A vulnerability discovered in the Unitree G1 Edu humanoid revealed that an attacker in close proximity to the robot could take full control of the machine without needing a physical connection, a Wi-Fi password, or even prior Bluetooth pairing.

The flaw, dubbed "Uni Bleed," was discovered by independent security researcher Olivier la Flam. According to the research, the robot's Bluetooth server accepted certain requests without requiring the device to be previously paired. An attacker within range could request an encrypted packet containing information related to that specific robot's unique key.

Although the packet was protected by Unitree's encryption, a second flaw existed: the company's cloud system could decrypt and return the device key to any authenticated user without properly verifying whether that account actually owned the robot. With that key, the attacker could bypass Bluetooth security checks and send new network configurations, forcing the G1 to connect to a Wi-Fi access point controlled by the attacker.

From there, other vulnerabilities in the robots' internal services could be exploited to gain the highest level of system access—known as "root." In the case of a humanoid, obtaining root access means far more than simply controlling a conventional computer. The ultimate target was the Locomotion PC, an internal computer running real-time Linux that serves as one of the G1's primary operational hubs. With full access, it would be possible to view data from cameras and microphones, modify vision systems, interfere with joint motors, and even disable active safety and collision-prevention mechanisms.

The G1 weighs approximately 36 kg and is equipped with actuators capable of rapid physical movement. The research also revealed another issue: a compromised robot could theoretically scan for nearby G1 units via Bluetooth and execute the same attack chain against them, creating the potential for malicious code to spread among multiple robots located in the same environment.

Flam demonstrated the ability to spread in a controlled manner using just two robots in the same room; after receiving the information, Unitree confirmed the vulnerabilities, paid the researcher a total bounty of $5,000, and fixed the most critical flaw in the cloud system. This case highlights a specific issue that is becoming increasingly important as humanoid robots leave the lab and begin operating in environments shared with people.

In a compromised humanoid, the software controls a physical machine capable of seeing, hearing, walking, and moving its joints—imagine the damage it could cause.