Hackers broke robots at DEF CON 34. Those attacks now ship as an Isaac Sim extension

VicOne released a free Radeis Extension for NVIDIA Isaac Sim on August 9, 2026. Developers import their own robot model and task, then run curated attack scenarios drawn from the company's research and from findings at DEF CON 34 to see how the robot behaves when the digital systems it depends on are compromised.

The scenario types are the ones that matter for embodied systems specifically: manipulated visual inputs, hijacked commands, poisoned AI policies and exploited connected interfaces. One stated test is whether a vision-language model resists adversarial visual prompts and sensor manipulation — a question the VLA field has largely deferred while it optimised for benchmark success rates.

Where the scenarios came from

At DEF CON 34's Robotic Hacking Community, VicOne ran a Physical AI Safety Stress Test capture-the-flag covering attack paths across AI models, perception, cloud and API services, robotics communications and embedded systems. The platforms were Reachy Mini and LeKiwi. Sixteen teams recorded 25 successful solves. Nearly every core challenge fell at least once. The exception was an advanced embedded-systems challenge involving cryptography and firmware vulnerabilities, which nobody solved.

That distribution is the story. The AI and perception layers — the newest parts of the stack — were the ones that broke. The oldest and most conservatively engineered layer held.

The industry must validate not only whether robots function as designed, but whether they remain reliable when the digital systems they depend on are compromised. — Max Cheng, CEO, VicOne

VicOne was founded in 2022, is based in Tokyo and is a Trend Micro subsidiary with a background in automotive cybersecurity. It says it has uncovered more than 180 zero-days across automotive and robotics, ingests over 100 million threat intelligence signals monthly, and has filed 30 US patent applications covering AI-defined vehicle and physical AI security. The free extension is on GitHub; the full Radeis product is a paid pre-deployment validation suite covering component, system and model risk plus remediation and compliance readiness.

Why it matters

Robot safety has been treated as a physical-force problem — speed limits, force limits, light curtains, ISO standards written for machines that could not be talked into anything. A vision-language-action model can be. If a robot's policy takes instructions from what its cameras see, then a sticker, a screen or a spoofed feed becomes an input channel, and no torque limit addresses that.

The interesting move here is not the product; it is the delivery. Attack scenarios released as a free simulator extension can be run pre-deployment by any team with an Isaac Sim workflow, which makes adversarial testing a build step rather than an audit. That is the same argument the safety-critical software world settled decades ago, arriving late to physical AI. Expect procurement teams — especially in defense and logistics, where robots are now being contracted at scale — to start asking for evidence that these tests were run.