Your Unitree G1 robot is officially a security nightmare—here’s why

Security researcher Olivier Laflamme discovered that Unitree G1 robots are essentially open invitations for anyone with a Bluetooth Low Energy connection and a bit of spare time. The flaws, tracked as CVE-2026-76639 and CVE-2026-76640, allow for unauthorized remote code execution without any pesky pairing or authentication steps required.

The first vulnerability lives in the chat_go tool, letting an attacker mess with file paths to overwrite system files and gain full root access. The second is a classic BLE implementation facepalm: the robot accepts commands from nearby devices without verifying the sender. While an AES-128 key is technically required, it can be easily snagged from the Unitree cloud API if you have the robot's serial number—which, let's face it, is probably printed on the bottom of the foot.

Once inside, an attacker gains total control over the robot's Locomotion PC, meaning they can steer the motors, toggle the cameras, or turn the robot into an expensive, metal-cased microphone. The researcher even demonstrated that one compromised Unitree G1 could potentially act as a carrier, jumping from robot to robot to spread malicious code wirelessly through a neighborhood like a digital flu.

Technology companies seem perpetually committed to prioritizing fancy circus tricks like hauling 1,400kg trucks or trekking through Arctic-level blizzards over basic digital hygiene. It is truly inspiring to see a multi-thousand-dollar piece of hardware capable of surviving -47 degrees Celsius while remaining completely defenseless against someone standing ten feet away with a laptop. Expect the future of robotics to be less "I, Robot" and more "I, am currently being remote-controlled by a teenager in a basement."

Source: Boschko.ca