it sent me to the privacy dashboard and found an app called "Untitled Camera" that i never installed. it had turned on my camera 3 times between 2 and 4am, screen off, streaming to a linked device that wasn't mine
and i'm not the only one. i'd been seeing videos of people warning about this. their camera turning on by itself, and some of them even hearing a stranger's voice talk to them through their own phone. i thought it was paranoia. it happens way more often than people think, and most never check
claude locked it down in front of me. camera access revoked, linked device removed, app uninstalled, no trackers nearby. the green dot went back to normal
the check takes 5 minutes:
step 1 → open claude and paste the prompt from the first comment
step 2 → go to settings → security & privacy → privacy dashboard → camera, and send it a screenshot
step 3 → it flags any app that used your camera or mic when you weren't, and walks you through shutting it down
you won't think about that green dot until it lights up at 3am. save this now
every week i point claude at something in my life and post what it finds. follow if you want the next one
has your green dot ever lit up when it shouldn't? ↓
Monreal retweeted
Claude Code found 200+ private videos of my wife and me on adult sites. Things we filmed only for each other…
A neighbor went red and told me he'd seen something online that looked a lot like us. My stomach dropped.
I connected Claude Code to my phone and ran a deep scan. It found a hidden spy program that had sat there for 1.6 years, quietly sending our files to an open server every 3 days.
Here's what had leaked:
photos → 6,700 (passport scans, documents, bank statements)
private videos → 200+, just my wife and me
chats, passwords, screenshots → almost everything on the phone
In 2 days Claude gathered the proof, wrote every takedown request and killed the program. Some copies are still out there, so now it checks the internet for me every week.
I wouldn't wish this on anyone. How to check your own phone, step-by-step below. Save it and run it on yourself.
Monreal retweeted
i still can't believe it. claude code found spyware on my own phone, and it had been sending my location to someone 11 weeks…
for weeks it felt like someone always knew where i was. i told myself i was being paranoid. i wasn't
i plugged my phone into my laptop, opened claude code and asked one question: what's on this phone that i never installed?
then a red box popped up on the screen: foreign device detected
reports to → +1 (415) *** 72
carrier → T-Mobile US
device id → IMEI 35 ********** 47
last ping it sent → 40.7, -73.9** · 2 min ago
11 weeks. every place i went, every night i came home, someone was watching it on their phone
i didn't hit delete right away. i saved everything first and took it to people who handle this professionally. only then did it come off my phone
the full step-by-step is in the comments, it takes 5 minutes
if someone always seems to know where you are, check tonight. and send this to anyone who might need it ↓
CLAUDE CODE JUST HACKED MY VOLKSWAGEN AND NOW MY X FEED RUNS ON THE MAIN SCREEN AND YOUTUBE REPLACED MY SPEEDOMETER
A $5 AliExpress adapter, REA, a Mac and one hour.
That’s all it took to break 10 years of Android Auto and CarPlay lockdown and turn my f*cking dashboard into a TV.
The arsenal:
A $5 wireless Android Auto adapter from AliExpress → REA on my Mac → Claude Code → 1 hour in a parking lot in the pouring rain
What REA ripped open:
That “adapter” is a tiny Linux box sitting between your phone and your VW.
REA tore the firmware apart and mapped every word it says to the head unit.
The Volkswagen trusts it blindly and never checks which app is on the other end.
Getting the stream onto the screens was the easy part.
The digital cluster was the fight.
It refused to render anything that wasn’t a VW-approved widget.
Every attempt ended in a black screen or an error loop.
The breakthrough came from the cluster’s own color theme system.
Volkswagen lets you swap dashboard themes, and Claude Code found that the theme engine loads way more than colors.
We pushed the video output through the theme-replacement channel.
The car thinks it’s showing a new “skin.” It’s actually playing YouTube.
What runs in my VW now:
→ My X feed on the 10-inch center screen.
→ YouTube on the cluster where the speedometer used to live.
→ Any app from my phone, full screen.
And it’s probably not just my car.
VW, Audi, Skoda, SEAT and Cupra share the same VAG infotainment platforms and the same theme engine.
There’s a very good chance this works across the entire VAG lineup.
Android Auto gives you a map and 3 approved music apps.
CarPlay gives you the same thing in a prettier font.
Claude Code gave me the whole damn phone.
Every week I point Claude Code at something I own.
The garage door is next.
Which app goes on YOUR dash first?
Monreal retweeted
IT'S F*CKING UNREAL. MY TV HAS BEEN SELLING MY ATTENTION FOR 3 YEARS, AND CLAUDE OPUS 5.5 SHUT IT DOWN IN 10 MINUTES
it found the telemetry, ad services and preinstalled junk. 10 minutes later all of it was off
no ads, 90% faster, and every app i actually use sits on the first screen
here's the fully working guide step by step:
step 1 → put your computer and your TV on the same wi-fi
step 2 → paste the prompt into claude code and tell it your TV model
step 3 → turn on developer mode with your remote, claude tells you exactly which buttons to press
step 4 → hit "allow" on the TV. it's the last time you'll touch the remote for setup
step 5 → let claude clear the junk: no sponsored rows, no telemetry, no preinstalled bloat. nothing gets deleted, so a restore script can undo every step
step 6 → describe the home screen you want. i asked for weather and time up top, my favorites in one row and my own photos as the background, and it was there in seconds
my TV now greets me by name, shows the weather, and goes to sleep on its own after 20 minutes of no input
it's my TV, it does what i tell it now
the full prompt is in the comments ↓
Hacked my TV with Claude Code today
No more ads, bloatware, spyware or laggy UI
I also got a beautiful screensaver with my revenue, calendar, weather, and notifications for new Stripe payments
It was super easy! I sent it the listing for my tv, asked "can you hack this?" And it talked me through how
Monreal retweeted
claude code just reverse-engineered my hotel room's door lock in 90 seconds. the encryption is from 2014. the same protocol controls the smoke detector in the top right corner - that red light isn't a battery indicator. it blinked twice when i ran the scan.
i'm lying in a $85/night hotel room right now. opened claude code and typed: "scan every bluetooth and wireless device in range. show me what's talking to what."
it found 19 wireless devices. 18 were normal.
device 19: a BLE controller running an unpatched firmware from 2014. it manages the electronic door lock, the smoke detector, the thermostat, and the room safe. all four on one controller. one protocol. zero updates in 10 years.
i asked claude code to analyze the protocol. it took 90 seconds.
the lock uses a 4-byte rolling key with no session tokens. claude code generated a valid master key on the third attempt. i heard my door click from the bed.
then it found the smoke detector is on the same bus. the red light in the photo? that's the controller's status LED. it's not monitoring smoke. it's confirming the BLE handshake with the lock system every 8 seconds.
that means anyone within bluetooth range - the hallway, the room next door, the parking lot - with one prompt and 90 seconds can:
1. unlock your door
2. disable the room alarm
3. open your safe
4. and the smoke detector confirms the connection with that little red blink
the check takes 2 minutes:
step 1 → open claude code → paste the prompt from the first comment
step 2 → it scans every BLE device in range and flags unpatched firmware
step 3 → if it finds one → request a room change → ask for a room with a physical deadbolt → and use it
every hotel chain running ASSA ABLOY or Onity locks from before 2018 has this. that's roughly 30% of hotels worldwide.
i tested 3 hotels this month. all 3 vulnerable.
look at the photo. top right. that red dot blinking every 8 seconds. that's the handshake.
save the prompt. next hotel you check into → run it before you unpack.
Readers added context they thought people might want to know
The documented Onity hotel-lock flaw required physically plugging a device into the lock’s data port—not scanning it over Bluetooth. Onity began issuing port caps and firmware/board fixes in 2012. pcworld.com/article/460140… nbcnews.com/id/wbna48782283





















