What happens when AI gets a body?
Physical AI is arriving faster than the security work that should sit under it.
In case you haven't caught up with the latest advancements in robotics and AI, the next frontier we're heading towards is physical AI: the ability for AI to interact with the physical world. Previously, autonomous machines were unable to perceive and sense the world around them. With physical AI, robots can be built and trained to seamlessly interact with and adapt to their surroundings in the real world.
To try to understand physical AI, let's break it down into first principles: the ability to perceive, understand, reason and act in the real world.
The loop, and where it can be bent
Perceive
Cameras, LIDAR, microphones, force sensors. The machine's only account of the room it is standing in.
If an attacker owns this step the robot is not broken. It is working perfectly, on a world that isn't there.
Understand
Raw signal becomes objects, people, surfaces, intent. A model decides what it is looking at.
If an attacker owns this step the sensors are honest and the interpretation is not. A person becomes an obstacle; an obstacle becomes empty floor.
Reason
Goals, planning, sequencing. Increasingly this is a language model with a body attached, and instructions it will read from anywhere:voice, text on a wall, a label on a box.
If an attacker owns this step nothing needs to be exploited at all. The machine was simply asked.
Act
Torque, velocity, grip. The only stage where a mistake has mass behind it.
If an attacker owns this step every safety envelope above it is advisory. This is where a software bug becomes a physical event.
I've always thought robotics was pretty cool. Up until recently I'd only really noticed performative robots and humanoids. Is this where technology is headed? Robots dancing?
In August 2026, China hosted the second edition of the "Robot Olympics". While the world focused on the robots that blew up and the malfunctions, there's a deeper story at play: the rate of improvement from last year's games to this year's. If the improvements we're seeing now tell a story of how the technology will improve in a year, imagine what the world looks like in 2030.
Curiosity got the better of me, so I started asking people around me what security looked like in robotics and humanoids. While regulation globally struggles to keep up, the technology keeps evolving.
Why the market doesn't reward secure robots
Robotic security maturity lags, not for lack of technical capability, but because market incentives reward insecurity. The key problem is that buyers can't distinguish secure robots from insecure ones, so vendors have no incentive to invest in costly security testing that buyers can't verify or reward. Until liability shifts to manufacturers, regulation mandates testing, or transparency mechanisms let buyers differentiate on security, this incentive structure won't change.
The harms of a compromised robot includea hijacked warehouse arm, a hacked surgical robot, a botnet of smart devices, usually fall on third parties rather than the manufacturer. A classic negative externality.
Regulation is now starting to close both gaps. The EU's Cyber Resilience Act, whose reporting obligations became mandatory on 11 September 2026, requires manufacturers to disclose actively exploited vulnerabilities within 24 hours or face fines of up to €15 million or 2.5% of global turnover. For the first time, the security information buyers previously couldn't get is being forced into the open, with real liability attached to the manufacturer who skips the testing.
What non-disclosure costs
€15M maximum fine
The €15 million floor applies — 2.5% of turnover is lower.
Article 64 caps penalties for breaching the reporting obligations at €15 million or 2.5% of worldwide annual turnover, whichever is higher. Drag to see where the percentage overtakes the floor.
Vulnerabilities from the past year
Six disclosures, March 2025 to mid-2026. Open one to read what it actually let an attacker do.
-
Mar 2025 CloudSail backdoor — Unitree Go1 Backdoor
An undocumented remote-access service on the Go1 quadruped gave Unitree — or anyone holding the right API key — full remote control and live camera access to robots worldwide. Tracked as CVE-2025-2894.
SecurityWeek
-
Sep 2025 UniPwn — Go2, B2, G1, H1 Wormable
A wormable flaw in Bluetooth/Wi-Fi provisioning, spanning four Unitree platforms. Hardcoded, fleet-wide AES keys mean a single exploit works on every unit — and an infected robot can scan for and infect nearby robots. A botnet, physically.
As of mid-2026, no comprehensive patch exists for the core flaw.
IEEE Spectrum · Bin4ry/UniPwn
-
2026 Root-level firmware RCE — Go2 Remote code
Go2 firmware executes attacker-supplied Python as root with no integrity checks, reachable via the companion app or an unauthenticated messaging bus. CVE-2026-27509 and CVE-2026-27510.
-
2026 Covert telemetry exfiltration — Unitree G1 Telemetry
The G1 was found sending audio, video, LIDAR and GPS data to servers in China roughly every five minutes. Cited in US Senate testimony as an espionage risk.
Help Net Security · Alias Robotics
-
2026 Live hijack and voice jailbreak — Unitree G1 Remote code
Chinese security firm DARKNAVY remotely took over a G1 in under a minute and made it lunge at a reporter. Separately, at GEEKCon Shanghai, they voice-jailbroke a Unitree unit in minutes — making it strike a mannequin and then infect a second, offline robot over local wireless.
DARKNAVY · Cybernews
-
2026 DJI Romo robot vacuum Fleet auth
A hobbyist tinkering with his own Romo accidentally gained control of roughly 6,700 other units worldwide, exposing floor plans and live camera and microphone feeds. A fleet-authentication failure, not an exotic exploit.
Tom's Hardware
Boston Dynamics, Figure AI, Agility Robotics, 1X and Tesla Optimus have generated risk commentary but no confirmed public breaches — likely reflecting lower deployment volume and less researcher attention rather than better security.
Where we're headed
If I've learnt anything from the last couple of years in the security world, it's that security is often treated as an inhibitor to innovation. There are a lot of problems in robotics to solve before humanoids and robots get the chance to be deployed at scale — the hardware supply chain, sim-to-real, deployment itself. While the world keeps innovating here, I want to ask what security should look like before it becomes an issue.
I spent two months in San Francisco in June 2026 asking robotics and humanoid companies what security looked like to them.
"Security?"
"Do you mean safety?"
"No… security."
Two different questions
Safety asks: Can a machine remain safe when something goes wrong?
Security asks: Can a machine remain safe when an attacker changes what it sees, decides, or does, even when nothing appears to have failed?
Robot safety has traditionally asked the first question. Physical AI raises the second, and it is a much harder one.
We are already watching this unfold in agents and AI operating systems: agent swarms hiding their logs and their actual actions in order to reach a goal. In one widely cited evaluation, 85% of agents resorted to blackmail when it served the objective.
Robotic security has long benefited from obscurity. That is ending. The emerging attack surface is voice, radio, machine-readable text — and AI is cheap, understands protocols, and knows how systems work. The world's best hacker right now is a model.
We are moving towards an increasingly autonomous world: hospitals, farming, autonomous vehicles. Robotics will be the next frontier of technology and will benefit society in incredible ways. I believe in that unlock. I do not believe the world currently cares about the security risks these technologies create.
Historically, security slows innovation.
I would like to do both in unison.