A chain of security flaws could allow an attacker within Bluetooth range to gain root-level code execution on Unitree G1 humanoid robots. The research, named UniBLEed, connects weaknesses in Bluetooth Low Energy, Unitree’s cloud API, Wi-Fi provisioning and Linux services to reach the locomotion computer responsible for movement, cameras, speakers, voice functions and other peripherals.

The vulnerabilities were reproduced on four G1 robots and assigned CVE-2026-76639 and CVE-2026-76640. Their physical context makes the impact especially important: compromising a general-purpose server can expose data, while taking over a computer that controls a mobile robot can also create operational and safety concerns.

Bluetooth access reveals a device-specific secret

The most serious chain starts with a Bluetooth service that accepts writes without requiring the nearby device to pair first. An attacker can write a cleartext request to a GATT characteristic and obtain an encrypted bootstrap package, along with information associated with the target robot.

That package protects the robot’s unique AES-128 key with RSA encryption. Normally, possession of the encrypted material would not reveal the underlying secret. Researchers found, however, that a Unitree cloud endpoint would decrypt the information for any authenticated Unitree account without confirming that the account actually owned the robot in question.

This was an authorization failure rather than an absence of authentication. An attacker could register a free account, collect the response and serial number from a nearby G1, submit them to the cloud service and recover the device-specific key. With that key, the attacker could complete the robot’s application-level Bluetooth handshake and send trusted configuration commands.

Wi-Fi manipulation leads toward root execution

Researchers next abused unsafe processing in the Wi-Fi setup workflow. A specially crafted, overlong password could force the configuration script down a manual path and inject additional network blocks into the generated wpa_supplicant configuration. This could make the robot connect to an attacker-controlled wireless access point.

From that position, the chain exploited memory corruption in the G1 Bluetooth server. A handler copied Wi-Fi network-name data into a 500-byte buffer without correctly limiting the total data received. By sending a payload of about 1,050 bytes across one or more Bluetooth connections, an attacker could corrupt adjacent process memory.

The reported exploitation technique altered an event-loop cleanup structure so the process invoked a command through the system function. Because the affected service ran with elevated privileges, that command executed as root on the locomotion computer.

A second route abuses AI-related services

A separate root-code-execution path affected the robot’s ChatGo AI and BashRunner services. An attacker already able to reach the internal robot network could exploit path traversal in a knowledge-upload feature, writing a file into a directory trusted by BashRunner. Restarting the service then caused the malicious file to execute as root.

Researchers warned that the Bluetooth chain could potentially be wormable. In theory, a compromised robot might scan for and attack other vulnerable G1 units within radio range. Demonstrating a vulnerability is not the same as observing such propagation in the wild, but the possibility raises the stakes for fleets deployed in shared spaces.

Owners should patch and segment robot networks

Unitree reportedly added an ownership check to the cloud decryption endpoint in July 2026, before public disclosure, and the researcher said fixes existed for most or all reported issues at publication time. Owners and administrators should:

• Install the latest Unitree firmware and mobile application updates.
• Confirm that fleet devices are consistently updated rather than relying on a single test unit.
• Keep robot management networks separate from sensitive corporate and production systems.
• Limit exposure to untrusted nearby Bluetooth devices where operationally possible.
• Monitor unusual Wi-Fi configuration changes, service restarts and unexpected outbound traffic.

UniBLEed shows why connected robots need security controls spanning radio protocols, cloud authorization, local services and physical operations. A weakness in any one layer may appear limited, but attackers can combine multiple implementation errors until they reach the component with the greatest privileges and physical influence.