28 Robot Zero-Day Vulnerabilities Found in Under Two Days

The race to deploy intelligent robots across factories, warehouses, and homes has accelerated dramatically in 2026, with Chinese companies producing over 40,000 humanoid units in the first half of the year alone and global industrial robot production surpassing 794,000 units through September. But as the hardware matures and embodied AI systems gain autonomy, a quieter and more dangerous race is unfolding beneath the surface: the race to secure them.

A Wake-Up Call From the Cybersecurity Frontier

In early November 2026, automotive cybersecurity firm VicOne released findings that sent shockwaves through the robotics industry. Using AI-assisted research tools, the company identified 28 zero-day vulnerabilities across software and platforms supporting the Physical AI ecosystem in less than 48 hours. The affected projects include software developed or maintained by Google, NVIDIA, and Meta, among other major technology companies.

What makes this discovery particularly alarming is not just the count but the speed. Traditional vulnerability research in robotics has been a painstakingly manual process, requiring weeks or months of code review and testing. The fact that an AI-assisted approach could surface nearly thirty previously unknown flaws in under two days demonstrates both the power and the peril of applying AI to security research. If defensive teams can find vulnerabilities this fast, so can adversaries.

Where the Vulnerabilities Live

According to VicOne’s analysis, approximately 75 percent of the 28 findings reside in development, training, simulation, or validation tools rather than in software running directly on deployed robots. This distribution reveals a critical blind spot in the industry’s security posture. Most robotics companies focus their security efforts on the runtime environment, hardening the software that controls the robot during operation. But the supply chain that produces the models, training data, and simulation environments is far less scrutinized.

Training Pipeline Risks

A manipulated pretrained model, for instance, could behave normally during routine testing but respond incorrectly to specific objects, scenes, or commands after deployment. This is not a hypothetical concern. The BadNets research demonstrated as early as 2017 that a neural network could be poisoned to misclassify a stop sign as a speed limit sign without affecting its performance on other inputs. At NeurIPS 2025, researchers introduced BadVLA, a backdoor attack targeting Vision-Language-Action models that power modern humanoid robots. The attack caused conditional deviations in robot action trajectories when a trigger was present, while preserving normal task performance otherwise.

Simulation Compromise

A compromised simulation environment poses an equally insidious threat. If an attacker can manipulate the virtual scenes used to validate robot behavior, a robot could appear to pass safety tests that should have exposed dangerous actions. The robot performs flawlessly in simulation, receives certification, and only fails catastrophically when deployed in the real world where the manipulated conditions no longer hold.

Runtime Exploitation

At runtime, the remaining vulnerabilities could alter robot movement or leave operators unable to see what is happening. In one concrete demonstration, VicOne researchers exploited a vulnerability to prevent a robot’s remote-stop command from working. This is the robotics equivalent of cutting the brake line on a vehicle. When a robot behaves erratically or enters a dangerous state, the remote-stop function is the last line of defense. Disabling it transforms a controllable malfunction into a potential catastrophe.

The Broader Threat Landscape

The VicOne findings are not isolated incidents. They reflect a growing body of research exposing the security weaknesses of embodied AI systems. A comprehensive review published in 2026 cataloged multiple attack vectors unique to robotics, including:

• Semantic integrity attacks that exploit the gap between language understanding and physical action, causing robots to misinterpret instructions like “move quickly” or “clear the area” in ways that produce unsafe motions
• Cross-modal injection where attackers embed malicious instructions in visual inputs, using text-to-image models to generate images that subtly encode hostile commands
• Goal hijacking in LLM-integrated navigation systems, where injected text in the physical environment redirects mobile robots into hazardous areas
• Physical environment manipulation where misleading text placed in the real world triggers AI-enabled robots to make dangerous decisions without any traditional hacking

The ROBOPAIR framework, introduced by researchers in 2025, demonstrated the first algorithm explicitly designed to jailbreak LLM-controlled robots. Unlike text-only jailbreaks that produce offensive language, ROBOPAIR generates syntactically correct code and API calls that the robot can physically execute, bridging the gap between harmful intent and physical harm.

Why Robotics Security Differs From Traditional Cybersecurity

Securing robots presents challenges that conventional IT security was never designed to address. A compromised database might leak data, but a compromised humanoid robot can exert physical force, navigate physical spaces, and interact with people in ways that cause direct bodily harm. The consequences of a security failure in embodied AI are not merely digital but physical, and in some cases irreversible.

Several factors complicate the security picture:

• Third-party dependencies: Modern robots rely on pretrained models, open-source simulation frameworks, and cloud-based training pipelines, each representing a potential attack surface that the robot manufacturer does not directly control
• Model opacity: Deep learning models are inherently difficult to audit for backdoors, and a poisoned model may pass all standard evaluation benchmarks while containing hidden triggers
• Real-time constraints: Robots operate under strict latency requirements, limiting the feasibility of runtime security checks that introduce delays
• Physical-world inputs: Unlike web applications that receive structured input through defined interfaces, robots perceive the world through cameras, microphones, and sensors, all of which can be manipulated through the physical environment

The Regulatory Response

Regulators are beginning to take notice. The FCC’s July 2026 move to ban imports of new foreign-made humanoid robots signaled that national security concerns extend to robotics. The commission has since granted limited exemptions to six companies, including Lightberry and OMRON, but the underlying message is clear: governments view unsecured robots as a systemic risk.

In China, the Ministry of Industry and Information Technology has launched real-world training initiatives targeting over 100 high-value application scenarios, with plans to build capacity for deploying tens of thousands of robots by the end of 2026. This scale of deployment amplifies the potential impact of any security vulnerability. A single backdoor in a widely deployed model could affect thousands of units simultaneously.

Building a Defense Framework

Addressing the security challenges of embodied AI requires a fundamentally different approach from traditional cybersecurity. Several strategies are emerging:

Supply Chain Verification

Robotics companies must treat pretrained models, simulation environments, and training datasets with the same scrutiny applied to third-party code. Model provenance tracking, cryptographic signing of training artifacts, and adversarial testing of pretrained models before deployment are essential controls.

Runtime Safety Layers

Independent safety monitors that operate outside the primary AI control loop can detect anomalous behavior and trigger failsafe responses. These monitors must be architecturally isolated from the systems they protect, so that compromising the main AI does not compromise the safety layer.

Simulation Integrity

Validation environments must themselves be validated. Simulation tools like NVIDIA Isaac Sim are increasingly used for safety testing, but if the simulation platform is compromised, the entire testing process becomes untrustworthy. Security extensions for simulation platforms, such as VicOne’s Radeis integration, represent early steps toward simulation integrity verification.

Standardized Vulnerability Disclosure

The robotics industry lacks a mature vulnerability disclosure ecosystem comparable to what exists in traditional software. Of the 28 vulnerabilities identified by VicOne, several do not yet have CVE tracking numbers. Establishing clear channels for reporting, validating, and patching robotics vulnerabilities is critical as the industry scales.

The Path Forward

The discovery of 28 zero-day vulnerabilities in under two days is both a testament to the power of AI-assisted security research and a stark warning about the maturity of robotics security. As humanoid robots transition from laboratory demonstrations to commercial deployment, as production scales to hundreds of thousands of units annually, and as embodied AI systems take on increasingly complex tasks in human environments, the security stakes will only grow.

The industry stands at a crossroads. It can treat security as an afterthought, bolted on after deployment, and risk the kinds of physical-world incidents that would set back the entire field. Or it can embed security into every stage of the robotics lifecycle, from training data curation through simulation, deployment, and runtime monitoring. The VicOne findings make clear that the window for making that choice is narrowing rapidly.

For an industry that has spent years mastering how robots move, the next critical challenge is ensuring they cannot be made to move against us.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous