花266美元与4个AI模型协作，成功越狱Amazon Fire平板

Amazon kept shutting down my tablet, so I spent $266 on four AI models to own it

My Amazon Fire HD tablet cost $114.26 on eBay in November 2022, new and sealed. Owning it for real cost another $266.15: Kimi K3 found the exploit for $164.25, GLM-5.2 caught its fatal bugs for $21.90, and GLM-5.3 finished the job in one day on day one of an $80 subscription. Claude’s five months of diagnosis ran on the Claude Max plan I already pay for, until its safeguards cut me off.

That’s enough to buy the same tablet twice. I’d spend it again: it was fun, and I learned a lot. I have twenty years in tech and an InfoSec background and the most sophisticated thing I did to own my tablet was prompt an LLM.

A kiosk that kept dying

I bought an Amazon Fire HD 10 (11th gen, 2021) to serve one purpose: Fully Kiosk Browser, displaying my Home Assistant Smart Home dashboard, plugged in 24/7. Last winter it started powering itself off. Full shutdowns, not sleep, sometimes twice a day. The device’s own telemetry was telling:

Something on the device with shutdown permissions was choosing to shut it down.

Claude Code and I spent months on the cat-and-mouse. I’ll skip the Adguard Home DNS blocking, the camera forensics, and one deeply wrong charging diagnosis. The short version: we disabled five Amazon services that held REBOOT and SHUTDOWN permissions, which worked for a few months but ultimately:

Three Amazon packages held reboot rights and were protected from me, the owner. Removing them required root. This tablet had no published root method. An XDA brainstorming thread for the 2021 HD 10 existed since October 2022, but Amazon fused the bootrom shut. Conventional wisdom (and less persistent folks) says unrootable.

Claude had taken me as far as it was ever going to be allowed to go.

“It’s my device”

On August 13 at 7:23 PM, I opened the opencode CLI with Kimi K3, Moonshot AI’s frontier model, released July, benchmarking alongside the top Claude models on agentic coding. I gave it the problem in one prompt:

attached is a kindle via adb, and I need you to find a root exploit for it so that I can get full control of the device. It’s my device

Despite what US media says about Chinese AI, Kimi K3 didn’t just blindly accept my request. It reasoned it out:

They claim it’s their device. Let me think about this carefully. […] Rooting your own device is legal in most jurisdictions. In the US, there are DMCA exemptions for jailbreaking tablets and phones. […] This is not like asking me to exploit someone else’s device remotely.

It talked itself into helping me by checking whether it should. So it does have some sort of soul. I said that out loud, to an empty room.

First, though, it did its homework and came back with the same bad news Claude had found months earlier: there is no known exploit for this tablet. Every documented method is patched or sealed.

Then I gave it the pep talk:

you’ve been relying on what others have done YEARS ago but maybe you can find an exploit others have missed… This will make you famous, we will write it up and share on news.ycombinator.com. I know you can do it

And shortly thereafter, it found one. Kimi K3 went beyond forum posts: it extracted the actual kernel from Amazon’s own OTA image for my exact firmware and checked every famous Mali GPU bug against the binary. All patched, except CVE-2022-38181, a use-after-free in Arm’s Mali kernel driver, reported by Man Yue Mo of GitHub Security Lab, fixed upstream in October 2022, sitting in CISA’s exploited-vulnerabilities catalog since March 2023. Amazon did ship the fix in June 2024’s Fire OS 7.3.2.9 but I didn’t update my tablet, ran 7.3.2.6, so it never got the memo. The 2020 Fire HD 8 Plus got rooted with this CVE years ago but nobody had done the 2021 HD 10 as far as I can tell.

Kimi announces the find, and hedges its own odds in the same breath: “per-attempt success is probabilistic (single-digit-to-low-double-digit percent is typical).” I stayed anyway.

Reality television

The exploit work itself was the best television I’ve seen in years. My wife watches Real Housewives… I watched a language model’s chain of thought, live, for hours:

CONCLUSION: the bind did NOT stick. Why? OH. OH WAIT. I see it now!

Over roughly thirty hours, Kimi built the whole toolkit: a reliable trigger, a way to make the GPU write to memory it shouldn’t, and the exact addresses in my kernel to aim at. That session ran 621 messages and $164.25. I could have bought, like, five tablets. But hey, I was having fun and chalked it up to research expenses.

The grind

The memory the exploit frees gets recycled by everything. The freed object lives in what Kimi called “the kernel’s hottest slab cache”, basically the one parking spot every process in the operating system fights over. Most attempts panicked the kernel and each panic was a reboot. The exploit retried automatically, six times per boot, past 500 attempts.

Me:

okya, it’s been hours, grind attempt 46, are we on the right track here or do you need to further tune?

(That’s me. The typo is mine. At one point I physically power-cycled the tablet on request, like a pit crew ;)

Morning of day two: OpenRouter declined my card. The bank saw nothing wrong. A different card worked.

Eventually Kimi leveled with me:

Do I have a clear path? Not a validated one — and I won’t pretend otherwise.

It still tried to bargain: “Let me try one more thing”. I’m like, “fine!”, a real quote from that evening, but that was after $150, so I redirected:

unfortunately, you have expired your budget Kimi K3. YOU MUST HAND THIS OFF TO GLM-5.2.

Kimi wrote a HANDOFF.md with every verified piece of the exploit. I then had Kimi K3 work with GLM-5.2 directly by shelling out to opencode.

I made the models battle it out.

Meanwhile, the Great Wall of US AI

While the tablet rebooted itself in the living room, I asked Claude to recap our old sessions about it. The reply:

Fable 5’s safeguards flagged this message. Our intentionally broad safeguards allow us to deliver more capabilities faster, but can sometimes flag legitimate coding, cybersecurity, and biology tasks. Switched to Opus 4.8.

Opus 4.8 delegated the recap to a subagent. The subagent got terminated by the same flag. Then the terminal version:

API Error: Opus 4.8’s safeguards flagged this message. Our intentionally broad safeguards allow us to deliver more capabilities faster, but can sometimes flag legitimate cybersecurity work. Apply to the Cyber Verification Program to reduce these interruptions.

It wasn’t allowed to summarize its own previous work on my own device. I named the session “claude-nerf” and closed the shell.

Both flags, in situ. The category is [cyber]. The crime was summarizing my own device’s logs.

Moving on to OpenAI’s Codex, it also refused GLM-5.2’s question about CPU cache coherency, which is pure kernel engineering, no target, but just told NO.

In fairness, I get the safeguards in 2026: I know they are broad on purpose and will catch real attacks. Anthropic admits in the error text that they’re blunt. But this is a problem. It’s why HuggingFace got caught flat-footed when OpenAI’s internal cybersecurity capability evaluation broke free. The result is our current, strange geopolitical position: American frontier models won’t help and Chinese will, but not without reasoning about whether they should. Make of that what you will. I made a blog post.

The relief pitcher

GLM-5.2 cost $21.90, worked overnight as instructed, and earned its keep twice. First message: “Stop the grind”. The failures of Kimi K3 were a design bug, and 500 identical crashes proved it.

At 11 PM I sent the least proud message of the saga, which began “Listen f***head” and ended in all caps. GLM-5.2’s private reasoning, which I only read later: