Hacker Shows Anyone Near a Unitree G1 Robot Can Seize Root Control

Security researcher Olivier Laflamme disclosed on August 27, 2026, that anyone within Bluetooth range of a Unitree G1 EDU humanoid robot can seize root control without authentication, via two vulnerabilities tracked as CVE-2026-76639 and CVE-2026-76640. The attack chain, dubbed UniBLEed, exploits a Bluetooth GATT characteristic and a cloud service flaw, allowing a wormable compromise that can spread between robots. Unitree has fixed the cloud account-binding flaw and paid a bounty in the $5,000 to $6,700 range, but the BLE and buffer overflow issues remain unresolved.

A security researcher showed that anyone standing near a Unitree G1 EDU humanoid robot can seize root control over Bluetooth alone, no password, no pairing, no warning. Stand close enough to a Unitree G1 and you don't actually need to touch it. You don't need a login, a password, or even a paired phone. You just need to be within Bluetooth range. That's what security researcher Olivier Laflamme published on August 27, 2026, in a disclosure he calls UniBLEed. He found two separate paths to full root access on the G1 EDU's locomotion PC, tracked as CVE-2026-76639 and CVE-2026-76640. Two bugs, two ways in. One runs over the network, through the robot's chat go AI assistant and a service called bashrunner. The other starts purely over Bluetooth Low Energy. No network needed. Proximity is enough. The BLE chain is the more alarming of the two, and Laflamme's write-up on his blog, boschko.ca, lays it out in detail. A Bluetooth GATT characteristic on the robot, labeled 0xFFE2, accepts writes without requiring the device to pair first. Send it the right opcode and the robot hands back its own AES-128 encryption key, wrapped in RSA, no proof you own the robot required. That key doesn't even need to come from the robot itself. Laflamme found that Unitree's cloud service, at an endpoint called /device/bindExtData, would decrypt that key for any free Unitree account without checking whether the account actually owned the robot in question. One customer could pull the BLE key for someone else's G1 with nothing more than an app login. From there, the key unlocks the robot's WiFi provisioning system, and a malformed 121-byte password triggers a buffer overflow that Laflamme traces to a root shell, launched through a corrupted function pointer that forces the system to call system as root. Unitree's Shanghai IPO Prices China's First Humanoid Robot Maker at $9 Billion https://startupfortune.com/unitrees-shanghai-ipo-prices-chinas-first-humanoid-robot-maker-at-9-billion/ Unitree Robotics priced its Shanghai STAR Market IPO at 150.80 yuan a share, valuing China's top humanoid robot maker at about $9 billion at a P/E ratio above 219x. DeepSeek and state oil giant CNPC both bought in as strategic investors alongside a new AI model partnership. - unitree robotics IPO valuation pricing https://startupfortune.com/unitrees-shanghai-ipo-prices-chinas-first-humanoid-robot-maker-at-9-billion/ - humanoid robot maker china IPO https://startupfortune.com/unitrees-shanghai-ipo-prices-chinas-first-humanoid-robot-maker-at-9-billion/ Laflamme is blunt about what that means at scale. He describes the chain as wormable: once one G1 is compromised, that robot can turn around and run the same exploit against the next G1 within range, and the one after that, with no extra discovery needed from the attacker. A single infected robot could spread through a lab full of them. On its own. The separate network path is less exotic but just as serious. The chat go service's file upload feature doesn't sanitize file paths, so Laflamme wrote a script into a directory that bashrunner treats as trusted, then waited for bashrunner to reload its whitelist and execute the file as root. What Unitree Has Fixed So Far Unitree's response has been partial. Laflamme reported the bugs between April 29 and June 25, 2026, and Unitree fixed the cloud account-binding flaw, the piece that let one customer unlock a stranger's robot, sometime between July 1 and August 6. Unitree paid a combined bounty in the $5,000 to $6,700 range across both chains. The Bluetooth GATT weakness and the buffer overflow on the locomotion PC itself are a harder fix, and Laflamme's own writeup is explicit that it reflects a point in time, not a guarantee that the firmware shipping today is clean. Frankly, that gap matters more here than it would for almost any other product category. A vulnerable smart speaker leaks your music habits. A vulnerable G1 can walk. Unitree isn't a fringe player. You can't wave it off. The company listed on Shanghai's STAR Market this year under ticker 688836, closed its first day of trading roughly 460% above its offer price, and now carries a market capitalization near $50 billion, according to reporting on the listing. Its EDU-configured G1 units, the ones used in Laflamme's research, run from roughly $43,900 depending on configuration, and they've become the default humanoid platform for robotics labs. Stanford, MIT, and UT Austin all operate G1 units for locomotion and manipulation research, and ETH Zurich's Autonomous Systems Lab runs two G1 Pro units to automate sample transport between wet-lab rooms. None of those institutions asked for a robot that a stranger in the hallway could silently take over. That's the uncomfortable part of physical AI arriving ahead of its own security posture. The industry has spent years worrying about what a chatbot might say. It has spent comparatively little time asking what happens when the thing running bad software also has legs. Also read: Sony Music and Warner Chappell Sue Anthropic Over Stolen Song Lyrics https://startupfortune.com/sony-music-and-warner-chappell-sue-anthropic-over-stolen-song-lyrics/ • StarkWare's Avihu Levy Mines Bitcoin's First Quantum Safe Transaction https://startupfortune.com/starkwares-avihu-levy-mines-bitcoins-first-quantum-safe-transaction/ • Instinct's AI Assistant Grabbed User Data Rights, Then Raised $250 Million https://startupfortune.com/instincts-ai-assistant-grabbed-user-data-rights-then-raised-250-million/ Unitree's Shanghai IPO Sets the First Real Valuation in Humanoid Robotics https://startupfortune.com/unitrees-shanghai-ipo-sets-the-first-real-valuation-in-humanoid-robotics/ Unitree Robotics opened book-building for its Shanghai STAR Market IPO on August 5, targeting a valuation near 42 billion yuan, just days after new US sanctions hit the company. It's the first profitable, at-scale humanoid robot maker to go public, setting a real valuation benchmark against pre-revenue rivals like Figure AI. - Unitree robotics Shanghai IPO valuation https://startupfortune.com/unitrees-shanghai-ipo-sets-the-first-real-valuation-in-humanoid-robotics/ - humanoid robot company IPO pricing https://startupfortune.com/unitrees-shanghai-ipo-sets-the-first-real-valuation-in-humanoid-robotics/