WiFi Motion Turns Millions of Home Routers Into Motion Sensors

Your router now reports when someone walks through your house. You installed no sensor. There is none. A phone indoors gave up a person’s breathing to a receiver three meters outside the wall.

The radio waves coming out of your router do not stop at the wall. They go through it, bounce off the floor, the cupboard and the person walking to the kitchen, and arrive at your phone along dozens of paths at slightly different times. Something in the room moves, those paths change, and the receiving device measures that change constantly, because it needs to know which speed and which antenna to use.

That measurement has a name in the specification: Channel State Information, or CSI. Your laptop and your phone already calculate it thousands of times per second, on hardware you already own. It exists to keep the connection fast. It also describes the room it travels through.

On 18 August 2026, Comcast started handing that description out for free.

The company folded a feature called WiFi Motion into a package named Xfinity Shield, on XB7 gateways and newer. It watches the signal between the gateway and the devices connected to it, and tells you through the app when something moved in the house. The house needs no camera for this and nothing extra on the wall.

WiFi Motion itself is not new, it has been running since at least 2025. What changed is that it now sits inside a security product on millions of routers. The same signal has been giving up other things for more than ten years.

In 2015, a system called WiKey read typing straight off a WiFi signal. It spotted a keystroke 97.5 percent of the time and identified single keys with 96.4 percent accuracy. On a continuously typed sentence it came back with 93.5 percent, and whole words inside a sentence above 85 percent. The machine being typed on was clean. Nothing was installed on it, and the reading came from the WiFi alone.

A year later came WindTalker, with a title that says it plainly: inferring your mobile phone password via WiFi signals. The attacker runs an access point, the victim connects to it like any other public network, and the fingers moving across the screen distort the signal in a way the attacker reads back. It was tested against Alipay, the largest mobile payment platform there is.

Breathing turned out to be readable too, with an ordinary Intel 5300 wireless card, the kind that sat in laptops for years. Median error is about 0.25 breaths per minute, with 90 percent of measurements landing under half a breath off. That is a wireless card counting a chest rising and falling.

In December 2022 came DensePose From WiFi. The phase and amplitude of a WiFi signal went into a neural network, and out came the body pose of several people at once. The paper lists the advantage over cameras: WiFi ignores furniture in the way, and it ignores darkness.

Much of the coverage gets this next part wrong. MIT measured breathing and heart rate at 99 percent median accuracy, at eight meters, and through a wall into another room. Their EQ-Radio reads emotional state off the reflections from a body. Both run on radio hardware the lab built itself. That is not your router. Breathing with ordinary WiFi is documented and reproducible. Heart rate and mood are not, not on the box in your hallway.

In 2022, Ali Abedi and his group at the University of Waterloo presented Wi-Peep. An off-the-shelf drone plus 20 dollars of hardware. It flies past a building and locates the WiFi devices inside to about a meter. It works on a network with a password on it, because it never needs to join that network.

The reason is a behaviour Abedi named polite WiFi. Devices answer contact attempts from any device in range, automatically, before any authentication happens. Ask, and they answer. Time how long each answer takes, from a few positions, and you have their location. Abedi’s own examples: follow the guards inside a bank by tracking their phones, or stand outside a house and map where the cameras, the laptops and the televisions are before picking a target.

The same behaviour reaches further than location. A 2021 master’s thesis at the same university built it into a working attack called Wi-Sneak. The shopping list is a laptop, a USB WiFi card and an ESP32 module, under a hundred dollars together. It forges a beacon frame so the target phone never falls asleep, floods it with fake packets, and reads the breathing rate out of the acknowledgments coming back. Tested from the back garden, three meters from the outside wall, against an unmodified OnePlus 8T inside. Accuracy came out above 99 percent at 12, 15, 20 and 30 breaths per minute, and out of 2,400 measurements, 78 percent were exactly right.

Breathing is readable, and reading it needs no access to the network at all.

The attack has a limit, and it sits close to the body. Under 60 centimetres the accuracy holds above 99 percent, at 1.4 meters it drops to 80 percent, and beyond that it stops working. Your phone on the arm of the sofa is well inside that range.

In a separate paper, Abedi and his colleagues went looking for how widespread the behaviour is. They tested more than 5,000 devices from 186 vendors. All of them sent an acknowledgment back to fake packets from an unauthorised device outside their network. They also found that fake beacon frames override a WiFi radio’s power-saving mode and keep it awake, and they ran their attacks on a module costing under ten dollars.

Their conclusion about fixing it fits in a single sentence: they believe these loopholes cannot be prevented.

There is no patch coming for any of this.

There is a third way in, and it needs neither CSI hardware nor the polite WiFi loophole. Since Wi-Fi 5, your phone measures how the signal travelled through the room and reports that back to the router so it can aim better. That report goes out unencrypted. A receiver in range reads it as easily as your router does.

Researchers at the Karlsruhe Institute of Technology built an attack on top of it called BFId and presented it at ACM CCS in Taipei in October 2025. Across 197 participants they identified individual people walking through a room with almost 100 percent accuracy. The people being identified did not have to be carrying anything. The attacker needs no special hardware and no access to the network. Their own recommendation is that privacy protection gets written into 802.11bf.

And this is no longer a lab trick or a vendor feature. On 26 September 2025, the IEEE published 802.11bf-2025, formally titled Amendment 4: Enhancements for Wireless LAN Sensing. It defines how devices announce what they can sense, agree on a measurement and hand the results back. It covers the licence-exempt bands between 1 GHz and 7.125 GHz, and above 45 GHz.

Sensing is not bolted onto WiFi any more. It sits in the standard, with its own negotiation and its own feedback path.

NIST described the amendment while it was still a draft, back in May 2023, and listed what the working group had in mind: user presence detection, environment monitoring in smart buildings, and remote wellness monitoring. That last one was in the goal from the start.

WiFi Motion at Comcast is supplied by Cognitive Systems, a company from Waterloo, Canada that has sold WiFi sensing to broadband providers since 2014. Their technology runs at more than 100 service providers and was already on 2.5 million devices in 2022. Their software is baked into the broadband chips MaxLinear sells.

Comcast is not the only one. Rogers in Canada runs WiFi Motion on the same platform, on their Gen 3 and Gen 4 gateways, switched off by default, with seven days of movement history you can scroll back through. Rogers states plainly on its own support page that this is not a home security service and is not professionally monitored.

So this is not an American story about one cable company. This is a layer inside a chip, and the chip is what providers buy.

Outside North America I could not name a provider selling this today. What the sources support is the layer in the chip, not a list of names. My own guess, and I want that read as a guess and nothing more, is that somewhere in Europe this already runs under a different product name. I would rather say that out loud than write it as a fact I cannot back.

What the industry wants next is written down in their own patents. One Cognitive Systems patent lists what the technique is meant to cover: fall detection, respiration rate, sleep pattern detection, apnea estimation, gait classification, sign language recognition, heart rate estimation and room occupancy.

A patent claims what a company wants to own, not what works today. Heart rate off a gateway has not been demonstrated. But it does tell you where the money is pointed.

One sentence sits buried in Comcast’s terms:

“Subject to applicable law, Comcast may disclose information generated by your WiFi Motion to third parties without further notice to you in connection with any law enforcement investigation or proceeding, any dispute to which Comcast is a party, or pursuant to a court order or subpoena”

Three situations, and in none of them do you get told. A law enforcement investigation. A court order or subpoena. And in the middle, quietly, any dispute to which Comcast is a party. Not the police. Your provider, in a disagreement with you, holding a record of when there was movement in your house and when there was none.

WiFi Motion is opt-in, you switch it on yourself in the Xfinity app. That clause has been in the terms since 2025, not since the relaunch. Neither of those changes what the record contains.

The measurement is open to you too, on cheap hardware:

• → ESP32-CSI-Tool pulls CSI straight off an ESP32, in active or passive mode
• → nexmon_csi does the same on a Raspberry Pi

Sit one of those in a room, walk past it, and watch the numbers move. That is the principle, working, on a board that costs less than a pizza.

What you can do:

• → Check whether your own provider offers motion sensing, and whether the setting is on. This is not limited to one country or one brand
• → Switching it off in an app stops the service. The chip can still measure
• → Treat the timeline a motion feature builds as data about your household, because that is what it is
• → Measuring your rooms does not need access to your network. Wi-Peep never joined one
• → WPA3 protects what you send. It does not hide that you moved

In February 2026, Türk Telekom demonstrated combined cellular and WiFi sensing on a preliminary 6G architecture. Vodafone is testing the same idea, turning the mobile network and the phones on it into something that measures the space around them. The router is where this started, not where it stops.

None of this is a bug. CSI exists because WiFi needs it. Sensing was standardised because vendors asked for it. The measurement that tells your laptop which antenna to use is the same measurement that tells someone else that a person crossed the hallway at 03:12.

Want to see what your own adapter is already pulling out of the air? My ethical hacking course takes you from managed mode into monitor mode with a USB adapter, so you can read the frames around you yourself, step by step.

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

IEEE 802.11bf-2025 | Comcast WiFi Motion | WiFi Physical Layer Stays Awake and Responds When it Should Not