Unitree G1 EDU Humanoid Robot Root RCE Vulnerabilities (BLE and Network-Adjacent Chains)

Technical Analysis

CVE-2026-76639 and CVE-2026-76640 are root RCE chains affecting the Unitree G1 EDU humanoid robot's onboard Locomotion PC. The BLE-based chain allows an attacker within Bluetooth range to escalate to root without network access, indicating insufficient authentication or input validation in the BLE service handling pairing or command input. The second chain leverages a network-adjacent path through the chat_go and bashrunner utilities, suggesting improper command sanitization or exposed debug/administrative interfaces reachable over local networks. Successful exploitation grants full root control over the robot's compute unit, enabling arbitrary code execution, persistent implantation, or physical manipulation of the robot's locomotion and actuators. Where these robots are integrated with AI agent frameworks for autonomous decision-making, perception, or task orchestration (common in EDU/research robotics platforms), a compromised Locomotion PC could allow attackers to hijack agent-issued commands, exfiltrate credentials or API keys used for cloud-connected AI services, or inject malicious instructions into the agent's control loop, representing a direct agent-relevant physical and cyber-physical risk.

Affected Systems

Unitree G1 EDU Humanoid Robot, specifically the onboard Locomotion PC; components chat_go and bashrunner; BLE communication interface

Indicators of Compromise

• No specific hashes, IPs, or domains disclosed in source reporting

Remediation Steps

1. 1

   Apply Vendor Patch

   Monitor Unitree for official firmware/software updates addressing CVE-2026-76639 and CVE-2026-76640 and apply immediately upon release.

2. 2

   Restrict Bluetooth Exposure

   Disable BLE interfaces when not actively in use, or restrict pairing to trusted, authenticated devices only.

3. 3

   Network Segmentation

   Isolate robot control networks from general enterprise or research networks to limit exposure of the chat_go/bashrunner network-adjacent attack path.

4. 4

   Harden Locomotion PC

   Audit and restrict access to bashrunner and chat_go services, disable unnecessary debug interfaces, and enforce least-privilege execution contexts.

5. 5

   Credential and API Key Rotation

   If the robot integrates with AI agent frameworks or cloud APIs, rotate any exposed credentials and audit agent command pipelines for signs of tampering.

6. 6

   Physical Access Controls

   Limit physical and proximity access to deployed robots given the BLE attack vector requires close-range presence.