Unitree Robotics' G1 Vulnerability Exposed by UniBLEed Exploit Chain

Independent security researcher Olivier Laflamme has disclosed a significant vulnerability in Unitree Robotics' G1 EDU humanoid robot, known as UniBLEed. This exploit chain allows an unauthenticated attacker within Bluetooth range to gain full root access to the robot's primary real-time controller, tracked under CVE-2026-76639 and CVE-2026-76640. The implications of this vulnerability are severe, as it enables potential control over the robot's functions, including live feeds from cameras and motors, without any prior pairing or credentials.

The importance of this discovery lies in the physical risks associated with compromised robotics. Unlike conventional smart devices, the G1's vulnerabilities can lead to dangerous scenarios, especially in environments where multiple robots operate in proximity. The exploit's design, which leverages structural oversights in Bluetooth communication and local Linux management, raises concerns about the security of humanoid robots in research labs and factories, where they may be deployed in high-density settings.

Looking ahead, the wormability of the exploit poses a significant threat, as a compromised G1 could potentially infect other nearby Unitree robots. While Laflamme's tests were limited to two robots, the risk of lateral spread in operational environments necessitates immediate attention to security measures for humanoid robots. No further timeline was disclosed at the time of publication.