Olivier Laflamme, a security expert, has published an analysis detailing two attack vectors targeting the humanoid robot Unitree G1. One of these vulnerabilities enabled remote access via Bluetooth.

Unitree, the manufacturing company, has acknowledged these vulnerabilities and issued patches to address them.

Unitree robot lineup. Source: Laflamme's blog.

Laflamme's primary discovery, dubbed UniBLEed, allowed unauthorized Bluetooth connections to the robot without requiring confirmation or a password.

In response to connection requests, the robot would transmit an encrypted service block — a combination of an AES-128 key, serial number, and Bluetooth address, all wrapped in RSA encryption. The developers intended for only Unitree's cloud infrastructure to decrypt this block.

However, the service accepted the block and returned decrypted data to any registered user without verifying whether they owned that specific robot.

“There was authentication, but no authorization,” Laflamme commented.

The serial number of the G1 could be discovered from the Bluetooth advertisement the robot broadcasted or obtained through a separate unencrypted request. Consequently, an attacker with a free Unitree account could derive the key for a specific robot and gain access to its encrypted channel, including Wi-Fi setup commands.

The attack could then proceed using a script called wpa_connect.sh. By providing a Wi-Fi password of 121 bytes, the robot would switch to an insecure manual mode for handling network settings. In this mode, the transmitted data would be integrated into the wpa_supplicant configuration without filtering or escaping.

This vulnerability enabled an attacker to alter network parameters, forcing the G1 to connect to the attacker’s hotspot, thereby redirecting the robot to a network under the attacker's control.

Following this, the CVE-2026-76639 attack chain would activate. The chat_go AI service allowed mobile applications to submit text notes to the robot's internal knowledge base. Instead of a regular note, an attacker could manipulate the path to upload arbitrary files into another service's directory. Upon restart, the robot would detect the injected file and include it in its list of authorized files.

The second attack chain, CVE-2026-76640, originated from a buffer overflow within the Bluetooth server itself.

Laflamme sent an extra 1050 bytes to the robot, overwriting adjacent memory structures, causing the main event processing loop to terminate, and inserting a false cleaning record. This led to the process executing a system command with root privileges.

The researcher noted that this attack chain was particularly potent — once one G1 was compromised, it could use the same exploit to attack other robots within Bluetooth range. Laflamme successfully replicated these vulnerabilities on various G1 units.

For his findings, Laflamme received a reward of $5000.

As a reminder, in August, Unitree unveiled their "Superman" humanoid robot, capable of running at 12.66 m/s and jumping 2 meters from a standstill.