Bluetooth to Root: Researcher Finds Two Ways Into Unitree's G1 Humanoid

Key points

• Security researcher Olivier Laflamme has disclosed two separate ways to take full control of the Unitree G1 EDU humanoid robot.
• The flaws are tracked as CVE-2026-76639 and CVE-2026-76640, and both grant root access, meaning the highest level of control on the machine.
• CVE-2026-76640 can be triggered over Bluetooth Low Energy, a short-range wireless signal used by phones and headphones, from anywhere within radio range.
• CVE-2026-76639 needs the attacker to already be on the same network as the robot, then abuses two internal services called chat_go and bashrunner.
• Unitree's G1 EDU is a research and education model priced in the tens of thousands of dollars, used by universities and robotics labs.

A researcher has shown that Unitree's G1 EDU humanoid robot, the walking, waving machine you have probably seen in viral demo videos, can be hijacked outright by anyone standing close enough to it with a laptop.

Olivier Laflamme published two separate attack chains against the robot this week. Both end at root, which in plain terms means the attacker owns the machine and can make it do anything its hardware allows.

One of the two, the more alarming one, needs no network access at all. It rides in over Bluetooth Low Energy, the same low-power wireless standard your earbuds use.

What actually got broken?

Laflamme found two independent bugs in the software Unitree ships on the G1 EDU. Each one, on its own, is enough to take the robot over.

The first, CVE-2026-76639, lives in two internal services on the robot called chat_go and bashrunner. An attacker who can already reach the robot on a local network (say, the lab Wi-Fi) can chain the two services together to run their own commands as the top-level administrator.

The second, CVE-2026-76640, is the Bluetooth path. It targets the robot's Locomotion PC, the small computer inside the G1 that handles walking and balance. From within Bluetooth range, roughly the size of a room, an attacker can send crafted signals that end with the same root-level control.

If you have followed web security for a while, the pattern is familiar. The network-side bug is essentially command injection, the classic web bug where user input gets fed straight into a system shell, dressed up in robotics clothing. The Bluetooth bug is more novel, because the attack surface itself (a humanoid you can walk up to) is new.

Who actually owns one of these things?

The G1 EDU is not a consumer product. It is Unitree's education and research model, sold to universities, robotics startups and corporate R&D labs, with a sticker price in the tens of thousands of dollars.

That matters for the risk picture. You will not find one in a shopping mall next week. You might well find one on a campus, in a demo booth at a trade show, or in a car maker's research lab, all places where a stranger with a laptop can get within Bluetooth range without raising eyebrows.

The Hacker News, which first covered Laflamme's disclosure, noted that the two chains are independent, meaning a fix for one does not automatically close the other.

Should the public be worried?

Not directly, and not yet. There is no sign of these attacks being used in the wild, and the affected robots are not the kind of thing sitting in family homes.

The wider worry is what this says about robot security generally. A humanoid robot is a computer with arms and legs. When that computer gets rooted, the consequences are not just data theft, they are physical: a machine that can move, lift and fall on someone, now taking orders from a stranger.

Buyers of these platforms should ask vendors two blunt questions. What wireless interfaces are on by default, and can they be turned off? And how quickly does the vendor ship security patches once a flaw is reported?

Unitree has not yet published a public advisory at the time of writing.