Researcher Exploits Unitree G1 Robot to Demonstrate Remote Takeover and Lateral Threats

Security researcher Olivier Laflamme spent roughly three months probing the Unitree G1 humanoid robot and uncovered a chain of two separate vulnerabilities that together grant an attacker full root control from a distance.

By first compromising the robot's network interface and then exploiting a privilege‑escalation flaw in its onboard operating system, Laflamme was able to obtain administrative access without physical interaction. The proof‑of‑concept showed that a single compromised unit could be turned into a weapon against other robots operating in the same vicinity, leveraging the G1's built‑in communication protocols to issue malicious commands.

The findings arrive at a time when service robots are increasingly deployed in warehouses, hospitals, and public spaces. Unitree, a Chinese company known for affordable quadruped and humanoid platforms, markets the G1 as a low‑cost alternative for research and commercial use, yet the incident highlights the growing gap between rapid hardware adoption and the maturity of its software security.

Laflamme reported the work to Unitree, which acknowledged the vulnerabilities and said patches would be released. The researcher emphasized that the attack required no specialized hardware and could be launched over a standard Wi‑Fi network, underscoring the ease with which an adversary could infiltrate a fleet of interconnected robots if proper safeguards are not in place.

Industry observers note that the demonstration adds to a mounting list of robotic platforms found to have exploitable flaws, from autonomous drones to industrial arms. As robots become more autonomous and networked, experts warn that manufacturers must adopt rigorous security testing and provide timely updates, lest compromised machines become vectors for larger cyber‑physical threats.