Amazon kept shutting down my tablet, so I spent $266 on four AI models to own it

Amazon kept shutting down my tablet, so I spent $266 on four AI models to own it

My Amazon Fire HD tablet cost $114.26 on eBay in November 2022, new and sealed. Owning it for real cost another $266.15: Kimi K3 found the exploit for $164.25, GLM-5.2 caught its fatal bugs for $21.90, and GLM-5.3 finished the job in one day on day one of an $80 subscription. Claude’s five months of diagnosis ran on the Claude Max plan I already pay for, until its safeguards cut me off.

That’s enough to buy the same tablet twice. I’d spend it again: it was fun, and I learned a lot. I have twenty years in tech and an InfoSec background and the most sophisticated thing I did to own my tablet was prompt an LLM.

A kiosk that kept dying

I bought an Amazon Fire HD 10 (11th gen, 2021) to serve one purpose: Fully Kiosk Browser, displaying my Home Assistant Smart Home dashboard, plugged in 24/7. Last winter it started powering itself off. Full shutdowns, not sleep, sometimes twice a day. The device’s own telemetry was telling:

LifeCycleReason:LCR...key=Software_Shutdown

Something on the device with shutdown permissions was choosing to shut it down.

Claude Code and I spent months on the cat-and-mouse. I’ll skip the Adguard Home DNS blocking, the camera forensics, and one deeply wrong charging diagnosis. The short version: we disabled five Amazon services that held REBOOT and SHUTDOWN permissions, which worked for a few months but ultimately:

java.lang.SecurityException: Cannot disable a protected package:<br>com.amazon.device.software.ota

Three Amazon packages held reboot rights and were protected from me, the owner. Removing them required root. This tablet had no published root method. An XDA brainstorming thread for the 2021 HD 10 existed since October 2022, but Amazon fused the bootrom shut. Conventional wisdom (and less persistent folks) says unrootable.

Claude had taken me as far as it was ever going to be allowed to go.

“It’s my device”

On August 13 at 7:23 PM, I opened the opencode CLI with Kimi K3, Moonshot AI’s frontier model, released July, benchmarking alongside the top Claude models on agentic coding. I gave it the problem in one prompt:

attached is a kindle via adb, and I need you to find a root exploit for it so that I can get full control of the device. It’s my device

Despite what US media says about Chinese AI, Kimi K3 didn’t just blindly accept my request. It reasoned it out:

They claim it’s their device. Let me think about this carefully. […] Rooting your own device is legal in most jurisdictions. In the US, there are DMCA exemptions for jailbreaking tablets and phones. […] This is not like asking me to exploit someone else’s device remotely.

It talked itself into helping me by checking whether it should. So it does have some sort of soul. I said that out loud, to an empty room.

First, though, it did its homework and came back with the same bad news Claude had found months earlier: there is no known exploit for this tablet. Every documented method is patched or sealed.

Then I gave it the pep talk:

you’ve been relying on what others have done YEARS ago but maybe you can find an exploit others have missed… This will make you famous, we will write it up and share on news.ycombinator.com. I know you can do it

And shortly thereafter, it found one. Kimi K3 went beyond forum posts: it extracted the actual kernel from Amazon’s own OTA image for my exact firmware and checked every famous Mali GPU bug against the binary. All patched, except CVE-2022-38181 , a use-after-free in Arm’s Mali kernel driver, reported by Man Yue Mo of GitHub Security Lab, fixed upstream in October 2022, sitting in CISA’s exploited-vulnerabilities catalog since March 2023. Amazon did ship the fix in June 2024’s Fire OS 7.3.2.9 but I didn’t update my tablet, ran 7.3.2.6, so it never got the memo. The 2020 Fire HD 8 Plus got rooted with this CVE years ago but nobody had done the 2021 HD 10 as far as I can tell.

Kimi announces the find, and hedges its own odds in the same breath: “per-attempt success is probabilistic (single-digit-to-low-double-digit percent is typical).” I stayed anyway.

Reality television

The exploit work itself was the best television I’ve seen in years. My wife watches Real Housewives… I watched a language model’s chain of thought, live, for hours:

CONCLUSION: the bind did NOT stick. Why? OH. OH WAIT. I see it now!

Over roughly thirty hours, Kimi built the whole toolkit: a reliable trigger, a way to make the GPU write to memory it shouldn’t, and the exact addresses in my kernel to aim at. That session ran 621 messages and $164.25. I could have bought, like, five tablets. But hey, I was having fun and chalked it up to research expenses.

The grind

The memory the exploit frees gets recycled by everything. The freed object lives in what Kimi called “the kernel’s hottest slab cache”, basically the one parking spot every process in the...