Research has uncovered severe security gaps in Unitree’s G1 humanoid robots that allow attackers within Bluetooth range to seize full control. The vulnerabilities let adversaries achieve root-level access over critical systems like movement, cameras, audio, voice functions, and other peripherals via a multi-stage exploit dubbed “UniBLEed.” The issues involve Bluetooth Low Energy, Unitree’s cloud API, and the robot’s Linux-based control environment.
How the Exploit Chain Works
Two distinct vulnerabilities, assigned CVE-2026-76639 and CVE-2026-76640, were demonstrated in four different units of the G1 robot. The central flaw begins with a Bluetooth service that accepts write operations without requiring device pairing. From there, an attacker can transmit a cleartext request to the robot’s GATT characteristic 0xFFE2 and receive a bootstrap package, unintentionally turning a legitimate cryptographic endpoint into a decryption oracle.
That bootstrap package holds the data essential for recovering the robot’s unique AES-128 key, which was initially protected using RSA. The issue becomes critical because Unitree’s cloud API has an endpoint called devicebindExtData, which decrypts this information for any authenticated user—without verifying that the user actually owns the target robot. This flaw is one of authorization, not authentication.
From Bluetooth to Full System Takeover
With the AES key in hand, attackers can complete the Bluetooth handshake and manipulate the G1’s Wi-Fi setup process. By sending an overly long password, the Wi-Fi configuration script gets forced into manual mode, allowing injection of custom network settings. This could result in the robot joining an attacker-controlled network.
Next, the exploit takes advantage of another vulnerability in the robot’s Bluetooth server. A handler that processes incoming SSIDs fails to enforce buffer length checks and copies data into a fixed 500-byte buffer without verifying size. By sending payloads up to 1,050 bytes over Bluetooth, attackers can corrupt memory and redirect execution within the server, eventually triggering a root shell via a system call.
Separately, CVE-2026-76639 impacts Unitree’s AI features. Attackers on the internal network can exploit a path traversal flaw in the knowledge-upload mechanism of the ‘ChatGo’ service to plant files in a directory trusted by another service called BashRunner. When BashRunner restarts, these files execute as root, handing full control to the adversary. Combined with the locomotion computer’s privileged Linux environment, the result is potentially dangerous physical and digital control.
Wormable Risk & Fixes
One particularly troubling aspect: the Bluetooth attack pathway may be wormable. A compromised G1 could spread the exploit to other nearby bots, making this not just a single-device issue, but a potential network threat.
Fortunately, patches have been issued. In July 2026, Unitree added an ownership validation check to the cloud decryption endpoint. Internal fixes for most or all discovered vulnerabilities are reportedly in place. Device owners are urged to update firmware and mobile apps, avoid exposing robots to untrusted Bluetooth devices, and keep robot management networks separate from sensitive systems.
This discovery underscores growing concerns as robotics merges with cloud services and wireless communication. G1 robots—designed to roam, perceive, and interact—now become risky assets if their wireless cryptography or ownership checks fail. What to watch: whether other robot makers follow in securing BLE endpoints, verifying cloud-side ownership, and treating robot firmware like critical infrastructure.
