Anyone Within Bluetooth Range Can Take Over This Humanoid Robot — and America's Robot Ban Doesn't Reach the Ones Already Here
About This Episode
Security researcher Olivier Laflamme published two CVEs on August 27 showing that a person within Bluetooth range of a Unitree G1 humanoid — no pairing, no password — can gain root control of the computer that runs its motors, cameras, microphones and collision detection. The decisive flaw was an authorization check Unitree's cloud never performed, and a compromised robot can attack other robots nearby. It lands a month after the FCC put foreign advanced robotic devices on its Covered List, a rule that blocks new models from authorization but explicitly leaves already-authorized robots free to be imported, sold and used.
Our Take
Washington answered Chinese humanoids with a list of who is allowed to build them, and a week later one researcher showed the actual danger was a missing permission check that no list of vendors could ever catch.
Continue Reading on Unscarcity
Humanoid Robots 2026: 50,000 Units and a US Import Ban
It is the direct match: the piece analyzes the FCC Covered List order on advanced robotic devices and argues control has migrated from owning a resource to holding the right to authorize a device for a market — exactly the lever Washington pulled a month before this robot was shown to be trivially hijackable.
Blocklists Fail When Machines Write the Unknown
Its catalog assumption — that a list of known-bad artifacts is a security architecture — is precisely what a banned-vendor list is, and it cannot see a missing authorization check in a cloud API from any country.