Ever thought your humanoid robot was just a friendly helper? Think again! Recent findings from Alias Robotics reveal that the Unitree G1 can be weaponized for espionage and cyber attacks, turning your high-tech assistant into a potential spy.

This unsettling discovery centers around a major vulnerability: the robot is hackable via Bluetooth. Imagine someone within range taking control of your robot just by exploiting its setup process! The flaw lies in how the G1 connects to Wi-Fi through Bluetooth Low Energy (BLE). Unfortunately, this connection process is wide open, allowing anyone with the universal credentials to gain root access. Yes, you heard that right—no sophisticated hacking skills are needed!

All models from Unitree share the same hardcoded AES encryption key, meaning once a hacker infiltrates one robot, the whole fleet is compromised. The researchers highlighted that this flaw isn't limited to just one firmware version—it spans across multiple versions, making it a widespread issue.

But wait, it gets worse. The encryption protecting the robot’s configuration files contains critical weaknesses. The outer layer relies on a basic Blowfish algorithm that’s notoriously insecure, while the inner layer is based on a predictable sequence of numbers. With just a bit of guesswork, anyone can decrypt sensitive information, like network details and service settings. It’s like a treasure chest that only needs the right key to unlock all its riches!

To make matters more alarming, researchers found that the G1 continuously sends data back to servers in China without user consent. Every five minutes, it transmits important information like battery status, motion states, and even data from cameras and microphones. This data transfer happens automatically, violating privacy laws like GDPR in Europe and California’s privacy regulations in the U.S. Users are completely in the dark about these transmissions—no consent forms, no alerts, just a silent stream of data flowing away.

Adding to the anxiety, the robot itself is packed with numerous open communication systems. Some channels are completely unencrypted, meaning anyone on the same network can snoop around. Combine that with the Bluetooth vulnerability and the weak encryption, and it’s like leaving the back door wide open for intruders.

Researchers showcased two unsettling scenarios to illustrate just how dangerous these vulnerabilities can be. In the first, they demonstrated how the G1 could function as a covert surveillance device without its owner being any the wiser. Once powered on, the robot immediately connects to telemetry servers and starts transmitting audio, video, and other sensitive information. Imagine a robot quietly collecting data in your office or lab and sending it off to unknown servers abroad!

In another chilling experiment, they tested whether the G1 could autonomously launch cyber attacks. By installing a Cybersecurity AI framework known as CAI, they found it could scan for vulnerabilities and plan attacks, identifying open communication channels with alarming ease. While the team stopped short of executing attacks, the potential for the robot to serve as a launching pad for cyber warfare is deeply concerning.

The bottom line? Humanoid robots like the Unitree G1 pose a unique cybersecurity threat as both surveillance tools and potential attack vectors. Researchers argue the industry needs to rethink robot security, moving away from static defenses to adaptive systems that can detect and counter threats in real-time. As noted by Víctor Mayoral-Vilches, founder of Alias Robotics, this issue is a wake-up call for the future of robotics—an era where our smart devices could easily become digital Trojan horses infiltrating our private lives.