VicOne reported an initial set of 28 zero-day findings identified in less than two days through AI-assisted research covering software and tools used across the Physical AI robotics ecosystem. The reported findings include projects developed or maintained by Google, NVIDIA, Meta and other organizations, spanning robot training, simulation, validation, deployment and runtime operations. VicOne said 75% involved development, training, simulation or validation tools, while the remainder concerned deployment or runtime. Potential effects include tampering with models or test results, reduced operator visibility and altered robot behavior, but the actual consequences depend on access, system architecture and other safeguards. The figure and classifications may change after vendor and vulnerability-authority review, and some findings do not yet have CVE identifiers; further details are expected through coordinated disclosure.
Why it matters
Robotics organizations should review the software supporting training, simulation, testing and operations, not only the robots in service. They should identify affected components, assess possible effects on models and control, and confirm that patches preserve safety functions such as remote stop; the reported remote-stop case was a separate demonstration, not necessarily an outcome of all 28 findings.
Key points
- VicOne reported an initial 28 zero-day findings identified in less than two days using AI-assisted research.
- 75% of the reported findings involved development, training, simulation or validation tools.
- Some findings had not yet received CVE tracking numbers at the time of publication.
- In a separate demonstration, researchers showed a vulnerability that prevented a robot’s remote-stop command from working.
- The total and classifications may change after review by vendors and vulnerability authorities.
Based on reporting by The Robot Report.
Join the conversation! Your thoughts help the community grow.