Security researcher Olivier Laflamme has disclosed two independent vulnerabilities in the humanoid robot Unitree G1 EDU. One attack chain can be triggered solely from Bluetooth range and ends with complete root access to the robot’s control computer. Unitree responded with a cloud-side patch and a bounty for the discovery, while a fully updated firmware for all devices is still pending.
Five individual flaws chain into root access over Bluetooth
The more severe vulnerability, cataloged as CVE-2026-76640, begins at a Bluetooth Low Energy (BLE) interface that accepts write access without prior device pairing. As Laflamme describes in his technical analysis, the robot reveals its AES-128 encryption key through a bootstrap command – embedded in a data packet that can only be decrypted via Unitree’s cloud service. That is where the second flaw sits: the cloud endpoint never checks whether the requesting account actually owns the affected robot. Any free Unitree account can therefore request the key for a stranger’s device, whose serial number can be read via simple Bluetooth scanning nearby. With the decrypted key, an attacker gains access to a Wi-Fi configuration function on the robot. An input field for the network name processes more data than the program expects – a buffer overflow that overwrites function pointers in the control program and executes arbitrary code with full system rights. At the end of the chain sits root access to the so-called Locomotion PC, the robot’s central control unit for movement and sensors. With those rights, all services on the device can be read out, including stored access keys for connected cloud voice services.
A second flaw reaches the target through the chat service
The second vulnerability, CVE-2026-76639, exploits the robot’s AI-powered chat service, called chat_go. Its knowledge-base function is meant to make the robot’s own documentation searchable and answer user questions – that very convenience feature opens a path to the system level via path traversal. The flaw lets files be written outside the intended folder – for instance into a directory that the system tool bashrunner treats as trusted. According to Laflamme’s research, that tool’s check on which files may run only applies at import time and can be bypassed with an innocuous-looking file extension. Once the bashrunner service restarts, the robot automatically executes the injected script – again with root rights. This chain needs no physical proximity, only network access to the robot or its control app – an attack path that could open, for example, through a compromised Wi-Fi network in the same lab. Together, both chains show how heavily a modern robot operating system depends on multiple interlocking components across cloud, app, and firmware. Unitree, according to Laflamme, was already aware internally of some of the issues before the report came in.
Manufacturer patches the cloud flaw, questions remain open
Laflamme reported the findings directly to Unitree’s security team in the summer of 2026, which by his account responded cooperatively and paid a $5,000 bounty on August 6, 2026 – $4,000 for the Bluetooth chain, $1,000 for the chat-service flaw. The manufacturer closed the cloud authorization check within days, so the key retrieval via a stranger’s account can no longer be abused. A publicly confirmed, fully patched firmware for all affected devices does not exist yet, as The Hacker News reports – Unitree did not initially respond to a request from the publication. That also leaves open the worm-like spread risk Laflamme describes: a once-compromised robot could, in theory, infect further G1 units within Bluetooth range without any human involvement – unverified independently, since no case has been documented in the wild so far. The G1 EDU line costs between $43,900 and $73,900 depending on configuration and targets university labs and research teams; individual units have also seen trial use at US agencies. Security concerns about Chinese robot makers are not an isolated case: the US regulator FCC banned humanoid robots from China earlier this summer over supply-chain risks, though that action targeted government procurement rather than a specific software flaw. Unitree’s own stock market debut in Shanghai went far more smoothly: Unitree’s stock jumped to a $50 billion valuation on its debut.
What matters next is whether Unitree also patches the firmware itself, not just the cloud connection – the buffer overflow in the Wi-Fi module still sits on the device as soon as someone obtains the key. The more institutions deploy humanoid robots with cameras, microphones, and freedom of movement in the room, the more their software security, alongside the mechanics, moves into the focus of security research.
