https://www.cnet.com/news/google-calls-home-hub-security-claims-inaccurate/

Another of his tweets called the Home Hub's security "dismal." In short, Gamblin found that you could use pieces of the Home Hub's code to remotely control the device and potentially put a user's information at risk. Gamblin didn't access specific user information in his hack, but he was able to remotely reboot the device, erase certain settings, and turn off notifications.

Google has responded to Gamblin's work. A spokesperson pointed out to CNET that by his own description, Gamblin is not a security expert. The spokesperson emphasized that "Despite what's been claimed, there is no evidence that user information is at risk."