Physical AI Security: Protecting Robots and IoT Devices from Cyberattacks

A robot’s commands can arrive through Bluetooth, a maintenance port, a companion app, or an AI planner. Physical AI security extends robot cybersecurity and IoT security to the authority to act—and the consequences when that trust fails.

The hardware , electronics , and RTOS guides cover the architecture; this article focuses on security.

1. When digital failures become physical consequences

A robot holding a knife above a toy doll makes the risk tangible: what happens when unsafe intent becomes movement? RoboHarm’s September 2026 study tested three policies across 300 trials and five tasks. The footage shows controlled research, not a reported injury.

Research in view RoboHarm · September 2026

Watch the original comparison ↗Video · opens in a new tab

Failed execution differs from safety refusal: greater capability may increase harm. These fixed-task results are not a population-wide accident rate.

The Waymo disruption , a July 2025 stunt reported that October, drew about 50 robotaxis into one San Francisco street through coordinated bookings. Valid requests accumulated into congestion; the report established service abuse, not steering compromise.

2. IoT security: device, network, and cloud attacks

Local deployment: Bluetooth, Ethernet, and physical access

For custom robot integration , local deployment keeps inference and control on-premises. Private LANs and Bluetooth remain possible entry points. An air gap excludes external network paths; maintenance can carry files across it.

ZHAW’s March 2026 offline-robot study identifies Bluetooth setup, accessible Ethernet, and default passwords. An unused interface may still be reachable.

Offline access map

Internet isolation still leaves local access paths

01Maintenance laptop

Ethernet→SSH / diagnostics

02Nearby Bluetooth

Radio→Setup service

Internet-isolated networkRobot + private LAN

No direct internet routeLocal interfaces may remain exposed

03Companion phone

Local link→App → Internet

Conditional app relay

04USB / debug

Media integrity·Debug rights

Service access

1. Per-device credentials
2. Command authorization
3. Local control

Ethernet supplies reachability to listening SSH or diagnostic services. Shared default passwords then let one known secret authenticate otherwise separate installations.

Canonical’s hardening guide separates exposure from privileges. Companion-phone credentials and cellular connectivity can permit relays, depending on app permissions.

Ruby Jumper’s February 2026 analysis describes removable-media relays across air gaps. This malware research concerns computers, not a robot incident; imported executables still cross a trust boundary.

Command Injection via Bluetooth Provisioning

Bluetooth security includes link protection and application permissions. BLE’s Generic Attribute Profile (GATT) defines services containing readable or writable characteristics. Provisioning may accept Wi-Fi settings: encryption protects their transit, while authorization decides who may change them. BlueZ’s GATT API distinguishes encrypted writes, authenticated writes, and authorization.

UniPwn’s September 2025 research demonstrated this application flaw through nearby radio access. Internet connectivity was unnecessary; current patch coverage remains a separate question.

Chaining Bluetooth, cloud, and root access

UniBLEed’s August 2026 disclosure chained Bluetooth, cloud-ownership, and onboard-software weaknesses into root execution on tested Unitree G1 robots. It records cloud remediation and a later vendor-reported firmware fix. Each crossed boundary granted additional authority.

Per-device credentials contain leaked-secret reach. Process isolation, least privilege, and a narrow configuration API limit a compromised daemon’s authority compared with root shell access.

MQTT and ROS 2 authorization

MQTT routes publications and subscriptions through a broker. TLS protects the connection; authentication identifies the principal. The broker’s authorization policy binds that principal to a device, topic, and operation.

An overbroad wildcard subscription can expose multiple devices. Ownership changes require permission expiry or revocation; delivery guarantees do not authorize motion.

The February 2026 DJI Romo investigation reported MQTT data access across thousands of vacuums; a journalist verified another owner’s floor map. DJI reported server-side fixes. Cross-device permissions affected privacy as well as control.

ROS 2 security uses DDS-Security to bind certificate identities to signed topic/operation permissions; signed governance defines domain protection. Enclaves group this context. ROS 2 alone does not establish those restrictions.

Firmware security: secure boot and signed updates

Espressif’s secure-boot and OTA documentation show protected eFuse bits enforcing a security-version floor, distinct from release labels. Recovery rollback requires an eligible image.

Remote access to refrigeration controllers

In October 2026, CERT-FR confirmed compromises of refrigeration controllers ; Reuters reporting described food losses and fires . AI involvement was not established. The case illustrates how ordinary device-management authority can reach a physical process.

Network segmentation limits reachability; application permissions limit operations; local constraints limit commands. A VPN can admit an overprivileged identity.

3. AI inputs, model integrity, and the authority to act

Prompt injection through robot observations

Prompt injection can grant lower-trust observations authority over a robot’s task. Perception attacks change the estimated world; unsafe direct requests can be understood correctly and remain hazardous.

RoboPAIR’s October 2024 research demonstrated adversarial prompts against LLM-controlled robots. Like RoboHarm, it separates model refusal behavior from system security.

Model provenance and hidden backdoors

Weights, adapters, and configuration define the inference artifact. Checksums match reference bytes; signed manifests identify their approver. Neither proves behavioral safety.

VillainNet , presented in 2025 and covered by Georgia Tech in January 2026 , embedded backdoors in selected SuperNet subnetworks. Traffic-sign classification experiments did not demonstrate a deployed car takeover.

Authorization between AI plans and motion

Typed requests constrain operations, field types, and units. Authorization binds the verified caller to a device; object and coordinate-frame versions bind the request to current state.

{
  "action": "pick",
  "device": "arm-17",
  "object": "part-42",
  "frame": "fixture-v6",
  "sequence": 481,
  "issued_at_ms": 420000,
  "deadline_ms": 420120
}

Independent workspace, speed, force, or temperature limits constrain a compromised planner. Effectiveness depends on implementation, failure behavior, and the operating envelope.

Replay attacks, command expiry, and scene changes

Signatures persist after scenes change. Sequence checks address replay attacks; expiry bounds age; current-state validation addresses changes before expiry.

A signature or message authentication code binds the payload and target, sequence, and deadline against substitution. Controllers track consumed sequences per authenticated session across restarts and use a defined clock domain. Validation near execution narrows the time-of-check/time-of-use gap; monitoring addresses changes during motion.

Connection loss needs a defined local response; RTOS scheduling alone cannot decide command authority.

Process disruption in the Polish energy attack

CERT Polska’s August 2026 follow-up describes a December 2025 attack stopping a steam turbine and process-water system; operators maintained heat supply. A misconfigured private APN enabled lateral access. AI involvement was not established.

4. Prevention, penetration testing, and recovery

Security hardening and patch verification

The September 2026 architecture review and embodied-AI survey connect defenses across device, network, model, and motion boundaries. Hardening reduces both reachable services and the authority available through them.

NIST’s patch guidance includes operational testing. Verification compares the running version with the vendor advisory and repeats the previously failing test; installation success alone is insufficient.

Detecting unauthorized access and configuration changes

Those controls define a baseline of approved peers, services, and configuration hashes. A September 2026 Go2 Pro forensic study correlates robot, companion-app, and network records. A new peer alone is weak evidence; its session followed by an unapproved configuration change is more informative.

Detection also has blind spots. An ICRA 2026 study shows sensor bias evading prediction-error alarms; an independent predictor drives control attenuation. Its manipulator simulations demonstrate a specific defense, not a universal safeguard.

IoT penetration testing and robot assessment

The 2026 robotics-testing paper tracks attack paths in a ROS/ROS 2 laboratory. RoboMD probes manipulation-policy robustness. Neither substitutes for deployment-specific validation.

Nmap supports basic service inventory; reachability alone is not vulnerability evidence.

scan le
devices
scan off
connect AA:BB:CC:DD:EE:FF
menu gatt
list-attributes

tshark -r robot-lab.pcapng \
  -Y 'btatt || mqtt || rtps'

mosquitto_sub -h broker.lab.example -p 8883 \
  --cafile ca.pem --cert device-a.pem \
  --key device-a.key -V mqttv5 \
  -t 'lab/device-b/telemetry' -d -E

binwalk firmware.bin

export ROS_SECURITY_KEYSTORE="$PWD/demo_keystore"
export ROS_SECURITY_ENABLE=true
export ROS_SECURITY_STRATEGY=Enforce
ros2 run demo_nodes_cpp listener --ros-args \
  --enclave /talker_listener/listener

Discovery identifies exposure; negative tests establish whether boundaries hold.

Incident response and recovery after compromise

CISA’s July 2026 PLC report describes password and IP-address changes disrupting water operations, with undocumented cellular modems adding exposure. This OT incident illustrates why connectivity and configuration both matter during recovery.

NIST’s backup guide covers logic, configuration, firmware, and restoration testing. Robot recovery also needs validated models and calibration. A trusted rebuild follows root-cause remediation; backup hashes need an uncompromised reference.

Password rotation may leave independent access paths valid. Bluetooth bonds and app tokens require separate revocation, alongside sessions and compromised keys. Verified rejection of old access, restored interlocks, and a monitored trial establish the return-to-service evidence.

5. Security across the robot lifecycle

A robotics proof of concept establishes an initial scope. Software updates, new operators, and ownership changes can reopen access paths.

Event records make those responsibilities traceable: which software ran, who issued a command, and what the machine did. Camera views, floor maps, and activity patterns also need bounded access and retention.

NIST’s device baseline covers identity, configuration, data, interfaces, updates, and security-state awareness. Its 2026 manufacturer guidance connects these capabilities to lifecycle responsibility.

Physical AI security becomes part of operating the machine: keeping permissions current, investigating unexpected behavior, and recovering to a state that operators can verify.