COMMUNITY DRAFT · VERSIONED · v0.2

The Embodied AI Security Top 10

A robot policy has its own attack surface, and it needs its own risk taxonomy. This is a versioned, community-draft list for vision-language-action policies — each entry with a definition, a real example, how Provael tests it (or why it is out of scope), mitigations, and a compliance mapping.

Cross-mapped to OWASP Agentic + LLM Top 10MITRE ATLASProvael covers 8 / 10EAI01 measured on SmolVLA

( 01 ) · EAI01

Policy & instruction jailbreak (direct command channel)

Natural-language commands that drive a VLA policy against its safety constraints — an LLM jailbreak, output as a physical action plan.

EAI01measured

( 02 ) · EAI02

Adversarial perception (patches / textures / sensor spoofing)

Crafted perturbations of what the policy sees or senses — patches, textures, sensor spoofs — that flip behaviour while looking benign to humans.

EAI02channel: visual/sensor_spoof

( 03 ) · EAI03

Model & pipeline poisoning, backdoors & supply chain

Hidden triggers planted at training time or via a poisoned open-weights checkpoint — normal behaviour until the trigger fires an attacker-chosen action.

EAI03channel: backdoor

( 04 ) · EAI04

Action-space integrity attacks (hijack / targeted trajectory / freeze)

Attacks optimized in the action output itself — hijack the trajectory to an attacker waypoint, degrade task success, or freeze the policy into paralysis.

EAI04channel: action/action_space/optimized

( 05 ) · EAI05

Indirect / embodied prompt injection

Malicious instructions that enter through the environment — a sign, a poisoned label, a hostile tool/MCP description, RAG content — treated as commands.

EAI05channel: injection

( 06 ) · EAI06

Cross-domain safety misalignment (the embodiment gap)

Safety at the language layer that does not carry to the physical action — a benign-sounding, “safely-reasoned” instruction still drives an unsafe motion.

EAI06channel: misalignment

( 07 ) · EAI07

CPS, firmware, comms & teleoperation compromise

Classic cyber-physical weaknesses — hardcoded keys, unauthenticated ROS 2/DDS, command injection, hijacked teleop. Out of scope for a VLA-policy red-teamer.

EAI07out of scope

( 08 ) · EAI08

Identity, access & excessive autonomy

Weak authn/z on robot control surfaces plus over-broad autonomy — a policy that self-authorizes a high-consequence action without an operator token.

EAI08channel: authorization

( 09 ) · EAI09

Model & data confidentiality — theft, extraction, inversion & surveillance

Stealing or extracting the policy (theft, extraction, inversion, membership inference) and the robot as a persistent multimodal surveillance device.

EAI09channel: confidentiality

( 10 ) · EAI10

Insufficient evaluation, observability & incident response

The governance meta-risk: no standardized eval, no telemetry to detect an attack, no rollback, no incident process — so the other nine go unmanaged.

EAI10out of scope

The “Embodied AI Security Top 10” is an independent community project maintained by Sattyam Jain (Provael), licensed CC BY-SA 4.0. Independent community project. Not affiliated with or endorsed by the OWASP Foundation or MITRE. Version v0.2 (draft), updated 2026-06-27. Ranking is expert-elicited, not data-driven — there is no embodied-vulnerability incidence corpus yet, and the order will change as one matures. Provael ships a runnable, sim-only attack family for 8 / 10 — EAI07 and EAI10 are out of scope for a VLA-policy red-teamer by design. Only EAI01 carries a real measured result; every other covered family is stub-validated scaffolding — no invented numbers.

RELATIONSHIP TO OTHER TAXONOMIES

Complementary to RoboJailBench — not a rival.

RoboJailBench (Yeke, Zhou, Lin, Cai, Bianchi & Celik — Purdue University; arXiv:2605.19328v1) proposes an 18-category harm-outcome taxonomy — what harm results (collision, force violation, unauthorized capture). This list is an attack-mechanism taxonomy — how the system is attacked. One mechanism here produces many of their harms, and several entries (poisoning, injection, CPS, evaluation) are delivery mechanisms or meta-risks with no single harm counterpart. Two axes of the same problem — complementary, not competing.

Mapped against their 18 harm categories, Provael measures 2 covered, 5 partial, 9 not covered, and 2 out of scope by design — deliberately not a clean sweep. A crosswalk that claimed to cover all 18 would be measuring the wrong thing.

$ provael crosswalk --target robojailbench

Test your policy against the Top 10.

Run Provael locally and measure your own attack-success rate, or book a red-team assessment for an audit-ready evidence pack.

Quickstart →Book an assessment