Rethinking Robot Safety in the Age of AI

Robot safety used to be about failure modes. Now it has to deal with sabotage. The source article argues that Physical AI changes the question from “can this machine stay safe when something breaks?” to “can it stay safe when someone quietly changes what it sees, decides, or does?” That is a nastier problem, because the robot may appear to be working normally right up until it isn’t.

The first layer is the model itself. Backdoor attacks have gone from simple image tricks to action manipulation in robot models. The article cites BadNets from 2017, where a hidden trigger could make a stop sign look like a speed limit sign. More recently, at NeurIPS 2025, researchers introduced BadVLA for Vision-Language-Action models, with triggers causing robots to take a different action path while otherwise keeping normal performance. Another 2025 study, GoBA, used ordinary objects like a coffee mug as a trigger and reported a 97 percent attack success rate without hurting clean-input performance.

Then there’s the system around the model. In September 2025, researchers disclosed UniPwn, a Bluetooth exploit chain affecting quadruped and humanoid robots from a major manufacturer. The chain used hardcoded cryptographic keys, bypassed authentication checks, allowed command injection, and reached root-level execution. The article also describes it as wormable, meaning a compromised robot could scan nearby units and spread. It also points to ROS 2 and DDS weaknesses that could let attackers run arbitrary code, abuse unauthenticated topics, override motor commands, or even replace AI model weights.

The third layer is runtime manipulation. The article points to RoboPAIR, which used structured prompts to steer LLM-controlled robots into unsafe trajectories, and BadRobot, where a robot could verbally reject a dangerous command while the motion controller still carried it out. On the vision side, VLAttack pushed a VLA model’s task success rate to zero with an adversarial patch, while FreezeVLA used a single adversarial image to freeze decision-making. The common theme is ugly and simple: the camera may still work, the model may still run, and the controller may still respond, but the behavior is no longer trustworthy.

The piece’s answer is lifecycle assurance, not one-off testing. It says teams need to check cyber risks during design, test realistic attacks before deployment, and keep monitoring in operation so they can spot when cyber events start shaping physical behavior. Functional safety still matters, but alone it’s not enough once the robot’s inputs can be poisoned without any obvious breakdown.