Security Risks in Open-Source AID Communities

Security Risks in Open-Source Automated Insulin Delivery (AID) Communities

Introduction

Open-source automated insulin delivery (AID) systems such as Loop and OpenAPS were built by people with diabetes and their families, and their code is shared publicly on GitHub [1]. An AID system links a continuous glucose monitor (CGM), an insulin pump and an algorithm that adjusts insulin delivery. The security story starts at the very beginning. When we read the 2022 international consensus statement on these systems, we found that OpenAPS grew out of the ability to send remote commands to a commercial insulin pump, first shown on a Medtronic MiniMed pump at a security conference in 2011 [1]. That kind of wireless access later became the reason for a Medtronic recall [2].

Security Risks

Most of the risk sits in the hardware these systems depend on. The rest comes from how the software is installed and how data is shared. OpenAPS and Loop were built around older Medtronic pumps; Loop, for example, supports models 515/715 and 522/722, the 523/723 with firmware 2.4A or lower, and certain firmware versions of the Paradigm Veo 554/754 [1]. A phone can't talk to those pumps directly. A small radio bridge called a RileyLink receives Bluetooth Low Energy (BLE) commands from the phone and passes them to the pump over a 916 MHz radio link [1]. A 2020 review put it bluntly: DIY users chose old, out-of-warranty Medtronic pumps because a security flaw in them could be used to send those commands [4].

Here's what surprised us. Those same pump models are on the product list of a Medtronic cybersecurity recall that began on June 27, 2019 [3]. Medtronic's stated reason was that an unauthorized person could connect wirelessly to a nearby pump to change its settings and control insulin delivery [2]. As of October 2026, the FDA recall database still lists the action as open [2].

Software Security Risks

The open-source apps don't come from an app store. A Loop user builds the app from its public source code and installs it with their own Apple developer account, either on a Mac with Xcode or through a browser-based build [1][9]. That process is often called sideloading. A build signed with a free account stops working after 7 days, and a browser build has to be redone at least every 90 days [9]. None of these DIY builds has regulatory approval, and updates have to be performed by the user [1]. So a fix the community publishes only protects the people who rebuild.

Remote monitoring adds a data risk. Nightscout is the self-hosted website many users run to share CGM and pump data remotely [1]. Its own documentation warns that "in a default setup, anyone with your Nightscout URL can view your site," and tells owners not to use the site's API_SECRET (its admin password) as the password for the Atlas database behind it [10]. The 2020 review made the broader point: because DIY systems export data to the cloud for outside monitoring, that data can be hacked, and the authors called for encrypting it before it leaves the system [4].

Physical Layer Security Risks

The radio link is the one part that software patches can't change. Medtronic's 2019 recall asked users to take cybersecurity precautions, and on January 4, 2023 the company sent customers an updated correction letter [2]. A letter doesn't change how the pumps communicate. Newer pumps move that link to BLE. FDA's 510(k) summary for the Omnipod DASH, cleared June 1, 2018, says its Pods talk to the controller over BLE, where the earlier Omnipod used proprietary RF, and lists harm from non-secure communication among the hazards in its risk analysis [5]. Bluetooth isn't a guarantee, but it does remove the separate bridge: Loop can run DASH Pods without a RileyLink [8].

The older Omnipod Eros Pods did need one, over a 433 MHz link [1]. Insulet discontinued that system, which it now calls the Omnipod Insulin Management System, in the United States on December 31, 2023 [6]. As of October 2026, Insulet still sells the Omnipod DASH system as a current product [7].

Mitigation Strategies

The consensus statement's recommendations are specific. It asks manufacturers to give users a way to send remote commands securely to modern, in-warranty pumps, and it advises using medical devices that are within warranty where possible, after warning about the risks of second-hand pumps [1]. A regulated route now exists for the algorithm itself. Tidepool built an interoperable controller that uses the Loop algorithm on an iPhone [1], and the FDA cleared Tidepool Loop on January 23, 2023; that review covered Tidepool's procedures for software, cybersecurity and device interoperability [11]. For anyone running Nightscout, the project documents how to switch off public viewing and grant access through tokens instead [10]. Whether to use an open-source system at all, and with which pump, is a decision to make with your care team.

Conclusion

The pattern across these sources is that the community can update its code, while the radio inside an older pump stays as it was built. The 2019 recall covers the Medtronic models that RileyLink setups rely on, and it was still open in October 2026 [2][3]. What we couldn't find was a primary source counting real-world attacks on people who loop, so the size of the risk in daily use is still unknown.

References