Anyone standing within Bluetooth range of this humanoid robot can take root on it — no pairing, no password, no warning
Security researcher Olivier Laflamme published two independent root remote-code-execution chains for the Unitree G1 EDU humanoid on 27 August, tracked as CVE-2026-76639 and CVE-2026-76640. The second is the alarming one. The robot uses Bluetooth Low Energy for its initial setup — you hand it a Wi-Fi name and password over the air — and the characteristic that receives that data, 0xFFE2, accepts writes with only basic write permission. No pairing, no authentication. From that single opening, an attacker within Bluetooth range reaches root on the robot's locomotion computer, the machine that decides where its legs go. The first chain is network-adjacent and runs through two of the robot's own components, chat_go and bashrunner. Unitree fixed a separate cloud ownership check in July; for these two flaws, no confirmed patched firmware version has been published.
Related stories
The email you read said one thing; the summary your AI wrote said another. The difference was 472 characters of white text.2026-08-29An AI copyright service filed a Minecraft claim against a free game engine, and Google pulled it from the Play Store
2026-08-29Meta's glasses will now stop recording if you cover the light that tells people they are recording
2026-08-29The firm that said software was eating the world has raised $1.1 billion for the part of AI you can drop on your foot
2026-08-29Photoshop now has a mode where you scribble on the picture instead of describing it — and a toggle that hides the professional interface entirely
2026-08-28