Hacking the Humane AI Pin (writings.agg.im)

Humane’s sudden shutdown of Ai Pin services after its sale to HP left early adopters with nonfunctional devices and sparked a grassroots reverse‑engineering effort. Buyers on Reddit recovered hardware and discovered four hidden USB 2.0 test pads (behind a moon sticker) exposing Android ADB, but the 1.0mm pitch required custom interposers and community 3D/PCB designs to connect. When leaked APKs appeared online, researchers could easily decompile them (Humane hadn’t obfuscated names), accelerating analysis of onboarding logic, certificate pinning, and SELinux‑restricted behavior. A critical turning point came when an anonymously posted 1.7KB private ADB key unlocked full shell access on many Pins, allowing demos and filesystem dumps. However, Humane’s rigorous SELinux policy blocked network sockets for untrusted apps; researchers implemented a “tethered jailbreak” (OpenPin) that proxies communication via ADB shell processes. They also investigated CVE‑2024‑31317 — an Android vulnerability (patched June 2024) present on the Pin’s 2023‑04‑01 security patch level — which can escalate app permissions to the system SELinux domain by abusing a global setting fed into Zygote. The work highlights how device centralization and poor key management can brick hardware yet make it vulnerable post‑shutdown, and underscores the dual role of community research in restoring functionality and revealing persistent security risks.