Mobile security researcher Robert Baptiste discovered that OnePlus smartphones had been apparently shipping for years with a hidden backdoor. Anyone with physical access could root a OnePlus phone with just a few lines of code.

Baptiste found an application called “Engineer Mode” on OnePlus devices intended for factory testing and discovered it could be used to obtain “root access” to the phone.

Engineer Mode was hidden behind a password, but Baptiste along with researchers at app security firm NowSecure was able to crack it quickly. The password is “angela” – a Mr Robot reference.

Baptiste believes that the vulnerability can only be exploited with physical access, at least for now. He said in a tweet that it’s “too early to speak about a random app getting root access, but we are on the good tracks”.

It looks like the application was left on some devices, but it’s not clear whether OnePlus did so intentionally, or whether it was an accident. Engineer Mode is on several different smartphones that OnePlus makes, including the OnePlus 3, OnePlus 3T, and the OnePlus 5, according to the blog Android Police.

Baptiste thought Engineer Mode was left on OnePlus devices with the company’s knowledge. “This app is a Qualcomm app customised by OnePlus. This backdoor had been coded by Qualcomm.” The backdoor may not have been left maliciously. However, Baptiste explained. It could have been due to “laziness”.

But OnePlus has form for collecting sensitive information from its users and transmitting it to a server along with each device’s serial number. Since a scandal outed the procedure, the outfit scaled back its snooping.