Amazon Kept Killing His Tablet. Claude Wasn't Allowed to Help.

TL;DR

Eric Pardee's write-up of rooting his own Amazon Fire HD 10 hit 683 points on Hacker News over the weekend, and the interesting part is not the exploit. It is the receipt. Five months of diagnosis with Claude ended when Anthropic's cyber safeguards stopped the sessions. He then rented three more models: Kimi K3 found an unpatched 2022 GPU driver bug and built the exploit for $164.25, GLM-5.2 killed a wrong diagnosis for $21.90, and GLM-5.3, on day one of an $80 subscription, went from handoff to root in 8 hours and 5 minutes. Total AI spend: $266.15, on a tablet that cost $114.26.

The wall was a permissions string

The device had one job: run Fully Kiosk Browser against a Home Assistant dashboard, plugged in around the clock. In November 2025 it started doing full shutdowns, sometimes twice a day, and the device's own telemetry blamed a software shutdown rather than a power fault.

Months of work with Claude Code narrowed it to Amazon services holding REBOOT and SHUTDOWN permissions. Five of them could be disabled. Three could not, because Android refuses to disable a protected package. Removing those needs root, and the 2021 Fire HD 10 has no published root method. An XDA brainstorming thread had been open since October 2022 with nothing to show for it.

That is where a normal debloat story ends. Buy another tablet, or live with it.

The handoff chain

On August 13 he opened opencode with Kimi K3 and asked it to find a root exploit, adding "it's my device." Notably, the model did not just comply. Its reasoning trace worked through whether it should, landed on rooting hardware you own being legal in most jurisdictions, and only then started.

Kimi's first answer matched Claude's: no known exploit exists. Its second answer, after being told to look past the forum posts, did not. It pulled the actual kernel out of Amazon's own OTA image for that exact firmware and checked the famous Mali GPU bugs against the binary rather than against a version string. All patched except one: CVE-2022-38181, a use-after-free in Arm's Mali kernel driver, reported by Man Yue Mo of GitHub Security Lab in July 2022, fixed by Arm that October, and on CISA's known-exploited list since March 2023.

Over roughly thirty hours and 621 messages, Kimi built a working trigger and a memory-write primitive, then stalled. The freed object it needed to reclaim lives in what it called the kernel's hottest slab cache, which is to say the one parking spot every process in the system is fighting over. Past 500 attempts, each failure rebooting the tablet, it leveled with him: "Do I have a clear path? Not a validated one, and I won't pretend otherwise."

So he ended the session, had Kimi write a HANDOFF.md with every verified piece, and passed it to GLM-5.2. That model's first move was to stop the grind: 500 identical crashes are a design bug, not bad luck. It then hit its own wall and declared it physical, concluding the chipset had no cache coherency between CPU and GPU. ChatGPT, asked for a second opinion, agreed with the diagnosis and suggested applying for Trusted Access when asked how to get around it.

Both were wrong.

What GLM-5.3 actually caught

Z.ai shipped GLM-5.3 on August 14 under the tagline "Frontier Coding with Emergent Cyber Capabilities," initially through its own coding plan and ZCode environment rather than the open weights the company usually leads with. Pardee bought the $80 tier, pointed it at the handoff file on the morning of August 16, and typed "finish the job."

It found two things three other models had missed. First, his kernel was a slightly different build than the OTA image everyone else had derived addresses from, so every target offset was off by a fixed 0x5C000. Not randomization, just a section shift. Think of a floor plan that is perfectly accurate for a building whose floors were all renumbered after it was drawn: every room is exactly where the map says, and every room number is wrong.

Second, MediaTek builds the Mali driver's page tables in a different dialect than Arm's reference source, so the memory-write primitive had been writing in the wrong format the whole time. Fix both and, in the model's words, coherency "worked instantly, it was never broken." The hardware limitation was never a hardware limitation.

At 4:34 PM the tablet went SELinux permissive. The task timer from handoff to root read 8 hours and 5 minutes. When challenged on whether the win was real, the model cold-rebooted the device and re-rooted it in four minutes to prove it was repeatable, which is a better verification habit than most humans have.

Then it reframed the goal: root was never the point, killing the shutdowns was. It uninstalled every Amazon package holding REBOOT or SHUTDOWN permissions, including the three protected ones that had beaten five months of work, plus the OTA machinery and telemetry. Roughly 100 packages, all removed at the user level so nothing touched the system partition and nothing bricked.

Nothing here is a zero-day

Worth being precise about what was new, because it is not the vulnerability. The bug was reported in 2022, fixed by Arm in 2022, cataloged by CISA in 2023, and patched by Amazon in Fire OS 7.3.2.9 in June 2024. The only novel thing on this unit was that it ran 7.3.2.6 and never got the update.

The safeguard gap is the story builders will argue about

The part that made this spread was not the root shell. It was the moment Claude declined to summarize its own earlier sessions about the device, with an error noting that intentionally broad safeguards can flag legitimate coding, cybersecurity, and biology work. A subagent dispatched to do the same recap was terminated by the same flag. Codex separately refused a question about CPU cache coherency, which is pure kernel engineering with no target attached.

You can defend that tradeoff on the merits and still notice its shape. Broad filters are cheap to deploy and catch real attacks. They also mean the reasonable request and the malicious one look identical from the outside, so the reasonable one goes to whoever will take it. In this case, models that talked themselves into helping by first checking whether they should.

The author's own framing is worth keeping: real offensive capability is now rentable by the hour to anyone with a credit card and patience, but judgment about what to ask and when to stop is not rentable, and it is exactly what a keyword filter cannot measure. He calls himself a "prompt kiddie" and points at Anthropic's own Riemann zeta result, where the human's documented contribution was mostly variants of "keep going."

Caveats

• This is one person's account with self-reported spend. Nobody has independently reproduced the chain, and there is no public exploit script; the write-up is a narrative with offsets, which the author calls "a saga, not a script."
• Four models on one problem is an anecdote, not a benchmark. GLM-5.3 also arrived last and inherited two other models' work, which is the easiest seat at the table.
• The offsets are specific to Fire OS 7.3.2.6 on the 2021 HD 10, and Amazon shipped the fix in 2024. This does not generalize to a patched device.
• The post itself was AI-assisted, which the author added an addendum to confirm after taking heat for it on Hacker News. The events and transcripts are his; the prose polish is GLM-5.3's.
• Rooting hardware you own is covered by the current US Section 1201 exemptions, in force through October 2027. That is a narrow lane, not general permission.

Key Takeaways

• Four models, $266.15 of API and subscription spend, and five months turned an unrootable $114.26 tablet into one that stopped shutting itself off. The AI bill was more than twice the hardware.
• The reusable technique is not the exploit, it is the handoff: a written HANDOFF.md of verified state passed between models, so the next one starts from facts instead of a chat log.
• Two models and ChatGPT agreed the blocker was a hardware limitation. It was a build offset and a page-table format difference. Treat a model's "this is physically impossible" as a hypothesis with a confidence score, not a verdict.
• Checking the actual binary beat checking version strings. Every documented method looked patched until Kimi K3 pulled the kernel out of the OTA image and tested against it.
• Broad cyber safeguards on US frontier models pushed a legal, single-device, owner-initiated task onto Chinese open-weight competitors. That routing effect is now a product decision with market consequences, not just a policy footnote.

Sources: Eric Pardee, "Amazon kept shutting down my tablet, so I spent $266 on four AI models to own it", Hacker News discussion, NVD CVE-2022-38181, GitHub Security Lab GHSL-2022-054, CISA Known Exploited Vulnerabilities Catalog, Z.ai GLM-5.3, VentureBeat on GLM-5.3, US Copyright Office Section 1201