Rooting an Echo Plus 2 with AI

The author used OpenAI's Codex coding agent to help root an Amazon Echo Plus 2, starting from a MediaTek BootROM exploit (Kamakiri via MTKClient) to install an app, then chaining the CVE-2019-2215 Binder use-after-free with an epoll/iovec trick to overwrite selinux_enforcing and core_pattern and gain UID 0. Root returned automatically after cold boots, succeeding 50 out of 50 stock reboots, and the device runs Kiosk Satellite with Home Assistant and Music Assistant on the stock audio stack. The author notes the unit's October 2026 kernel still lacks the 2019 Binder fix, and that a software update could close the route.