Bluetooth to Root: Researcher Finds Two Ways Into Unitree's G1 Humanoid

Key points

• Security researcher Olivier Laflamme has disclosed two separate ways to take full control of the Unitree G1 EDU humanoid robot.
• The flaws are tracked as CVE-2026-76639 and CVE-2026-76640, and both deliver root access, the highest level of control on the machine.
• CVE-2026-76640 can be triggered over Bluetooth Low Energy, a short-range wireless standard used by phones and headphones, from anywhere within radio range.
• CVE-2026-76639 requires the attacker to already be on the same network as the robot, then abuses two internal services called chat_go and bashrunner.
• Unitree's G1 EDU is a research and education model priced in the tens of thousands of dollars, sold to universities and corporate R&D labs.

A researcher has shown that Unitree's G1 EDU humanoid robot can be hijacked outright by anyone close enough to it with a laptop. No login required. No inside access. Just proximity.

Olivier Laflamme published two separate attack chains against the robot this week. Both end at root, meaning the attacker owns the machine and can make it do anything its hardware allows.

One of them needs no network access at all. It rides in over Bluetooth Low Energy, the low-power wireless standard your earbuds use.

What actually got broken?

Laflamme found two independent bugs in the software Unitree ships on the G1 EDU. Each one is enough, on its own, to take the robot over.

The first, CVE-2026-76639, lives in two internal services called chat_go and bashrunner. An attacker who can reach the robot on a local network can chain the two services together to run their own commands as the top-level administrator. It's command injection, the classic web bug where user input gets fed straight into a system shell, dressed in robotics clothing rather than anything genuinely new.

The second, CVE-2026-76640, is the Bluetooth path. It targets the robot's Locomotion PC, the small computer inside the G1 that handles walking and balance. From within Bluetooth range, roughly the size of a room, an attacker can send crafted signals that land root-level control. That attack surface, a humanoid you can walk up to in a lobby, is what makes this one worth watching.

The two chains are independent. A fix for one doesn't automatically close the other.

Who actually owns one of these things?

The G1 EDU isn't a consumer product. It's Unitree's education and research model, sold to universities and corporate R&D labs at a sticker price in the tens of thousands of dollars.

That shapes the risk picture. You won't find one in a shopping mall next week, but a campus, a trade-show demo booth or a car maker's research facility are all places where a stranger with a laptop can get within Bluetooth range without raising eyebrows. We noted in July that America's FCC moved to block imports of Chinese-made humanoid robots on national security grounds, and these disclosures add a different kind of pressure on operators already scrutinising the platforms they've bought.

Should the public be worried?

Not directly, and not yet. There's no sign of these attacks being used in the wild, and the affected robots aren't sitting in family homes.

The broader concern is what this says about robot security generally. A humanoid robot is a computer with arms and legs. When that computer gets rooted, the consequences go beyond data theft: a machine that can move and fall on someone is now taking orders from a stranger.

Buyers should press vendors on two points. Which wireless interfaces are on by default, and how quickly does the vendor ship patches once a flaw is reported? Unitree hadn't published a public advisory at the time of writing.

The Bluetooth vector is the detail that sticks. Command injection on a networked service is old news repackaged. An unauthenticated wireless path into a walking robot's motor controller is the kind of thing that makes a physical-security team's job genuinely harder.