Can your Amazon Alexa devices be hacked?

Amazon Alexa devices are surprisingly secure as of 2026, even though they still listen to their password. There are no widely known, unpatched exploits that allow attackers to remotely take over current Alexa devices. Most documented attacks require malicious actors to gain physical access to the smart speaker or trick users into taking action. If someone manages to access the Bluetooth on your Alexa and successfully pairs, they could potentially take control via pre-recorded sounds, but again, they’ll need to be physically on your property.

That’s not to say the Alexa line of hardware is infallible. Researchers have demonstrated several ways to hijack speakers over the years, but Amazon is relatively quick to patch reported vulnerabilities. In 2022, researchers published a paper demonstrating one of the newest attack methods. However, this still required prior preparation and access to the device.

Since Amazon launched Alexa-enabled devices in 2014, the number of real, publicly documented hacks has remained relatively small. More serious attacks have targeted indoor security cameras, but listening in on conversations is still a concern when you have an Alexa in the house. That said, many detailed hacks require extensive setup and, again, physical access to the device.

In 2017, British company MWR Labs managed to turn a first-generation Echo into a wiretap. This was done by opening the base which, on these early iterations, featured metal pads for connection to the device’s internal hardware from the factory. With a bit of MacGyver ingenuity, researchers were able to take complete control of Alexa using custom malware.

The following year, a woman reported that an Alexa device sent a voice message to a random contact on her list. Amazon insisted this was because the voice recognition system misheard the words “Alexa” and “send a message.” Also in 2018, at DEF CON 26, researchers explained how they hacked an Alexa (among other smart home hubs) and broke into its software to manipulate it. Again, this required physical access.

Further research by SR Labs in 2019 revealed that a malicious Alexa skill could potentially be used for “vishing,” or voice phishing, to trick users into revealing their passwords. The researchers later published a full demo showing how the attack worked and claimed that Amazon had not fixed the problem six weeks after the disclosure.

Check Point Research also discovered a vulnerability in 2020 that could allow attackers to remove or install Alexa apps and skills. Rather than gaining physical or full access to the device, this attack involved tricking users into clicking on a malicious link. According to Check Point, a successful attack could have exposed passwords, personal information and voice history, and “silently” installed skills, viewed installed skills, or deleted them. As is the case with many phishing attacks, the exploit depended on the victim clicking on a malicious link. Amazon fixed the vulnerability before it became widespread.

Since 2022, newly revealed Alexa vulnerabilities have become less common, but jailbreaking older or now-obsolete Echo devices has become somewhat of the norm among some customers unwilling to give in to planned obsolescence. Currently, the Echo Show 5 (first and second generation) and Echo Show 8 are the only Amazon Alexa devices with confirmed community jailbreaks. Whether these devices are still worth owning is another question entirely.