AI-powered camera hacks: tinkerers unlock features manufacturers lock away

What's going on

A modern digital camera is basically a small computer with an image sensor bolted on. What it can do often depends less on the hardware than on the firmware, the device's built-in operating software. Manufacturers use this to deliberately save certain features for pricier models. A growing scene of tinkerers is now breaking those locks, and more and more of them are getting help from AI assistants like Claude. The German photo magazine DOCMA has reported on the trend, and the filmmaking site CineD has given it its own article series.

According to CineD, the spark was a video by photographer and YouTuber Tony Northrup titled "I hacked my camera with AI (and so can you)". But the projects themselves had been piling up on GitHub for weeks, covering cameras from Sony, Sigma, Nikon, Canon, Ricoh, Fujifilm and Hasselblad. CineD makes one thing clear right away: all of these projects are unofficial and experimental, and you use them at your own risk.

The moped principle: the limiter lives in software

DOCMA compares the situation to a speed-limited moped. The engine could do more, but the price bracket allows less. In cameras, the limiter lives in the firmware. Sony, for example, keeps shutter angle off the A7 IV. It's a way of expressing exposure time relative to frame rate, and filmmakers love it. The camera could calculate it, but Sony saves it for Cinema Line models like the FX30. Hasselblad keeps video off its medium-format cameras, probably because of heat.

The Hasselblad X2D II 100C, a camera that costs around $7,800, shows how far this can go. According to PetaPixel, it now runs video, Apple CarPlay, ChatGPT and a Linux desktop. Digital Camera World says the video hack comes from a developer called Cheese (奶酪), who describes it as experimental. Getting Doom running on a camera proves that your own code can control the display, touchscreen and shutter button. More useful features come after that. A tool from researcher Radium Wang gave the older X2D and the 907X continuous autofocus (AF-C) with eye detection, which Hasselblad had kept for the X2D II. According to CineD, though, the developers stopped the public release on November 6 and took the toolkit offline. Another add-on gives the X2D II a six-shot, 400-megapixel pixel-shift mode.

The key projects at a glance

Sony: According to CineD, the developer took an A7 IV on firmware 6.02 and changed a single stored setting using Sony's USB service mode and the existing tool Sony-PMCA-RE. After a cold start, the camera showed the shutter angle icon and 180° in movie mode. Nothing gets flashed, and writing back the old value restores the original state. You can't reach the setting from the dial or touch controls yet, though. Other finds count as research rather than finished features. The firmware has its own LUT manager with 16 slots (LUTs are color tables for specific looks), but it stays hidden. There's also a 5016 × 3344 pixel scan mode with no matching encoder profile found so far, and a de-squeeze display for anamorphic lenses that's listed as a "strong candidate, untested". DOCMA also reports that a Reddit user got hold of the decrypted firmware through a vulnerability. His attempt to unlock 8K ended in a boot loop. According to Photografix, the camera works again, but there's still no 8K. For older Sony models, Chris Gampat used Claude to bring back the discontinued PlayMemories apps, Sony Alpha Rumors reports. Sony shut down the service on August 31, 2025.

Sigma: For the Sigma fp, the fpSup project adds five extra CinemaDNG formats on top of UHD and FHD (CinemaDNG is an open raw video format). They include OG3K at 3008 × 2000 pixels and OG4K at 3840 × 2560 pixels. Open gate means the entire sensor area is used. fpSup-Lossless uses a hardware codec in the camera that the stock firmware never uses for video. According to the project, it compresses a 12-bit 3K frame from 9.1 MB to about 3.2 MB. Gyro2 writes motion data for the stabilization software Gyroflow into every frame. Everything loads from the SD card into RAM, so the camera's flash memory stays untouched. It only works with the original fp on firmware 5.02.

Nikon: Nikon's firmware is signed and verified. Even so, the GitHub group Wonder Lantern is building a patcher for the Z30. You supply the original C 1.20 firmware, and it produces a modified version from it. Features include three bitrate profiles with up to 200 instead of 144 Mbit/s in 4K, slow-motion recording up to 25 minutes instead of three, a histogram, a level, zebras, exposures up to 900 seconds and custom shutter sounds. The developers admit that some features have only been tested in a simulated camera, and earlier versions had bugs in playback and framing. Thom Hogan points to reports from China claiming that someone used AI to bring RED's Log3G10 curve to the Z6 III, Z8 and Z9, re-signing the firmware in the process. Hogan himself warns that so far, the only evidence is screenshots.

Canon, Ricoh, Fujifilm, GoPro: Magic Lantern, the best-known camera add-on since 2009, has been back with a new core team since summer 2025. On the R5 and R8, it hasn't gotten much past a hello-world test so far. Film-look projects for old DSLRs are being built on top of it: Soup Engine gives the 2005 EOS 5D 13 film looks, and Film Roll limits the EOS 6D to rolls of 12, 24 or 36 shots. Ricoh's GR series has GRKit, GR Mod and GR4-MonoUnlock, and the GRLife website builds custom firmware with up to 49 film looks while warning that you'll lose your warranty. On the Fujifilm side, Daniel Cook got Doom running on the X-A2 after a year of reverse engineering. GoPro is going the other way and opening up its own cameras with the official Labs beta.

What the AI actually contributes

According to CineD, the Sigma developer, who goes by bei, 夏曉雨 or ijigen, describes how the AI decompiled the firmware, turning machine code back into readable code. Along the way it found a factory shell and a file called AutoRun.txt that the camera runs from the SD card at startup. The project now publishes "AI Skills", instruction files for AI assistants that let others have their own AI control the camera over USB. The same developer warns:

"Please treat all of this as a reference, not as truth. My AI made a lot of mistakes, and some of them may still be in my notes or skills."

The CineD author thinks that sentence sums up the whole movement. AI finds hidden settings in firmware files much faster. But it won't check whether a clip has a broken frame at minute 14, or whether a change survives the next cold start. That's why the serious projects split their tables into "confirmed on camera" and "found in code".

DOCMA sees it the same way. According to Digital Camera World, many of the Canon film-look projects are made through vibe coding, meaning you program by telling the AI what you want. But the hardest part, getting outside code onto a camera at all, was done by humans. As DOCMA puts it: the AI furnishes the apartment that humans broke into first. Tony Northrup used Claude to teach his Ricoh GR IV to show distances in feet and inches, and he claims AI makes firmware tinkering possible without any coding skills. According to DOCMA, though, the evidence from cameras so far barely goes beyond film looks and displays like that.

Risks for cameras and for proof of authenticity

How risky this is depends on how deep the change goes. Apps like Recipe Lab only use existing settings and can be undone. Modified firmware, on the other hand, can cost you your warranty and your camera. DOCMA's advice: only try outside code on a device you can live without, and back up the original software first. It's no coincidence that many film-look projects run on cameras up to 20 years old.

A second problem involves C2PA, a content credentials standard in which the camera digitally signs every image the moment it's taken. Nikon introduced it for the Z6 III in August 2025 and suspended the service again in early September. A user named Horshack had shown that the camera's multiple-exposure mode could be used to sign a photo from a different camera. Later he even got an AI image made with Gemini authenticated this way, and Nikon declared all certificates invalid. The bug was in the stock firmware. If anyone can modify the firmware, DOCMA argues, a signature is only worth as much as the protection on its keys.

The bigger picture

Camera hacks aren't new. Magic Lantern brought RAW video to Canon DSLRs, and the Panasonic GH2 hack pushed the bitrate far beyond the factory setting. But those took small groups of specialists who could read assembly code. AI assistants noticeably lower that barrier. DOCMA sees the tinkerers as an early-warning system and a free product spec for manufacturers, because they show what customers want. The smartest response, it says, is GoPro's: open the door yourself, the way Linksys deliberately sold the WRT54GL router for third-party firmware back in 2005. How solid many of the findings are is still an open question. A lot has only been tested on a single camera, and some of it has only been simulated or is backed up by nothing more than screenshots.