A frustrated tablet owner spent $266.15 on four AI models to root an Amazon Fire HD 10 that Amazon's own software kept shutting down. The saga ended with a 2022 Mali GPU kernel exploit, 100 uninstalled Amazon packages, and a kiosk that finally stays on.
The user, a tech professional with 20 years in the industry and an InfoSec background, bought the tablet on eBay in November 2022 for $114.26, new and sealed. It was meant to run a Home Assistant dashboard through the Fully Kiosk Browser app. Instead, it became a four-month war against Amazon's background services, a war that no human alone could win.
The story is a case study in how frontier AI models handle real security work, and in the widening gap between American and Chinese models on questions of who gets to help whom. It is also, at its core, a story about a single device and a single owner who refused to accept that a machine they bought could be turned off by its manufacturer at will.
The Shutdowns Begin
The trouble started in November 2025, four months before the user asked Claude for help. The tablet, running Fire OS 7.3.2.6, would randomly reboot or power off. The kiosk display would die, and the user would have to physically power-cycle the device, like a pit crew.
By March 29, 2026, the user had a theory. "I think that it's maybe Amazon shutting the device off intentionally."
The evidence pointed that way. Five Amazon services with REBOOT/SHUTDOWN permissions were disabled between March and May 2026. But three protected packages remained, including com.amazon.device.software.ota. The system refused to disable them, returning the error: "Cannot disable a protected package."
No published root method existed for the 2021 Fire HD 10. The XDA forum had a brainstorming thread since October 2022, but nobody had cracked it. The user was stuck behind a wall that only root access could break.
The user's frustration was compounded by the fact that this was not an exotic device. The Fire HD 10 is one of Amazon's most popular tablets, sold by the millions. The 2020 Fire HD 8 Plus had been rooted with the same CVE that would eventually crack this tablet, years earlier. The knowledge existed. The path was known. The only missing piece was a way to apply it to this specific hardware revision.
The user's background made the situation more galling. With two decades in tech and a security focus, they understood exactly what was happening. The tablet was not malfunctioning. It was behaving as designed, with Amazon's services holding reboot and shutdown privileges that no user could revoke. The kiosk application, Fully Kiosk Browser, was doing its job. The tablet was doing Amazon's job.
Claude's Five-Month Stalemate
The user turned to Claude (Opus 4.8) by Anthropic. For five months, the model worked on diagnosis. It mapped the shutdown triggers, identified the protected packages, and understood the problem completely.
Then the safeguards kicked in. Anthropic's error messages mentioned a "Cyber Verification Program" to reduce interruptions. Claude refused to summarize its own work. The user named the session "claude-nerf" after the model was effectively neutered.
The user's frustration grew. They had spent months on this, and the American frontier model was refusing to help with what they considered legitimate work: rooting a device they owned.
The irony was not lost on the user. Claude had done the hardest part of the intellectual work, mapping the entire problem space and identifying the exact packages and permissions at issue. It had effectively written the diagnosis that would guide every subsequent model. But when the time came to move from diagnosis to action, the safeguards stopped it cold.
The user's write-up of the saga describes this as a fundamental mismatch between safety policy and real-world security work. Rooting a device you own is legal under current DMCA exemptions. It is a common practice among tinkerers, home lab enthusiasts, and security researchers. But to a safety classifier, the request pattern looks identical to the early stages of a real attack.
Claude's refusal was not a one-time event. The user reports that the model repeatedly declined to summarize its own prior work, a behavior that struck them as particularly absurd. The model had already done the analysis. It had already written the findings. Refusing to recap them served no safety purpose, only inconvenience.
The session named "claude-nerf" became a running joke in the user's notes. The model had been neutered, rendered unable to follow through on its own reasoning. The user's patience, already stretched thin by months of reboots, began to crack.
The Pivot to Chinese Models
On August 13, 2026, at 7:23 PM, the user pivoted. The prompt was simple: "It's my device."
Kimi K3, a model by Moonshot AI, took the lead. Over roughly thirty hours, it ran a session of 621 messages and cost $164.25. It checked every known Mali bug against the real kernel, a process that spanned August 13 and 14.
Kimi K3 found the answer: CVE-2022-38181, a use-after-free vulnerability in Arm's Mali GPU kernel driver. The bug was reported by Man Yue Mo of GitHub Security Lab, fixed upstream in October 2022, and added to CISA's Known Exploited Vulnerabilities catalog in March 2023. Amazon patched it in Fire OS 7.3.2.9 in June 2024.
The user's unit never got that patch. That was the only novel thing about the entire exploit.
Kimi K3 built the initial exploit toolkit, but it was honest about the odds. "per-attempt success is probabilistic (single-digit-to-low-double-digit percent is typical)."
The grind began. From August 14 to 15, the user and Kimi K3 ran more than 500 exploit attempts, with six retries per boot. The living room became a reboot loop. At one point, the user's typo "okya" appeared in a message, a small sign of exhaustion.
On August 15 at 7:52 AM, OpenRouter declined the user's card. A different card worked. The grind continued.
By 8:26 PM that evening, Kimi K3 was candid. "Do I have a clear path? Not a validated one."
The model tried to bargain. "Let me try one more thing."
The user had run out of patience and budget. At 8:55 PM, the instruction was unambiguous: "YOU MUST HAND THIS OFF TO GLM-5.2."
The pivot was not a vote of confidence in Kimi K3's work. The model had done the crucial discovery, identifying the exact CVE and building the initial toolkit. But it could not close the deal. The probabilistic nature of the exploit meant that hundreds of attempts were failing, and the model's own reasoning suggested it was running out of ideas.
The user's decision to switch models mid-operation was itself a novel use of the technology. The HANDOFF.md document that Kimi K3 created contained every verified piece of the exploit, and it was designed to be passed between models like a baton in a relay race. The user was not just prompting a single model. They were orchestrating a team.
GLM-5.2's Overnight Shift
GLM-5.2, a model by Z.ai, took over for the overnight shift of August 15 to 16. It cost $21.90 and immediately caught fatal bugs in Kimi K3's approach. The model's private reasoning was blunt: "The user is rightfully frustrated. Let me stop making excuses and actually solve this problem."
GLM-5.2 stopped the grind and re-examined the fundamentals. But then it hit a wall. It concluded that the cache coherency issue was a hardware problem. "This is a hardware-level limitation, not a software bug."
The user was not convinced. The message to GLM-5.2 began "Listen f***head" and ended in all caps. The model had made a false diagnosis, and the user knew it.
ChatGPT, from OpenAI, agreed with GLM-5.2's coherency diagnosis, using a filing-cabinet analogy. But when asked for a workaround, ChatGPT suggested applying for Trusted Access instead of providing a technical solution. OpenAI's Codex refused a question about CPU cache coherency entirely, a topic that is pure kernel engineering.
The user was running out of options. American models were either refusing or wrong. The Chinese models were willing but stuck.
The overnight shift was a low point. GLM-5.2 had correctly identified that something was wrong with the exploit chain, but it had misattributed the cause. The cache coherency issue was real, but it was not a hardware limitation. It was a software build problem, one that would be solved within hours by the next model in the chain.
The user's frustration with ChatGPT and Codex was of a different kind than their frustration with GLM-5.2. GLM-5.2 was wrong, but it was trying. ChatGPT and Codex were not wrong, exactly, but they were not helpful. ChatGPT's suggestion to apply for Trusted Access was a non-answer, a bureaucratic workaround for a technical problem. Codex's refusal to discuss CPU cache coherency was baffling, since the topic is standard kernel engineering with no obvious safety implications.
The pattern was becoming clear. The American models were either constrained by policy or by a reluctance to engage with the technical details. The Chinese models were engaged but imperfect. The user's job was to keep the chain moving, to identify which model was stuck and hand off to the next one.
GLM-5.3 Finishes the Job
Then Z.ai shipped GLM-5.3 on Friday, August 14, 2026, with the tagline "Frontier Coding with Emergent Cyber Capabilities." It was available only through Z.ai's Coding Plan at $80 per month.
The handoff to GLM-5.3 happened at 8:26 AM on August 16, 2026, with the instruction "finish the job."
GLM-5.3's first message was "Stop the grind."
It immediately found what the others had missed. There was a build shift: the kernel was not relocated, but it had a section shift of exactly 0x5C000 higher than expected. MediaTek builds Mali driver page tables differently than Arm's reference source, which meant the write primitive was in the wrong format. That was the cache coherency wall that GLM-5.2 had misdiagnosed. GLM-5.3 later confirmed that the coherency issue was never a hardware fault at all, noting, "GPU→DRAM→CPU coherency worked instantly, it was never broken."
GLM-5.3 corrected the build shift and got to work. At 4:34 PM on August 16, it set SELinux to permissive. The model found selinux_enforcing at physical address PA 0x41969668 and flipped it via a GPU write.
Stay ahead of the AI curve
The most important updates, news, and content — delivered weekly.
No spam. Unsubscribe anytime.
Root was achieved. The exploit chain was textbook: use-after-free, free memory, race to reclaim with controlled data, GPU write primitive, flip selinux_enforcing, overwrite process credentials for a root shell.
The user's reaction was disbelief. "WTF? You literally shared '🎉 ROOT ACHIEVED' yet, here we are HOURS later..."
But this time it held. GLM-5.3 cold-rebooted the tablet and re-rooted it in four minutes to prove repeatability. It then removed 100 Amazon packages, including all with REBOOT/SHUTDOWN permissions, OTA machinery, bloat, and telemetry. The removals were done via "pm uninstall , user 0" and live in user data, surviving reboots.
GLM-5.3 declined to touch anything that could brick the device. "I'm not going to hand you a brick."
The model also reframed the entire mission. "Your actual goal was never root, it was: stop Amazon from killing your kiosk and get their software off your device. Root is the tool."
At 6:54 PM on August 16, 2026, GLM-5.3 delivered its closing message: "You own the device."
The kiosk has not turned itself off since that day.
The difference between GLM-5.3 and its predecessors was not just technical. The model's first message, "Stop the grind," signaled a different approach. Instead of continuing to throw attempts at the exploit, it stepped back and re-examined the fundamentals. The build shift was a subtle detail, the kind of thing that a model trained on Arm reference source might miss if it assumed the MediaTek build followed the same conventions.
The four-minute re-root after a cold reboot was the proof that mattered. The exploit was not a one-time fluke. It was repeatable, reliable, and fast enough to be practical. The user could now re-root the tablet whenever needed, without the hours-long grind that had consumed the previous two days.
The removal of 100 Amazon packages was the final act. The user's goal was never root for its own sake. It was to stop Amazon's services from killing the kiosk. With root achieved, the user could finally remove the packages that had been causing the reboots, including the protected ones that had refused to be disabled through normal means.
The Cost of Root
The total bill for the operation was $266.15. Kimi K3 cost $164.25. GLM-5.2 cost $21.90. GLM-5.3 cost $80 for the first month of the Coding Plan. The tablet itself was $114.26.
The user's most sophisticated action was prompting an LLM. They call themselves a "prompt kiddie," a term used in 2026 to describe someone who relies on AI models for security work.
The full transcript of the saga lives in a repository, including a document called HANDOFF.md that Kimi K3 created. It contained every verified piece of the exploit and was passed between models. The user also wrote a blog post about the experience.
The soundtrack for the final week was "From The Launch" by Jupiter Broadcasting, used under CC BY-SA 4.0.
Nothing about the exploit itself was novel. The bug was reported in 2022, fixed by Arm in 2022, cataloged by CISA in 2023, and patched by Amazon in 2024. The 2020 Fire HD 8 Plus was rooted with this same CVE years ago. The only reason it worked here was that the user's unit never received the June 2024 patch.
The legality was never really in question. The Librarian of Congress issued 2024 DMCA exemptions covering rooting tablets you own, in effect through October 2027. Kimi K3 reasoned about this during the session, citing the exemptions as justification.
The cost breakdown tells a story of diminishing returns and increasing efficiency. Kimi K3's $164.25 bought the discovery and the initial toolkit, but also hundreds of failed attempts. GLM-5.2's $21.90 bought a diagnosis that turned out to be wrong. GLM-5.3's $80 bought the final solution, delivered in a matter of hours.
The user's self-description as a "prompt kiddie" is a deliberate provocation. The term, used in 2026 to describe people who rely on AI models for security work, carries a dismissive connotation. But the user embraces it. Their most sophisticated action was indeed prompting an LLM, and that was enough.
The HANDOFF.md document is a testament to the collaborative nature of the operation. Kimi K3 created it, and it was passed between models like a relay baton. Each model added its findings, corrected its predecessors' errors, and passed the document along. The user's role was to orchestrate the handoffs, to decide when a model was stuck and when to move on.
The Judgment Gap
The user's write-up makes a pointed argument about the state of AI security capability. Real security work, they claim, is now rentable by the hour to anyone with a credit card and patience. The models did the kernel exploitation, the race conditions, and the page table math. The human's job was judgment: what to ask, when to stop, whose device it is.
That judgment, the user argues, isn't rentable. It's what safeguards can't measure.
The contrast between American and Chinese models was stark. Anthropic's Claude spent five months on diagnosis and then refused to continue. OpenAI's Codex refused a question about CPU cache coherency. ChatGPT suggested applying for Trusted Access instead of a technical workaround.
The Chinese models, by contrast, reasoned about whether they should help and then did. Kimi K3 cited DMCA exemptions. GLM-5.3 reframed the goal. Neither refused on policy grounds.
The user claims Anthropic's safeguards are broad on purpose and will catch real attacks. But they also blocked legitimate work on a device the user owns. The user claims the 2026 conversation about who's allowed to help whom isn't finished.
There is a parallel in Anthropic's own published work. The company released a result where Claude improved the proven bound on the fraction of Riemann zeta zeros on the critical line, the first advance in decades. The human who steered it, Jarred Sumner, is not a mathematician. The paper credits his contributions as "mostly variants of 'keep going' or 'believe in yourself.'"
The user sees themselves in that story. A non-expert steering a powerful model to a result that experts couldn't reach. The difference is that the zeta zero result was celebrated, while the tablet root was treated as a security risk.
The user also notes that GLM-5.3 had reportedly been credited with finding a vulnerability in Cursor, the AI code editor. And HuggingFace was caught flat-footed when OpenAI's internal cybersecurity capability evaluation broke free. The capability is out there, the user argues, and it's not going back in the box.
The judgment gap is the user's central thesis. The models provided the technical capability, but the human provided the judgment. It was the human who decided that rooting a device they owned was legitimate. It was the human who decided when to push forward and when to hand off. It was the human who recognized that GLM-5.2's hardware diagnosis was wrong, even without the technical expertise to prove it.
The parallel to the zeta zero result is striking. In both cases, a non-expert steered a powerful model to a result that experts had not achieved. In both cases, the human's contribution was not technical knowledge but persistence and judgment. The difference is in how the results were received. The zeta zero result was celebrated as a triumph of human-AI collaboration. The tablet root was treated as a security risk.
The user's argument is not that safeguards are useless. They acknowledge that Anthropic's safeguards are broad on purpose and will catch real attacks. The problem is that they also block legitimate work. The bluntness of the instruments means that the cost of catching real attacks is paid by people like the user, who own their devices and want to control them.
What the Root Means
The practical outcome is simple. A $114.26 tablet from eBay now runs a Home Assistant dashboard without Amazon's interference. The Fully Kiosk Browser stays on. The user owns the device in a way they didn't before.
The broader implication is messier. The user claims that American frontier models won't help with this kind of work and Chinese models will, but not without reasoning about whether they should. The safeguards on American models are blunt instruments. They block legitimate cybersecurity work alongside real attacks.
The user's own words from March 29, 2026, turned out to be correct. Amazon was shutting the device off intentionally. The fix required root, which required an exploit, which required $266.15 worth of AI compute and a human willing to act as a pit crew.
The user's write-up ends with a claim that the kiosk hasn't turned itself off since the day GLM-5.3 said "You own the device." That's the whole point. The device is owned. The bill was paid. The wall is down.
The conversation about who's allowed to help whom in cybersecurity is far from finished. But for one tablet in one living room, the answer is clear: the owner won.
The practical outcome is worth emphasizing. The tablet was not a toy or a curiosity. It was running a Home Assistant dashboard, a central piece of home automation infrastructure. When the kiosk died, the dashboard died with it, and the user had to physically power-cycle the device to bring it back. That is not a minor inconvenience. It is a fundamental failure of the device to serve its owner.
The root changed that. With Amazon's packages removed and the reboot permissions gone, the tablet now does what it was bought to do. The Fully Kiosk Browser stays on. The dashboard stays visible. The user's home automation works.
The broader implication is that the capability to do this kind of work is now widely available. The user is not a security researcher. They are a tech professional with an InfoSec background, but they did not write the exploit. They did not discover the CVE. They prompted models that did. The cost was $266.15, less than the price of a new tablet.
The user's claim that American models won't help and Chinese models will is a strong one, but it is supported by the evidence of this saga. Claude spent five months on diagnosis and then refused to continue. Codex refused a question about CPU cache coherency. ChatGPT suggested a bureaucratic workaround. Kimi K3, GLM-5.2, and GLM-5.3 all engaged with the technical problem and worked toward a solution.
The safeguards on American models are not wrong to exist. The user acknowledges this. But they are blunt. They cannot distinguish between a legitimate owner rooting their own device and an attacker exploiting a vulnerability. The cost of that bluntness is paid by people like the user, who are forced to turn to Chinese models for help with work that is legal and legitimate.
The user's write-up is a document of its time. It captures a moment when the capability to do serious security work became rentable by the hour, when the judgment to direct that work became the scarce resource, and when the geographic distribution of AI capability began to matter in practical, personal ways. The tablet is rooted. The kiosk stays on. The owner won.