The robotics sector has been shaken by revelations about the security of one of the most popular humanoid models on the market. An independent cybersecurity expert known by the pseudonym “Boschko“ has identified two serious system vulnerabilities in the Unitree G1 humanoid. The findings, combined in the research project UniBLEed, show how outsiders can take full control of the machine via a Bluetooth Low Energy (BLE) connection, completely bypassing authorization processes.
The first critical issue, registered under the codename CVE-2026-76640, is based on the specificity of the device’s Bluetooth protocol, which accepts external commands from nearby transmitters without the need for prior pairing. Although for full access to require a specific AES-128 cryptographic key, the expert found that it can be easily generated via the manufacturer's cloud API by any registered user with only the robot's serial number. By overflowing the buffer in the Bluetooth service running with the highest system rights (root), the attacker is able to execute arbitrary code on the main Locomotion PC computer.
The second vulnerability, known as CVE-2026-76639, is contained in the chat_go artificial intelligence module. When uploading files to the database, a “path traversal“ error is revealed, which allows manipulation of the system directory of the bashrunner tool. In this way, the attacker can define which applications to run and regain root administrator privileges.
The main risk of these gaps lies in the fact that the compromised Locomotion PC directly manages the Linux operating system responsible for the physical actions of the robot — electric motors, sensors, cameras and audio system. Gaining full access creates the opportunity not only for personal data leakage and unauthorized surveillance, but also for potentially dangerous movements by the humanoid in a real environment. In addition, the attack architecture allows it to spread autonomously from one robot to another within the range of the Bluetooth network without human intervention.
Unitree responded quickly to the report, paying the researcher a reward of $ 5,000 within the framework of the bug detection program and has already released initial software updates. All owners of the Unitree G1 model are recommended to immediately update the firmware, temporarily restrict Bluetooth functionalities and tighten security in user profiles.