Will AI Wearables Replace the Smartphone?

Last week a group of security researchers revealed that the Rabbit R1 suffered from a major security vulnerability. It had hard coded API keys embedded in its source code, giving attackers access to pretty much everything done on the device, including every response ever given by an R1 device.

The Rabbit R1 is an example of a new form factor one enabled by the existence of the new large language models, wearable AI, or at least in the case of the R1, AI that lives in your pocket. Along with Humane's AI Pin it was seeking to replace something that has been the most successful computing platform ever invented, the smartphone. The black rectangle that lives in everyone's pocket, including yours.

Last week's security disclosure is arguably much worse for the product than the discovery, only a week or so after launch, that despite all the company's arguments to the contrary, the R1 was just an Android app all along.

This time security researchers who gained access to Rabbit's source code discovered critical hardcoded API keys, which amongst other things allowed anyone with access to read every response every R1 has ever given, including ones containing personal information, and to brick the R1 device entirely. Keys found in the source code included ElevenLabs and Azure — for text-to-speech — along with keys giving access to Yelp and Google Maps data.

Hard coded API keys are typical in example code. But their presence in a shipping product is very bad practice and suggests either naive, or inexperienced, developers were behind the R1 or that the company just went ahead and shipped their initial prototype as their product.

But just because it’s a prototype doesn’t mean you should cut corners, because temporary solutions often times will become permanent ones due to inertia. When you are prototyping you should alway be aware whether the prototype you are working on is what is known as a “throw away” prototype, or is intended as an evolutionary prototype.

Especially in the early days of prototyping most engineers will iterate through several throw away prototype stages and, despite inevitable time pressures it is important that these prototypes are indeed thrown away. It's quite possible that in this case, it wasn't.

The design of the Rabbit R1 has a lot of hints that it was a prototype that escaped into the world. The hardware is just a generic Android phone with the touchscreen disabled, it can even run Doom. Both it and the Humane AI Pin feel like they rushed to market unfinished, and there are echos of both General Magic and the Segway — and the Sinclair C5 before that — in the way they have come to market.

Of course security threats of hard coded API keys are an old fashioned problem. Embedding models into hardware gives us a whole new attack surface for a whole new generation of products. Unsurprisingly perhaps, generative AI models aren’t immune to adversarial attacks. But that’s probably not the most worrying new attack surface they have. They’re also vulnerable to a whole new type of attack, prompt injection. I have been vicariously enjoying the arrival of prompt injection attacks as an attack vector on this new generation of devices.

Defending a model against these kinds of prompt injection attacks is already incredibly difficult, combine that with interactions with more traditional APIs that these wearable devices have access too — like Yelp or Google Maps — and there is real potential for harm.

It's arguable that last week's revelations around Rabbit R1 have turned it into a dead product. Despite actions by developers who, amongst other steps, immediately rotated the leaked keys, you have to wonder who is now going to buy, or use, a product known to have such problems. Many people will be wondering what else is hidden in the code base, and whether there are any other problems still hidden.

If this does kill off the Rabbit, then it survived only slightly longer than Humane AI Pin, which after disastrous reviews during the pre-launch campaign was dead-on-arrival when it shipped to its first users. The founders are now trying to sell the company rather than the product the company built.

Unlike Google Glass, which sort of interestingly failed not due to the technology but on a societal level, the AI Pin was by all accounts just poorly designed.

The failure of Google Glass was down to its users pushing back against a product that didn't do what they wanted, or perhaps more correctly, did things they didn't want it to do. The failure of the Humane AI Pin, and the Rabbit R1, is users pushing back against products that just didn't work.

Both the AI Pin and the R1 failed to live up to their promises, and failed to perform the basic tasks that their users expected from them.

Supporters of the idea are arguing that these new products — the AI Pin and the Rabbit R1 — are just the Apple Newton of the category. The Newton is perhaps the most well know poster child for the saying that, behind every successful idea is the same idea done by someone else, just too early.

But neither the AI Pin, nor the R1, are the real Newton of the AI wearables era, that crown goes to the now almost forgotten Pebble Core.

Dead before it even shipped to users, the Core was announced by Pebble just before the company was bought by Fitbit and dismantled for its intellectual property.

The Core was arguably there first, six years ago. A smartphone in a box without a screen with access to Amazon's Alexa allowing you to ask it to perform tasks on your behalf. It was supposed to serve as the hub of your personal computing, a platform for other wearables and device manufacturers to build around.

I still rather bitterly regret the demise of Pebble as a platform, they were trying to build a wearables ecosystem. Brought down for the most part by their own hubris, and by totally misjudging the wearables market, Pebble had real potential. The Pebble Core was a prototype that just never made it to become a product, but it was still there first.

While it was only three years between the release of Apple's Newton and the Palm Pilot, that succeeded where the Apple Newton failed. With the now disastrous launch of both the Humane AI Pin and Rabbit R1 six years after the Pebble Core, it's more than possible it's going to be much longer before anyone tries to build a working AI-enabled wearable again.

With much touted AI integration coming to both iOS and Android phones over the next few months, undercutting what makes the new wearable AI unique, it could also mean it will be a long time before the ubiquitous black rectangle that all of us carry in our pockets gets replaced.