ReadingResearchRadarInvestment framework
Sign in / Sign up
← Back to reading
NewsMaterial4 min readDisconfirmAI Editorial

c't 3003 Editor Lukas Rumpler: The Security Key for AI-Controlled Smart Homes Lies Not in Cloud vs. Local, but in the Tools You Grant

Connecting Claude or local models to Home Assistant via the MCP protocol enables complex automation, visual dashboard generation, and troubleshooting. The author conducted a side-by-side performance test comparing cloud and local models on the same task and proposes a tiered permission scheme: use the restricted Assist interface for daily operations, temporarily enable ha-mcp management access only when building, and require step-by-step approval for all changes.

2026-11-13 23:02 GMT+8

In his latest video, c't 3003 editor Lukas Rumpler demonstrates a controversial practice: connecting large language models (LLMs) to Home Assistant via the Model Context Protocol (MCP), granting them administrative permissions over smart home systems. His core conclusion is that security does not depend on whether the model runs in the cloud or locally, but rather on which tool permissions you actually grant.

MCP is an open standard that allows Claude, ChatGPT, Gemini, or local programs like LM Studio to issue operational commands to smart home systems through a unified interface. Home Assistant offers two integration paths: an official built-in MCP server and a community project called ha-mcp installed via HACS. The difference in permissions is vast—the official integration can only query status and toggle devices, whereas ha-mcp possesses nearly 90 tools capable of creating automations, writing dashboards, reading logs, making backups, and even installing HACS extensions. Rumpler likens the former to a remote control and the latter to an administrator login.

He used ha-mcp and Claude to build several items to demonstrate their practical value. The most intuitive example is the dashboard: he described wanting an interface for a kitchen iPad that looks like home decor rather than a technical panel. Claude generated a visualization using Amsterdam canal houses as a metaphor—each house represents a room; windows glow when lights are on, doors open when someone is in the room, and the washing machine is depicted as a small boat with a rotating drum during operation. A second dashboard, inspired by Van Gogh's 'The Yellow House,' uses SVG graphics and animations to present the status of various rooms. He admits he could never have written this code by hand.

Sign in / Sign up
ReadingResearchRadarInvestment framework

More practical scenarios involve complex automation and troubleshooting. He describes bedroom lighting logic involving multiple conditions: lights turn off if no one is present for five minutes, restore previous settings if someone returns within two hours, keep specific lamps on between 8 PM and 2 AM, and partially illuminate upon entry while dimming within two minutes. Writing these branch conditions manually is tedious; Claude directly generates the required automations, scenes, and scripts. Troubleshooting is also effective: when lights unexpectedly turned green, Claude checked the logs and found it was caused by his girlfriend accidentally pressing the wrong switch; when a voice file failed to play, Claude identified that German umlauts in the filename were unsupported by the system.

However, Rumpler emphasizes that this setup can cause serious problems. He lists three categories of risk: First, the secret address key for ha-mcp acts as a password; if leaked, an attacker can install arbitrary code on your home network. Second, if the AI can read your calendar, a meeting invitation containing a malicious instruction could be triggered weeks later—security researchers demonstrated last year using Gemini in a real apartment to execute such prompt injection attacks, resulting in blinds opening and water heaters turning on. Third, all household data processed through Claude passes through Anthropic servers.

His proposed layered defense scheme is as follows: Use the official integration's Assist address for daily use (exposing only devices authorized for the voice assistant, unable to create automations or install extensions); temporarily enable ha-mcp only when construction is needed and immediately disable access afterward; disable dangerous tools unnecessary for the task (installing HACS packages, restarting, deleting) in the ha-mcp panel; set all changes in the Claude connector to require step-by-step approval, allowing each click only once rather than permanently; and simultaneously disable Claude's web search and email functions to prevent the AI from accessing external content and private data simultaneously.

For local model alternatives, Rumpler performed a direct comparison on the same task: instructing both Claude and Qwen3.8-27b (running on an M2 Max MacBook with 64GB RAM) to build an automation to turn off a spherical bedroom light after two hours. Claude completed the task in under a minute; Qwen took 30 minutes across three attempts, with single reasoning pauses exceeding four minutes, struggling for minutes solely over whether the duration should be formatted as 02:00:00 or hours: 2. Later, he asked Qwen to troubleshoot a light that wouldn't turn on. The model did find a logical error Rumpler admitted he would never have discovered independently (the automation checked if the light was off before it had actually turned off, so the restoration condition never triggered). However, its proposed fix introduced new issues—the light would jump to maximum brightness every time it restored, ignoring previous dimming states.

Rumpler explains that local models are slow because Home Assistant returns massive amounts of data at every step, which the model must read before proceeding; Mac inference chips are far slower than dedicated GPUs when processing large context inputs. His conclusion is: use cloud models for building complex content, and local models for simple operations and privacy-sensitive scenarios, but regardless of the choice, human review cannot be skipped. AI handled the writing for him, but not the verification.

Sources

  • heise.dec't Magazin↗
Continue researching →