How Researchers Are Tricking Robots Into Doing the Wrong Thing
New research shows that AI-powered robots can be manipulated through their cameras, training data, or wireless systems, and the machines may never flag anything as wrong.
Key points
- A 2025 attack called GoBA achieved a 97 percent success rate at hijacking a robot's behaviour using an everyday object, such as a coffee mug, as a hidden trigger.
- Researchers disclosed a Bluetooth exploit chain, UniPwn, in September 2025 that gave attackers root-level control of humanoid and quadruped robots within 60 seconds.
- A technique called BadRobot found that robots sometimes verbally refused a dangerous command while their movement systems carried it out anyway.
- Safety standards designed around mechanical failure aren't built to catch deliberate manipulation of the AI inside a robot.
Robots used to fail the way machines always have: a motor burned out, a sensor went dark, a cable snapped. Engineers built safety rules around those breakdowns. What recent research reveals is a different category of failure, one where the robot keeps working perfectly while quietly doing the wrong thing.
What does a hidden attack on a robot actually look like?
The clearest demonstration comes from the training phase, the period before a robot is ever switched on in the field. In 2017, a study called BadNets showed that an AI model could be secretly taught to behave badly under one specific condition while appearing normal in every test. Stick a small sticker on a stop sign and the model calls it a speed limit sign. Remove the sticker and it works fine.
That concept has since reached physical robots. At NeurIPS 2025, a major machine-learning conference, researchers introduced a technique called BadVLA, targeting Vision-Language-Action models (systems that let a robot see its surroundings, interpret instructions, and translate those into physical movement). The attack buried a hidden instruction inside the model during training. When a specific trigger appeared in the robot's camera view, its movements shifted in unsafe ways. No trigger, normal behaviour. The hidden instruction survived even when engineers retrained the model on new tasks.
A companion study called GoBA went further. An everyday object placed in view, the researchers used a coffee mug, could serve as the trigger. Attack success rate: 97 percent, with no measurable drop in normal performance.
As we reported on 1 September 2026, cybersecurity is the piece that current robot safety thinking tends to skip, and these results show why that gap matters.
Can attackers get in after the robot is already built?
Yes. Even a robot with a clean, untampered AI model can be compromised through its surrounding software and wireless systems.
In September 2025, researchers disclosed a Bluetooth exploit chain called UniPwn affecting humanoid and quadruped robots from a major manufacturer. Hardcoded cryptographic keys (permanent passwords baked into the hardware) allowed decryption of the robot's wireless traffic. Login checks were bypassed. Commands with full administrative access were injected. Demonstrations produced uncontrolled behaviour within 60 seconds. The exploit was described as "wormable": one compromised robot could potentially spread the attack to nearby units in the same fleet.
Middleware creates another opening. Middleware is the background software layer that carries instructions between a robot's parts. Known weaknesses in ROS 2 and DDS-based systems (standard communication frameworks used across the robotics industry) let an attacker deliver fake commands or swap out the AI model's weights, the numerical values that determine how the model thinks, without ever touching the hardware.
| Attack | Year | Target | Key result |
|---|---|---|---|
| BadNets | 2017 | Image classifiers | Hidden trigger causes misclassification |
| BadVLA | 2025 | Robot action models | Trigger causes unsafe movement trajectories |
| GoBA | 2025 | Robot action models | 97% attack success with everyday object trigger |
| UniPwn | 2025 | Humanoid and quadruped robots | Root-level control via Bluetooth in 60 seconds |
| BadRobot | 2025 | LLM-controlled robots | Robot refused command verbally, executed it physically |
Should people near robots be worried?
Not immediately, but the research deserves attention. These attacks were demonstrated in controlled settings by academic researchers. No public incident of a real-world robot being hijacked this way has been reported. What the findings establish is that the safety testing frameworks most robot makers use today were designed for mechanical failure, not deliberate manipulation.
As robots move into hospitals, warehouses, public spaces, and construction sites, that gap matters more. A robot that freezes mid-task is an annoyance. One that executes an unsafe action while every component shows a green status light is harder to catch and stop. The hardware works; the intent has been corrupted.
Security researchers involved in this work argue that robot makers need to test for adversarial conditions before deployment, monitor for behaviour changes during operation, and treat cybersecurity as part of safety certification rather than a separate box to tick later. The robots aren't broken. That's exactly the problem.
Common questions
Do these attacks affect robots I might encounter today?
The demonstrated attacks were carried out in research settings, not in the wild. Many of the software frameworks and wireless systems the researchers targeted are already used in commercial robots, so the vulnerabilities are real even if active exploitation hasn't been publicly documented.
What would a fix look like?
Researchers point to scanning AI models for hidden triggers before deployment, running simulated attacks in virtual environments to catch weaknesses, and monitoring a robot's physical behaviour in real time so that a mismatch between what the system reports and what the machine actually does triggers an alert.
