‘Who will pay €500? Surely not me’: determined to hack Meta Ray‑Bans, she borrows her brother‑in‑law’s and succeeds

Receive a summary of important news every evening with Le Récap’

She presents herself under the pseudonym “pamoutaf”. In a blog post published on November 6, this application security researcher explains how she managed to hack Ray-Ban Meta glasses and make them run her own code.

A long-term project, carried out in several stages, which began in July 2026. pamoutaf was then preparing Pwn2Own, a competition which rewards hackers who have succeeded in hacking consumer devices, and had chosen to attack Meta's glasses, which were among the targets of the previous edition.

All that remained was to get our hands on the famous glasses. “Who will pay 500 euros? Certainly not me,” she wrote. She explains that she borrowed her brother-in-law's pair for a few weeks, who barely used them.

The glasses installed programs without checking their origin First difficulty: the Ray-Ban Meta do not have a screen. It is therefore impossible to directly explore their system.

And your digital life becomes peaceful Bitdefender Premium Security is a European cybersecurity solution that automatically protects you against hackers and all web threats. Enjoy your online activities with complete peace of mind Sponsored Cybersecurity is on sale To get around this obstacle and get your hands on the firmware, understand the internal software of the glasses, pamoutaf explains that it turned to the Meta AI application. A crucial intermediary since it allows you to control the device from a smartphone but also to send it its updates.

After identifying the address to which the application downloads them, the researcher managed to obtain a first file “which seemed promising. » Problem, it only contained a partial update of around 156 MB. Digging through the code, she spotted a setting, “device_firmware_full_update_only”, which she activated to retrieve the full firmware.

All that remained was to have the glasses execute their own code. To do this, pamoutaf used the Device Access Toolkit (DAT), a Meta kit that allows developers to install a small program on the glasses, and this is where the flaw was located.

In principle, the device first checks the signature of this program, a sort of cryptographic stamp which guarantees that it really comes from Meta. But until firmware version 126, glasses did not do this. With Frida, a tool that allows you to modify the functioning of an application while it is running, she intercepted the installation to insert her own program in place of Meta's. “This meant I could run any app on the glasses,” she writes.

Machine-translated from French