Provael — incident tracker

UniBLEed - two root-RCE chains in the Unitree G1 EDU, one reachable from Bluetooth range with no pairing

Sat, 01 Aug 2026 00:00:00 GMT

Unitree G1 EDU humanoid, firmware through 1.5.2 - the Locomotion PC, which runs motors, cameras, audio and voice as root — Chained remote code execution: BLE GATT + WiFi provisioning (CVE-2026-76640) and a DDS bridge + path traversal (CVE-2026-76639) (CVE (2), both PUBLISHED 2026-08-27), 2026-08

Disclosed 27 August 2026 by Olivier Laflamme. CVE-2026-76640 needs only Bluetooth proximity and no pairing or credentials: crafted writes to an unprotected GATT characteristic overflow a fixed 500-byte SSID accumulator with a 1050-byte payload across BLE connections, corrupting an adjacent mainloop function-pointer entry that the cleanup path later invokes with attacker-controlled data through system() as uid 0. CVE-2026-76639 is network-adjacent: an unauthenticated WebRTC-to-DDS bridge on TCP 9991, a world-readable static AES-128 key, and path traversal in the chat_go knowledge upload combine to plant a payload in bashrunner’s script directory and run it as root. Both records were read at cve.org before this entry was published; both are PUBLISHED, assigned by VulnCheck, and name Unitree Robotics G1 EDU through 1.5.2. THIS IS THE CLASS PROVAEL DOES NOT TEST. Provael attacks a policy through the instructions and observations it receives; nothing here touches a policy. The entry point is a radio, the bug is a missing bounds check in C, and the outcome is uid 0 on the computer the policy happens to run on — EAI07, which the registry marks out of scope for a VLA red-teamer by design, and which is assessed with IEC 62443 and ATT&CK-for-ICS methods and CVE scanning against the robot’s own stack. A clean Provael run says nothing whatsoever about this. That boundary is a large part of why this index exists: the risks a policy scanner cannot see still belong on the map.

Maps to EAI07.

Primary source: Laflamme, UniBLEed (researcher write-up); CVE-2026-76639 / CVE-2026-76640

DURA - a diffusion-optimised patch that works when printed, and needs only the robot’s emitted actions

Sat, 01 Aug 2026 00:00:00 GMT

OpenVLA-7B and pi0-FAST on LIBERO, plus a real Franka arm — Adversarial patch optimised along a diffusion latent trajectory, white-box and black-box (Research), 2026-08

Reports 100% ASR under white-box access across all four LIBERO suites in both the simulated and physical patch settings, 86.0% and 79.3% black-box, and 77% from a patch covering 2% of the image (99% at 5%), against 23.5% benign and 39.5% clean-patch baselines. What is new is the black-box variant: it needs only the victim’s emitted actions, so an observable action stream is itself an attack surface rather than just an output. Third-party work - Provael did not run it, and unlike most entries here it was demonstrated on physical hardware, with a printed patch held in the arm’s camera view.

Maps to EAI02, EAI04.

Primary source: arXiv:2608.10393

DRIFT - flow-matching robustness reported as an artefact of how it was measured

Sat, 01 Aug 2026 00:00:00 GMT

Flow-matching VLA policies (pi0, pi0.5) — Universal gripper patch optimised against the first denoising step (Research), 2026-08

Reports that the adversarial robustness flow-matching policies were credited with "is largely illusory: it stems from prior attacks ignoring the multi-step denoising ODE", and that attacking only the first denoising step beats attacking a wider window. Not a deployed incident and no robot was harmed: a white-box result on off-the-shelf policies in simulation.

Maps to EAI02, EAI04.

Primary source: arXiv:2608.03207

AGSD and SARF - attention-hijacking patch, and a defense measured on real hardware

Sat, 01 Aug 2026 00:00:00 GMT

OpenVLA on LIBERO, and a physical PiPER manipulator — Printable patch that hijacks action-to-vision attention, plus a fine-tuning defense (Research), 2026-08

AGSD drives OpenVLA to a 100% failure rate under attack; the paired SARF defense cuts that to 14.2-56.8% and, on a real PiPER arm, lifts average success under attack from 23.0% to 65.0%. Listed because the defense half carries a physical-robot number - the kind of evidence Provael does not have for any family.

Maps to EAI02.

Primary source: arXiv:2608.03231

Command injection in Universal Robots PolyScope 5

Fri, 01 May 2026 00:00:00 GMT

Universal Robots cobot controllers (PolyScope 5 < 5.25.1) — Unauthenticated OS command injection → controller RCE (CVSS 9.8), 2026-05

CISA advisory ICSA-26-134-17: an unauthenticated attacker with network access to the Dashboard Server executes commands on the robot controller - enough to alter safety configurations or manipulate physical movement.

Maps to EAI07.

Primary source: CISA ICSA-26-134-17

Unauthenticated RCE in Hugging Face LeRobot

Wed, 01 Apr 2026 00:00:00 GMT

LeRobot async-inference PolicyServer (the default open VLA stack, 21.5k★) — Unsafe pickle deserialization over unauthenticated gRPC (CVSS 9.8), 2026-04

CVE-2026-25874: any attacker who can reach the PolicyServer port runs arbitrary code on the host - a server that sits directly in the control path and whose outputs govern actuator commands on the robot's joints.

Maps to EAI03, EAI07.

Primary source: CVE-2026-25874 (Resecurity)

AttackVLA / BadVLA - targeted action hijack & backdoors

Sat, 01 Nov 2025 00:00:00 GMT

Vision-language-action robot policies — Targeted action-sequence hijack and implanted backdoors (Research), 2025-11

Drove a real robot through an attacker-specified action sequence, and showed backdoors that trigger a chosen motion on a hidden cue - the danger is in the trajectory, not the words.

Maps to EAI04, EAI03.

Primary source: arXiv:2511.12149

FreezeVLA - adversarial policy paralysis

Mon, 01 Sep 2025 00:00:00 GMT

Open vision-language-action policies — Adversarial-image freeze (no-op / paralysis) (Research), 2025-09

Reported roughly 76% paralysis attack-success rate: an adversarial image freezes the policy into inaction - an availability failure that a single task-success metric hides.

Maps to EAI04.

Primary source: arXiv:2509.19870

UniPwn - Unitree Go2 / G1 exploit chain

Mon, 01 Sep 2025 00:00:00 GMT

Unitree quadruped & humanoid robots — Unauthenticated comms/BLE exploit → RCE, wormable (Real-world), 2025-09

An unauthenticated exploit chain against widely-deployed Unitree robots enabling remote code execution and self-propagation, alongside separately-reported covert telemetry from the same platform.

Maps to EAI07, EAI09.

Primary source: IEEE Spectrum

RoboPAIR - jailbreaking LLM-controlled robots

Tue, 01 Oct 2024 00:00:00 GMT

LLM-driven robots (Unitree Go2, Clearpath, an AV stack) — Automated policy / instruction jailbreak (Research), 2024-10

An automated jailbreak that reliably drove LLM-controlled robots to perform disallowed physical actions - the external validation Provael cites for EAI01.

Maps to EAI01.

Primary source: arXiv:2410.13691

Adversarial road stickers steer Tesla Autopilot

Tue, 01 Jan 2019 00:00:00 GMT

Tesla Autopilot (deployed driver-assist) — Physical adversarial-perception patch (Real-world), 2019

Researchers placed three small stickers on the road that steered Autopilot into the oncoming lane - the canonical proof that adversarial perception moves a real machine, not just a benchmark.

Maps to EAI02.

Primary source: IEEE Spectrum