Security researcher Olivier Laflamme published two separate root exploits on 27 August. The robot takes its Wi-Fi password over Bluetooth and that channel requires no authentication. An attacker in range gets root on the computer that decides where the legs go.