AI
The £135 Shortcut and the Rules That Replaced It
Smart weather stations that work with Home Assistant cost £135. Paxton-Fear decided to spend less and ordered a radio weather station with wireless sensors, plus an ESP32, from AliExpress. The plan was to get Gemini to write all the firmware. She set strict rules: Gemini only, no Googling, buy only what Gemini recommends, use only libraries Gemini specifies. Her partner’s warning from her first hardware project applied from day one: it’s expensive to be bad at this.
Loading Gemini with Domain Knowledge
Paxton-Fear chose Gemini 2.5 Pro partly because it can search the internet, reducing hallucinations, and partly because it came bundled with her Google subscription. She built a custom Gem, loading it with 10 reference files: books on IoT hacking, hardware hacking, API security, and C programming. She fed it a prompt asking for a full project plan with deliverables and sources. Gemini’s first move was to redirect her away from tapping SPI lines toward radio frequency analysis.
RF Capture, Stripped Wire Antenna, and Packet Timing
With an SDR dongle and RTL433, she captured the weather station’s radio transmissions. Gemini specified which pins to use on the ESP32 devboard. There was no antenna, so she stripped a wire and bent it upward. Decoding the custom packet structure required many hours of prompting. Channel one kept failing. The eventual fix was accidental: printing to the serial port slowed the loop enough that packets could be captured without timing errors between samples.
Where Gemini Fails: Sparse Training Data in ESPHome YAML
The original plan was Zigbee on the ESP32C6. Gemini overruled it and pushed ESPHome. Generating correct ESPHome YAML config took four to five hours of prompting. ESPHome config is specific to each device setup, and Gemini likely had sparse training data for it, so it guessed. After all that, the real problem surfaced: the ESP32C6 doesn’t support ESPHome. Swapping in a spare ESP32 she already had took minutes and the config worked immediately.
What the Project Actually Proved
The finished device has eight wires and reads wrong temperatures. Channel one shows wild fluctuations while channel two is stable, and both sensors sit next to each other. The £135 integrated weather station would have worked out of the box. The project’s sharpest finding: AI generates code well when the task maps to familiar APIs or dense training data. ESPHome YAML and microcontroller timing logic had neither. Her earlier e-ink label project worked because web APIs gave Gemini a solid foundation.
Q&A
Which version of Gemini did you use? Gemini 2.5 Pro, though she also cross-checked it against ChatGPT and found Gemini performed better for this hardware project. ▶ 17:06
Why did Gemini keep generating wrong ESPHome YAML? Likely sparse training data for device-specific ESPHome configs, so it was hallucinating plausible-looking YAML rather than generating from knowledge. ▶ 17:44
Did AI give better advice than expected on the RF approach? Yes, it immediately identified radio frequency capture as the right method and steered her away from physically tapping SPI lines, a technique she hadn’t considered and lacked the skills to execute. ▶ 20:31
Notable Quotes
No thoughts, just vibes. Like Katie Paxton-Fear · ▶ 5:07
Challenge accepted. I don’t give up. Why Katie Paxton-Fear · ▶ 12:37
Wounded, right? Let’s keep going. So Katie Paxton-Fear · ▶ 14:01
Key Takeaways
- AI generates IoT firmware well when the target has a documented API or dense training data.
- Always commit working code before prompting for changes; AI cannot recover from its own regressions.
- Radio frequency capture is simpler than physical SPI tapping for devices with wireless sensors.
- ESPHome YAML is specific enough that current LLMs hallucinate more than they help.
About the Speaker(s)
Katie “InsiderPhD” Paxton-Fear is an API security expert and Security Advocate at Semgrep. A former API developer turned API hacker, she has found vulnerabilities in organizations ranging from the Department of Defense to Verizon. She has been featured in the Wall Street Journal, BBC News, ZDNet, and The Daily Swig. She regularly delivers security training and research to large brands, combining accessible explanations with technical depth.