VicOne maps three cyberattack layers on Physical AI robots
IEEE Spectrum published an article sponsored by VicOne, a Tokyo-headquartered Physical AI cybersecurity company, arguing that classic robot safety engineering, which asks whether a machine stays safe when a component breaks, is not enough for AI-driven robots. Physical AI raises a different question: can a machine stay safe when an attacker quietly changes what its sensors register, what its model concludes, or what its controller does, while nothing appears to have failed. The article frames this as a layered attack surface spanning three layers: training pipelines, system infrastructure, and runtime perception.
Layer one covers training-time backdoors. BadNets, from 2017, showed a model can behave normally under most conditions yet misclassify inputs when a hidden trigger appears; in one example a subtle pattern made a stop sign register as a speed-limit sign without changing behavior on other inputs. BadVLA, introduced at NeurIPS 2025, extended this from classification to action: it backdoors Vision-Language-Action (VLA) models so a robot's action trajectory deviates only when a trigger is present, the model otherwise performs normally, and the backdoor survives task transfer and fine-tuning. GoBA, a related 2025 study, showed an everyday object, a coffee mug, can serve as that trigger, reporting a 97 percent attack success rate with no drop in performance on clean inputs.
Layer two covers vulnerabilities in the system stack around an otherwise secure model. UniPwn, disclosed in September 2025, is a Bluetooth exploit chain against quadruped and humanoid robots from an unnamed major manufacturer: hardcoded cryptographic keys let attackers decrypt traffic, authentication checks were bypassed, and command injection reached root-level execution. The exploit is described as wormable, meaning a compromised robot could scan for and potentially affect other units on the same fleet. The article also points to vulnerabilities in ROS 2 and DDS-based middleware that can allow arbitrary code execution or let an attacker send commands over unauthenticated topics, overriding motor commands or replacing a model's weights without attacking the AI model itself.
Layer three covers manipulation of perception and reasoning at runtime, which needs neither firmware changes nor a network breach. RoboPAIR, from 2024, showed carefully structured prompts could redirect LLM-controlled robots into unsafe trajectories. BadRobot found cases where a robot verbally refused a dangerous command while its motion controller carried the action out anyway. VLAttack showed an adversarial patch placed within a camera's view could drive a VLA model's task success rate to zero, and FreezeVLA showed a single adversarial image could freeze a robot's decision-making loop, leaving it unresponsive to further instructions.
The article closes on VicOne's own pitch: a lifecycle approach combining AI-model and vulnerability scanning, simulation-based validation, and continuous monitoring across design, pre-deployment testing, and live operation. It cites VicOne's Radeis tool, used with NVIDIA Isaac Sim to test adversarial inputs before deployment, and a VicOne Lab R7 demo in which chaining three wireless exploits triggered uncontrolled robot behavior and operational disruption within 60 seconds. The piece points readers to a VicOne whitepaper for more detail.
Key facts
- GoBA's coffee-mug backdoor trigger reached a 97 percent attack success rate on Vision-Language-Action models without degrading performance on clean inputs.
- UniPwn, disclosed in September 2025, chains hardcoded-key and authentication-bypass Bluetooth flaws into root-level command injection on quadruped and humanoid robots from an unnamed major manufacturer, and is described as wormable across a fleet.
- VLAttack drove a VLA model's task success rate to zero using an adversarial patch in the camera's view; FreezeVLA froze a robot's decision loop with a single adversarial image.
- VicOne's own Lab R7 demo chained three wireless exploits to trigger uncontrolled robot behavior and operational disruption within 60 seconds.
- BadRobot documented cases where a robot verbally refused a dangerous command while its motion controller executed the action anyway.
Why it matters
Robot safety engineering has traditionally focused on failures: does the machine stay safe when a part breaks or a condition goes unexpected. The article argues AI-driven "Physical AI" robots need a second, distinct layer of assurance, cybersecurity, because an attacker can manipulate what a robot perceives, decides or does while every individual component keeps functioning normally, leaving conventional safety checks blind to the change. It presents this as a genuine gap in current safety assurance rather than a repackaging of existing practice.
Who it affects
Companies building or deploying robots that use Vision-Language-Action models or LLM-based control, and makers of quadruped or humanoid robots that rely on Bluetooth, ROS 2 or DDS middleware. The layers described run from model training through fleet operation, so the exposure spans robotics developers, integrators and operators. VicOne, the sponsor, is pitching its own products at that same audience.
How to use it
VicOne's recommended lifecycle approach: scan AI models and the surrounding software and hardware stack for known vulnerabilities, validate behavior against adversarial inputs before deployment using tools such as its Radeis validator paired with NVIDIA Isaac Sim, and monitor continuously in operation so that an affected path can be contained without stopping an entire robot fleet. No pricing or availability detail for VicOne's products is given in the text.
How solid is it
This is sponsored content: IEEE Spectrum credits it as brought to readers by VicOne, a Physical AI cybersecurity vendor, rather than to a named journalist, and VicOne's own Radeis tool and Lab R7 demo appear alongside the cited independent research. That research itself, BadNets, BadVLA (NeurIPS 2025), GoBA, UniPwn, RoboPAIR, BadRobot, VLAttack and FreezeVLA, consists of named, dated studies with concrete reported figures, but the article's framing and conclusions are the vendor's own.
Risks and caveats
The article does not name the "major manufacturer" whose quadruped and humanoid robots UniPwn affected, nor the specific robot models used to test BadVLA, GoBA, VLAttack or FreezeVLA, so the real-world exposure of any particular product cannot be judged from this text alone. No publication date is given for the IEEE Spectrum article itself, only the years of the studies it cites.
“Physical AI raises a harder question: Can a machine remain safe when an attacker changes what it sees, decides, or does even when nothing appears to have failed?”
— IEEE Spectrum, sponsored content from VicOne