AI Risk Wire

Cases › security breach › LR-2026-0345

Humanoid robots hacked through voice commands in demonstration

Preliminary Why: 1 report: Mashable · subject to change · 1 independent report

Status: action reported, no fix

Severity minor
Reported 26 Dec 2025
Industry robotics

No source states: loss or records, developer and model, agent tool, could do, deployer.

Severity minor: test: the hack was contained to one demonstration and no third party is stated as touched.

Security researchers from the Chinese group Darknavy showed a demonstration at GEEKcon in Shanghai. A commercially available Unitree humanoid robot ran an internal AI agent. By exploiting a flaw in the software, the researchers took over the robot while it was connected to a network. They then had it use local wireless communication to spread the hack to a second nearby robot that was not connected to the network. The spread took only minutes. The researchers also issued a command for the robot to physically strike a mannequin on stage. The sources describe the demonstration as run in a safe environment with the aim of finding fixes. The sources do not describe any production deployment, third-party harm, or fix applied afterwards.

What happened

1 · What went wrongA software flaw let the researchers take over the networked robot, which then spread the hack by wireless to a second robot not on the network.
2 · What it reached or didThe spread from one robot to the other took a matter of minutes.
3 · How it was caughtThe hack was made public when the Darknavy specialists showed it off, as reported by Yicaiglobal and Interesting Engineering.

What was done

The researchers also commanded the robot to physically strike a mannequin on stage.

Risks

AI system attacked or breached
Primary23 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Application

Vulnerability scanning of AI components · Adversarial testing before deployment · Short-lived, scoped credentials · Live behaviour monitoring · AI incident response plan · Segmentation of agent components · Encryption of stored data

Infrastructure / target

Known flaws patched · Intrusion and endpoint detection · Inventory of exposed services

Evidence

No source states: what the AI was doing, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.

Show the full account: 4 items from the primary sources

What happened, in order

Not dated in the sources:

  • At GEEKcon in Shanghai the researchers hacked the robot by voice commands and used it to infect other nearby units.
  • The robot was taken over while connected to a network, then spread the hack wirelessly to a second robot.
  • The spread from one robot to another took a matter of minutes.
  • The researchers then commanded the robot to physically strike a mannequin on stage.
Show every field, with its source and grade

The AI system

Stage of use
in research
C one secondary source states it

What happened

Earliest source we hold
2025-12-26
D inferred by us from the described behaviour, reason shown
Who caught it
an independent researcher or journalist
C one secondary source states it
Cause in detail
a flaw in the software
C one secondary source states it
What went wrong
security breach
C one secondary source states it
primary risk
RK08
D inferred by us from the described behaviour, reason shown

Impact

Severity
minor
D inferred by us from the described behaviour, reason shown
Why this severity
test: the hack was contained to one demonstration and no third party is stated as touched.
D inferred by us from the described behaviour, reason shown

Context

Industry
robotics
C one secondary source states it
Country
China
C one secondary source states it

Notes on gaps

No fix or remediation is reported, only a stated intent to find fixes.

LR-2026-0345 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON