Root on a Unitree G1 over Bluetooth is a safety bug, not a data bug

Reporting on September 4, 2026, timed to the opening of IFA in Berlin, pulled together two separate disclosures against Unitree’s G1 humanoid. The first, published in September 2025 by researchers Andreas Makris and Kevin Finisterre as UniPwn, is a Bluetooth Low Energy chain that yields root without pairing and can propagate from an infected robot to other Unitree units in range. The second is a pair of 2026 flaws, CVE-2026-76639 and CVE-2026-76640, disclosed by researcher Olivier Laflamme, which give unauthenticated root code execution on a G1 EDU by way of the robot’s network services, Unitree’s cloud API and its Linux control environment.

Both are researcher-published with technical write-ups; neither is a vendor advisory. The frequently quoted attack distance of roughly 30 metres is a researcher and press figure, not a measured vendor specification, and the practical range of any BLE attack varies with radio and environment.

Why an actuated endpoint changes the model

Enterprise security treats a rooted device as a confidentiality and lateral-movement problem: read the data, pivot to the next host. A G1 rooted over Bluetooth is that, plus a 35kg bipedal machine executing attacker-chosen motion in a room with people in it. The control stack that keeps the robot upright and the sensors that decide where its feet go are on the same box the attacker now owns. Emergency stops and torque limits enforced in software are, at that point, attacker-controlled software.

The wormability is what turns a demonstration into an operational risk. A fleet parked in one charging area is a single Bluetooth radius. This is the class of failure the simulation-side work has started to model — VicOne’s attack-scenario extension for Isaac Sim exists precisely so developers can watch what a robot does when its commands and policies are hijacked rather than assume it stops.

What is confirmed and what is not

Confirmed: the CVEs are assigned, the technical chains are documented in detail by the researcher, and Unitree paid a bounty — an acknowledgement in itself. Also confirmed on the researcher’s account: a firmware build dated September 1, 2026 that blocks those two chains.

Not confirmed: that fielded units are patched. Reporting two days later stated no confirmed public patch. Both can be true — a build can exist while most owners never install it — and that is the real exposure. Unitree has published no coordinated advisory listing affected models, fixed firmware versions and update instructions, which is the artefact a fleet operator needs. Absent one, no buyer can establish the status of a robot already on their floor.

The same robot, two regulatory answers

The US FCC added foreign-made advanced robotic devices, humanoids and quadrupeds included, to its Covered List on July 28, 2026, citing national-security risk; without an equipment authorisation the hardware cannot lawfully be sold new in the United States. We covered the scope of that rule when it landed. The EU has adopted nothing equivalent, and Unitree was exhibiting and selling to European buyers at IFA 2026, which opened September 4.

The gap is defensible on its own terms: the FCC action rests on supply-chain and national-security determinations rather than on these specific bugs, and product-security law is not usually written by trade instrument. But the practical result is that identical hardware, with identical published exploits, is treated as unacceptable in one market and unremarkable in the other. In the EU that question falls to the Cyber Resilience Act and machinery rules, and neither has yet produced an enforcement position on humanoids.