Hack One Robot, Reach the Next: How Unitree’s G1 Left the Door Open to Root Takeover

Key Takeaways

Hide

• Security researcher Olivier Laflamme disclosed UniBLEed, an exploit chain yielding unauthenticated root execution on the Unitree G1 EDU humanoid robot over Bluetooth.
• The attack bypassed security boundaries by abusing an authorization gap in Unitree’s cloud backend, which decrypted device-specific cryptographic keys for any registered user.
• Root access grants complete control over the robot’s primary Locomotion PC, which governs real-time balance, motor trajectory, depth sensors, and audio-visual feeds.
• The research demonstrated potential wormability, showing that a single compromised humanoid could theoretically spread malicious payloads to neighboring units within wireless range.
• Unitree patched the cloud-side key recovery vulnerability and awarded a $5,000 bug bounty, though the findings highlight broader questions around local firmware hardening across the robotics industry.

When a conventional smart device suffers a software compromise, the worst-case scenario usually involves stolen passwords, private data leaks, or unauthorized background traffic. But when physical artificial intelligence gains legs, arms, and high-torque actuators, ordinary software vulnerabilities suddenly acquire a dangerous physical blast radius.

That reality has been brought into sharp focus by independent security researcher Olivier Laflamme, who published the disclosure of UniBLEed—an exploit chain targeting Unitree Robotics' G1 EDU humanoid robot. Tracked under two vulnerability identifiers, CVE-2026-76639 and CVE-2026-76640, the attack allows an unauthenticated adversary within ordinary Bluetooth range to seize full root privileges over the machine's primary real-time controller.

The findings demonstrate that an attacker standing near an unboxed G1 needs no physical tether, no Wi-Fi credentials, and no prior Bluetooth pairing to take control of the machine—and potentially use it as a stepping stone to compromise neighboring humanoids.

Anatomy of a Proximity Takeover

Rather than relying on esoteric zero-day primitives, the UniBLEed exploit chain strings together several structural oversights spanning Bluetooth communication, cloud infrastructure, and local Linux daemon management.

At a high level, the takeover unfolds across four key stages:

1. Unpaired Bluetooth Query: The G1’s Bluetooth server accepts incoming write requests without requiring device pairing. A nearby device can request an encrypted bootstrap package that contains the robot's unique device encryption key.
2. The Cloud "Decryption Oracle": While that key package is encrypted to Unitree's master public key, the vendor's cloud backend contained an authorization flaw: it would decrypt and return the device key to any authenticated user account, without checking whether that account actually owned the target robot.
3. Network Hijacking: Armed with the recovered encryption key, the attacker can pass Bluetooth security checks and issue setup commands that inject custom configuration data into the robot's Wi-Fi scripts, forcing the G1 onto an attacker-controlled wireless hotspot.
4. Escalation to Root: Once operating on the same local network, vulnerabilities in the robot’s background services—including its conversational AI subsystem and Bluetooth daemon—allow the attacker to bypass memory protections and trigger arbitrary commands with root privileges.

For readers interested in the low-level mechanics—including the reverse-engineering of firmware encryption, the memory corruption bugs in the event loop, and the full exploit proof-of-concept—Laflamme documented the technical walkthrough in a detailed post on his research blog.

Total Hardware Control and the Threat of Lateral Spread

The ultimate destination of the exploit chain is the G1’s Locomotion PC—the internal computer running a real-time Linux kernel that serves as the robot's operational core.

Because virtually all core services on this node run with elevated administrative privileges without sandboxing, gaining root access grants unrestricted control over the entire physical machine. An attacker can access live feeds from onboard cameras and microphones, modify vision models, manipulate joint motors, or disable active safety and collision-avoidance checks on an 80-pound machine capable of rapid physical movement.

Equally concerning is the attack's wormability. Because standard G1 robots out of the box broadcast identical unauthenticated Bluetooth profiles, a compromised humanoid could theoretically scan its immediate surroundings and automatically execute the same takeover against other Unitree robots in range. While Laflamme responsibly limited his experimental propagation tests to two robots in a single room, the possibility of lateral spread presents genuine operational risks for high-density environments like research labs, university campuses, and factory pilot facilities.

Vendor Response and Ongoing Firmware Challenges

Unitree moved relatively quickly to address the most dangerous part of the chain after being alerted to the research. The company validated the reports, paid a combined $5,000 bug bounty, and patched the cloud authorization loophole by enforcing strict account-to-robot ownership verification before returning encryption keys.

In his write-up, Laflamme went out of his way to praise Unitree's security team and responsiveness, noting that vendor collaboration in the robotics space rarely goes this smoothly. "I have deep respect for the Unitree staff & their engineers. They're genuinely one of the strongest robotics companies out there," Laflamme wrote, emphasizing that his findings represent a point-in-time assessment rather than the company's current security posture.

Laflamme also framed the vulnerabilities as symptomatic of a broader industry-wide blind spot rather than a failure unique to Unitree. "Go look at any robotics company or startup (especially in the Valley) & see how many security roles they're hiring for. They're not. Most never have," he noted, urging researchers to report findings through Unitree's security portal and highlighting their rapid triage process.

That cloud-side fix successfully breaks the remote, zero-knowledge attack vector for unauthorized third parties. However, significant architectural questions remain. The underlying local vulnerabilities—such as unauthenticated Bluetooth characteristics, unescaped configuration scripts, and unauthenticated internal data buses—reside within the robot's local firmware. Until comprehensive, hardened over-the-air firmware updates are systematically applied to fleets in the field, local attack surfaces remain accessible.

A Growing Pattern Under Geopolitical Scrutiny

The UniBLEed disclosure arrives at a sensitive moment for Unitree. By leveraging aggressive vertical integration and a sub-$30,000 price point, the company has established itself as the dominant global hardware provider for robotics researchers, recently capping its commercial ascent with a blockbuster public listing on Shanghai’s STAR Market.

Yet this is not the first time Unitree’s software architecture has faced pushback. Independent evaluations previously uncovered critical remote execution flaws and undocumented background data transmissions across its quadruped and humanoid platforms.

These persistent software and security concerns have already provided political fuel in Washington, accelerating protectionist initiatives like the bipartisan GUARD Act and the recent sweeping FCC import bans on foreign robotic devices.

As humanoid robots steadily migrate from stage demonstrations and research benches into shared human workspaces, UniBLEed delivers a clear lesson for the entire robotics sector: mechanical agility and accessible price tags mean little if basic digital security is left behind.