1050 Bytes into a 500-Byte Buffer: Unitree G1 Can Be Hijacked via Bluetooth

On August 27, security researcher Olivier Laflamme disclosed two vulnerabilities in the Unitree G1 humanoid robot that together grant root access: without cables, without passwords, from Bluetooth range. The decisive step is a classic buffer overflow, 1050 bytes into a 500-byte storage space, until the robot executes a foreign command as root.

The concern is less about the individual robot than about propagation. A compromised G1 can launch the same attack against any other G1 within radio range, and the machine weighs around 40 kilograms. Unitree closed the cloud portion of the attack chain in early August and paid a 5000 dollar bounty. For the Bluetooth vulnerability itself, no confirmed firmware version exists to this day.

The first of the two vulnerabilities, catalogued as CVE-2026-76639, requires no wireless connection at all. On the G1 runs a chatbot service called chat_go, which accepts knowledge files while essentially taking the filename unchecked. Anyone on the same network can thus write any file to any location in the filesystem, including a directory that a second service called bashrunner blindly trusts. Restart the service, have the file executed, done. Five messages, no login, root privileges on the computer controlling the robot's movement.

The second chain, CVE-2026-76640, is the real story. It starts with a Bluetooth characteristic identified as 0xFFE2, which accepts write access without the requesting device ever being paired. A foreign smartphone in the vicinity can thus make a request. It then receives an encrypted startup packet, and this is precisely where Unitree's security assumption lay: only the manufacturer can decrypt the packet because the private key resides in their cloud. But the cloud long failed to verify whether the requesting account actually owned the robot in question. A free account was enough to obtain the AES key of someone else's G1. And this single key opens two doors, the Bluetooth protocol and the signalling channel for the video connection.

From there it continued through WLAN provisioning. An excessively long password caused Unitree's own configuration script to write the entered text unfiltered into a configuration file, allowing the robot to be forced into the attacker's wireless network. The rest was handled by the buffer overflow in the Bluetooth server. Laflamme used the excess bytes to build a fake cleanup structure that the program later mistook for a real function pointer and promptly executed. To make this work reliably, he had to know where in memory the program was located, and he obtained this information from the first vulnerability. One weakness made the other useful. It took him three months.

Unitree comes across better in the report than one is accustomed to from disclosures of this kind. The cloud error was closed within roughly two months, a bounty of 5000 dollars flowed on August 6, 4000 for the Bluetooth chain and 1000 for the chatbot path. The researcher describes the cooperation as nearly exemplary. But the cloud fix is the easy part. The missing pairing and the buffer overflow sit deep in the firmware, and anyone who today wants to know from which version onward their device is clean will find no answer in the manufacturer's documentation.

What a compromised robot can do, Laflamme himself has enumerated: eavesdrop and record, manipulate the perception and movement logic, swap the AI models on board, disable safety functions like collision detection. With a vacuum cleaner that would be annoying. With a device that stands upright, moves independently, and weighs as much as a ten-year-old, it is something else.

For Switzerland, the G1 is no exotic piece. It has become the standard platform for research and teaching, available in Europe depending on the configuration for well over 20,000 to over 70,000 euros, and stands in university labs, technical colleges, innovation centres, and demo rooms. Precisely there the situation is unfavourable: these devices rarely run on isolated networks. They stand in workshops, in foyers, at trade fair booths, often several next to each other. Bluetooth range means that an adjacent room is enough. Laflamme limited his propagation test to two robots in the same room; no one knows how far the chain could reach in practice.

The timing is uncomfortable for the manufacturer. Unitree has been listed on the Shanghai STAR exchange since August 28, the first humanoid builder on a Chinese mainland market, and the stock opened 629 percent above the offer price. In the United States, meanwhile, the FCC telecommunications authority placed foreign advanced robotic devices on its Covered List in late July, blocking market approval for new models. Anyone who already regards Chinese robotics as a security risk gets material supplied here. That the causes are banal programming errors and not a backdoor will probably be lost in this debate.

Because that is precisely the finding that points beyond Unitree. The attack required no special equipment: a decompiled Android app, a firmware encryption method that researchers had already broken years ago, and an error class older than the entire industry. Humanoids are currently being built and sold like consumer electronics, with cloud account, app, and wireless connection. Except a compromised smartphone cannot cause physical harm.