Tenants Are Hacking the Building
Multifamily residents are using consumer AI and open tools to work around building systems and regain control of how their apartments operate
Multifamily residents are using consumer AI and open tools to work around building systems and regain control of how their apartments operate
Today's Thesis Driven letter is guest written by Phil Kirschner, founder of PK Consulting and the author of The Workline, a newsletter for executives navigating sustainable change.
I live in a New York City apartment building. It pains my children that they can't ask Google to see whether the ping-pong table in our basement is currently free. My building has a tenant platform that handles package notifications and little else. The superintendent logs maintenance calls somewhere no resident can see. Several WhatsApp groups have formed to share what the official system doesn't: maintenance alerts, amenity availability, package thefts. These are the workarounds residents build when buildings are designed for operators and not for the people living in them.
The reason is structural. Every major property management platform restricts API access to certified vendor partners. Residents have no official programmatic connection to the systems running the building they live in. A recent TikTok showing apartment residents how to override a thermostat sealed in a lockbox drew 32 million views. Apparently a lot of people have a locked thermostat.

Something better is coming, and it is not coming from the building.
The tools are already in place: consumer AI platforms like Claude and ChatGPT combined with open-source platforms like HomeAssistant connect to building systems like SmartRent through community-built integrations. ButterflyMX has built a tenant-facing webhook. Large-scale adoption of tenant-side AI agents is still emerging, but the tools, the frustration, and the behavioral precedent are established.
A March 2026 McKinsey report on agentic AI in real estate framed the entire AI opportunity from the operator's side. So did the recent Thesis Driven survey on PMS openness. The tenant appears in both as a recipient: notified and managed. Nobody asked what happens when tenants start managing back.
Operators who design for this will shape what gets built on their systems. Those who don't will inherit whatever tenants construct on their own. Either way, the tenant experience in multifamily is about to look very different.
In this letter, we cover:

The behavioral precedent for tenant-side AI already exists, and it comes from the corporate office. A technology company real estate leader told me employees were using a tool to automatically claim favored desks at 12:01 a.m., the moment booking windows opened. They were also covertly reserving EV parking spots and fresh food in vending machines, officially first-come, first-served.
Teams and individuals have always tried to make their days in the office a little more predictable and a little more comfortable. Physical personalization is commonplace and typically harmless. Augmenting or subverting digital systems was a different matter: it historically required deep technical experience and significant time investment.
The barrier today is considerably lower. AI-powered coding assistants let even non-technical employees translate a clear problem description into a working connection with the digital environments that govern their physical ones. Corporate real estate teams can respond by tightening API controls or framing it as a cybersecurity risk, and for employers that response has real teeth: the corporate lease puts the employer between the individual and the building, and employers have real authority to set the rules.

But as office buildings introduce more shared amenities, employees who are already hacking their way to a better day on their company's floors will naturally point their energy past the edge of their tenancy. And once they go home for the day, there is no employer standing between them and the building's systems.
Home has become the most technology-saturated environment in most people's daily lives, and the smart home has moved from a hobbyist niche to a major consumer electronics category. More than half of American households actively use smart devices today, a share on track to reach nearly 70 percent by next year. The U.S. smart home market is valued at nearly $30 billion and forecasts predict it will triple by 2032.
Residents talk to their TVs, watch package deliveries from miles away, and run temperature and lighting schedules calibrated to their exact routines. Yet despite the efforts of major aggregator platforms like Apple's HomeKit, Google Home, Amazon Alexa, and Samsung SmartThings, most smart homes remain a collection of disconnected islands. Clever cross-platform automations were a pipe dream for all but the technically sophisticated.
Then came HomeAssistant, an open-source platform with an active developer community, extensive DIY documentation, and a comprehensive set of integrations. HomeAssistant is governed by the Open Home Foundation, a nonprofit that manages more than 250 open-source smart home projects on a shared premise: home data belongs to the resident, cloud access is optional, and local control is the default.

Anyone with Claude Code or a similar AI coding tool can now build applications and automations in plain English. In a single-family home, at least.
Multifamily buildings are getting smarter too. New Class A apartment buildings routinely include smart locks, connected thermostats, EV charging, package lockers, and managed WiFi, all tied into a property management platform. But the intelligence in these systems runs in one direction. Every major PMS platform, including Yardi, RealPage, AppFolio, Entrata, Buildium, and ResMan, has an API, but limits access to certified vendor partners. Residents are not on that list.
SmartRent, a multifamily home automation platform, advertises an API-first approach to integration with property management systems, accounting software, and CRM platforms. It does not offer a resident-facing API. An open-source GitHub repository connects HomeAssistant to SmartRent anyway.
The employee who figured out how to claim the office vending machine before colleagues could is living in one of these buildings.
Consider what a tenant with modest technical curiosity could build today. Using HomeAssistant and a large language model running on a Mac Mini, a parent could set up an automation through their Google Home device: when the weekend forecast calls for rain, check the building's amenity calendar, book the playroom and the golf simulator, add it to the family calendar, and notify the parent group.
No app required and no phone call, whether the building officially supports it or not.
Tenant-side AI will not arrive all at once. It will emerge through specific use cases, building on the tools already in consumer hands and the frustrations already driving workarounds.
Here are four scenarios likely to play out over the next three to five years, none of which requires new technology or a system bypass.
Tenants get two keys.T he first is the physical key they already have. The second is an API key: explicit, permissioned digital access to the building systems they live inside, handed to them at move-in the way a physical key always has been. ButterflyMX, which operates across more than 20,000 buildings serving 1.5 million apartments, has already built toward this. Its developer platform includes a tenant-facing webhook that gives residents a programmatic connection to their building.
Aaron Rudenstine, ButterflyMX's CEO, told me: "Giving residents access to API platforms opens up a world of possibilities where the people living in the buildings become the ones solving the challenges they face every day. Prior to AI, residents lacked the 'digital key' needed to build a solution. But now, anyone can be a developer, regardless of coding experience."
The technology is there. The policy question is who controls it.
Lease negotiation with building data. This scenario is a few years out, but the pieces are in motion. As programmatic building system access becomes more common, a resident's AI agent could pull service request history, identify patterns in maintenance response times, calculate what building-provided WiFi actually costs against market alternatives, or draft a renewal letter timed to the building's highest vacancy period. A tenant walking into a lease renewal with that data is negotiating from a fundamentally different position than one who isn't. The data asymmetry advantage operators hold today will erode as the tools for accessing it become widely available.
There is no current requirement for tenant data portability, but precedents exist in banking, health, and energy. Latch and SmartRent have both faced lawsuits related to monitoring of tenant patterns. Regulatory pressure in this direction would not be without precedent. For tenants, that precedent matters: the same frameworks that gave bank customers access to their own financial data could eventually give residents access to their own building data.
Coordinated resident advocacy. WhatsApp groups exist in buildings across the country because formal feedback mechanisms leave residents without adequate channels. An AI layer on top of those conversations could aggregate complaints across units, identify patterns over time, and generate coordinated communications to building management or, where relevant, to housing authorities. The organizing infrastructure already exists in every building where residents have gone around the official channel. The AI layer would give them better tools for something they are already doing by hand.
Personal environment negotiation. Ecobee recently expanded its SmartBuildings API. A dual-control thermostat model, where tenants hold preferences within operator-set parameters, is already being implemented in new multifamily construction. A tenant agent that knows sleep schedules, remote work days, and temperature preferences could continuously negotiate within operator-set bounds, without a system bypass. The logical endpoint is tenants writing environmental preferences directly into their lease.
Across all four scenarios, the friction is at the policy level, not the technical one. The parameters already exist.
For operators, blocking tenant-side AI is not a realistic option. It would mean restricting the same open APIs operators rely on for their own integrations, and somehow prohibiting the consumer devices residents have already brought into their homes. The more productive question is how to design for it: what gets built, under what terms, and by whom.
Three questions are worth working through now.
• What is the current exposure?
The first step is understanding what is already accessible. Tenant-relevant data flows through the current PMS, smart lock system, and building access platform in ways most operators have never fully mapped. That means looking beyond what the API technically permits to what a sufficiently motivated developer could reach through authentication workarounds. Tools like Skywalk API were built because a developer decided to find out before an operator did. Running that audit proactively means shaping what is discoverable and what gets built on top of it. The alternative is learning about it after the fact.
• How was the tenant experience designed?
The thermostat sealed in a lockbox became a symbol because it was legible: a building experience designed entirely on the operator's terms, with no accounting for the person living there. The question operators should be asking is whether the tenant-facing experience was designed at all, or simply installed and left as is. Residents who encounter that absence tend to build around it in ways operators learn about later, and carry those preferences to their next building.
• What is the platform strategy for tenants?
The components of an open tenant-facing stack already exist in most buildings. The decision for operators is where they sit in that stack, and on what terms. Operators who move first on permissioned tenant access, even modestly, get an early signal on how residents actually want to interact with the building, before someone else answers that question for them.
Buildings now generate more tenant-relevant data than ever. The tools for acting on that data, officially or otherwise, are consumer-grade and improving rapidly. The behavioral precedent is established.
Residents who have a well-designed, permissioned way to interact with their building have less reason to route around it. That is already visible in buildings where operators have made that choice.
The second key is already cut. The question is who hands it over.
Covering the future of real estate and the people creating it