Security researcher Olivier Laflamme has disclosed two independent root remote code execution chains affecting the Unitree G1 EDU humanoid robot, including one that begins from Bluetooth proximity without pairing — and is reportedly wormable, meaning a compromised robot could spread the exploit to nearby G1 units.
The vulnerabilities, tracked as CVE-2026-76639 and CVE-2026-76640, were published on August 27, 2026. Laflamme was awarded a $6,700 bounty from Unitree’s security team for the research.
What Is the Unitree G1 EDU?
The G1 EDU is the education-focused variant of Unitree’s bipedal humanoid robot, priced around $20,000. Unitree, the Hangzhou-based robotics company that went public on Shanghai’s STAR Market earlier this month in a blockbuster IPO, is one of the world’s largest humanoid robot manufacturers by shipment volume — second only to Agibot, according to Counterpoint Research data. The G1 is available on Amazon and can be delivered within days.
That accessibility is what makes the security findings notable. This isn’t a locked-down industrial system in a controlled facility. It’s a humanoid robot that could be standing in a university lab, a research centre, or a living room.
Two Chains, Root Access
The first vulnerability, CVE-2026-76639, exploits a path-traversal condition in chat_go — the robot’s AI chatbot component — to reach a process called bashrunner, which executes commands as root on the robot’s Locomotion PC. Laflamme described this as a three-bug chain.
The second, CVE-2026-76640, is the more alarming one. It’s a five-bug chain that starts with a Bluetooth Low Energy characteristic that accepts writes without pairing. From there, the attack crosses into Unitree’s cloud service — which, at the time of research, did not verify that a requesting account actually owned the target robot — to recover the robot’s AES encryption key. That key unlocks the BLE handshake, which leads to Wi-Fi provisioning code where a buffer overflow produces root execution.
In his technical disclosure, Laflamme described the chain as wormable: once one G1 is compromised, it could propagate the same exploit to the next G1 within Bluetooth range, and so on. He limited his testing to two robots in one room.
What Unitree Has Done
According to Laflamme, Unitree patched the cloud account-to-robot ownership check in July 2026. As of the August 27 disclosure, the cloud-assisted route in the proof-of-concept requires an account bound to the target G1 or the relevant key material already in hand.
Laflamme was notably complementary toward Unitree’s security team, writing that they “moved quickly through triage, response, and remediation” and that the company sent him a G1 robot as compensation for the research — something he described as “literally unheard of in robotics.”
An exact fixed firmware release has not been publicly confirmed. The Hacker News reported reaching out to Unitree for confirmation on fixed versions, affected product scope, and remediation status.
An Industry-Wide Gap
What stands out here is not that Unitree has vulnerabilities. It’s that the robotics industry as a whole has barely begun thinking about security.
Laflamme made the point directly: “Go look at any robotics company or startup (especially in the Valley) — see how many security roles they’re hiring for. They’re not. Most never have.”
He’s right. The FCC’s ban on certain Chinese humanoid robots centred on national security concerns, but the more immediate threat is mundane: a $20,000 robot running software with path traversal bugs, unpaired Bluetooth writes, and cloud APIs that don’t check ownership. As humanoid robots move from conference demos into warehouses, factories, and eventually homes — a transition already underway, with shipments up roughly 300 per cent year-over-year — the attack surface grows with every unit deployed.
The race to build capable humanoid robots is moving faster than the race to secure them. That gap will matter more as volumes scale.
❓ FAQ
Which Unitree robots are affected? The disclosed vulnerabilities target the G1 EDU model specifically. Broader applicability to other Unitree robots has not been confirmed. Unitree has not publicly stated which firmware versions are affected or patched.
Can this be exploited remotely over the internet? CVE-2026-76639 requires network adjacency to the robot. CVE-2026-76640 requires Bluetooth proximity. The cloud-based key recovery step in the second chain has been patched, but the researcher noted the remaining path requires either an account bound to the target robot or key material already in hand.
Did Unitree fix the vulnerabilities? Laflamme said Unitree has patches for the majority of the vulnerabilities, with some already deployed at the time of posting. The company’s security team was described as responsive throughout the disclosure process. However, no specific fixed firmware version has been publicly documented.
Is this unique to Unitree? No. The researcher explicitly noted that most robotics companies are not hiring security engineers. The vulnerabilities reflect an industry-wide gap in robotics security, not a Unitree-specific failure.
