A researcher found two ways to get root on Unitree's best-selling humanoid robot -- one just by standing near it with Bluetooth on

Two vulnerability chains disclosed August 27, 2026 give an attacker full root control of the control computer inside Unitree's G1 EDU humanoid robot -- the model most often bought by the universities and research labs training the next generation of roboticists. One of the two chains needs nothing but Bluetooth range and no pairing, and the researcher who found it, Olivier Laflamme, calls it wormable: a compromised G1 can pass the exploit on to the next G1 that comes into radio range, with no human in the loop.

The Bluetooth chain, tracked as CVE-2026-76640, strings together five separate flaws. A Bluetooth Low Energy characteristic on the robot accepts write commands without requiring pairing at all; sending it the right command returns the robot's AES-128 encryption key, wrapped in RSA. Unitree's cloud API is supposed to be the only thing that can unwrap that key -- but the endpoint didn't check whether the requesting account actually owned that robot's serial number, so any free Unitree account could decrypt any G1's key. From there, an unescaped field in the robot's Wi-Fi setup script lets an attacker force it onto an attacker-controlled network, and a buffer overflow in that same code path -- a 500-byte field fed 1,050 bytes -- corrupts the robot's event loop into running arbitrary code as root.

The second chain, CVE-2026-76639, doesn't need Bluetooth proximity at all: it abuses a path-traversal bug in the file-upload feature of `chat_go`, the G1's onboard AI chat service, to plant a script in the directory a separate service called `bashrunner` executes as root on startup. Laflamme's writeup notes both chains reach the same destination -- the Locomotion PC, a real-time Linux box that already runs as root with control over the robot's motors, cameras, microphone and speaker.

Unitree's response gets real credit in the same writeup that found the holes: the company paid a $1,000 bounty for the first chain and $5,000 for the second, and, per Laflamme, "moved quickly through triage, response, and remediation" once notified through its official channel at security.unitree.com. Unitree closed the cloud-side ownership check -- the specific flaw that let any account decrypt any robot's key -- in July 2026, before the CVEs were even publicly reserved.

"[Unitree's security team] moved quickly through triage, response, and remediation." -- Olivier Laflamme, security researcher, in his technical disclosure writeup

But as of publication, The Hacker News reported that no confirmed fixed firmware release has been verified in any Unitree guidance it could access -- meaning the Wi-Fi buffer overflow and the pairing-free Bluetooth write are, for any G1 EDU still running an older build, still live.

That firmware gap matters because of who actually owns these robots. G1 EDU is Unitree's developer edition -- root-level SDK access, ROS support, and full permission to install custom software are the point of the product, not a security lapse. TIME reported that 74% of Unitree's humanoid sales go to universities, research institutions and individual developers, against just 9% to industrial buyers, with more than 5,500 G1 units shipped in 2025 alone. Documented deployments include labs at Stanford, MIT, UT Austin and ETH Zurich -- exactly the kind of shared, semi-public spaces where a stranger, or another lab's own device, can get within Bluetooth range of an unpatched unit without anyone noticing.

The disclosure lands alongside two other Unitree stories already in motion: a US Covered List order that could bar new Unitree and AGIBOT robot models from the American market on national-security grounds, and Unitree's own Shanghai STAR Market IPO, which priced weeks before this disclosure. Neither story is about this vulnerability specifically -- the Covered List order concerns supply-chain and data-routing risk, not firmware bugs -- but a wormable root exploit on the best-selling humanoid robot on Earth is exactly the kind of finding that gets cited in that broader argument, regardless of what actually caused it.

Nothing here suggests Unitree was careless once the report landed -- a fast bounty payout and a real fix to the worst single flaw are the response security researchers actually want to see. What's still open is narrower and more concrete: a specific firmware version number that closes CVE-2026-76640 for good, published somewhere a G1 EDU owner can check against their own unit. Until that exists, "patched" is a claim, not a status a lab administrator can verify.