VicOne has identified an initial set of 28 zero-day findings in less than two days through AI-assisted research across software and tools that support the Physical AI ecosystem. The findings include projects developed or maintained by Google, NVIDIA and Meta, among others, according to the company.
Based on initial validation, VicOne classified all 28 findings as zero-day vulnerabilities. The company cautioned that the count may change after review by vendors and vulnerability authorities, and that some findings do not yet have CVE tracking numbers. A zero-day is a previously unknown weakness without an available fix; VicOne said faster discovery does not necessarily mean an attack has occurred, but teams still need to determine whether they use the affected software and what an attacker could access or change.
Many of the affected tools are used to train, simulate, test and operate robots. VicOne said weaknesses in them could influence the models teams build, the test results they trust and the instructions sent to robots. That creates two demands for robotics teams: responding as AI helps uncover weaknesses faster, and assessing how each finding could affect robot safety and operations.
VicOne said AI can accelerate parts of vulnerability discovery, including examining code, tracing system communications and testing whether a suspected weakness can be exploited. Attackers could use similar capabilities. When a weakness is a zero-day, faster discovery can leave teams little time to respond.
The findings span three stages of the robotics lifecycle: development and training, simulation and validation, and deployment and runtime. VicOne described potential scenarios for each stage, while noting that these are potential consequences rather than demonstrated outcomes for every finding. Actual effects depend on the attacker's access, the system's design and whether other safeguards prevent changes from reaching physical behavior.
In development and training, a team might download a pretrained model to adapt for its robot. Loading a malicious file could give an attacker access to the training system, allowing changes to training data or the model itself. A manipulated model could behave normally during routine testing but respond incorrectly to a particular object, scene or command after deployment. The risk can enter through a tool the team trusts before anyone attacks the robot directly.
In simulation and validation, importing a compromised scene or robot model could give an attacker access to the simulation environment. With sufficient control, the attacker could alter simulated sensor readings, physical conditions or test results. A robot could then appear to pass tests that should have exposed unsafe behavior, leading a team to approve it for real-world use on misleading evidence.
In deployment and runtime, an attacker could exploit weaknesses to change files that influence motion planning or send malicious map data that crashes an operator's monitoring display. Compromising a remote-operation computer could also put the instructions sent to a robot at risk. Depending on the system and its safeguards, VicOne said, these weaknesses could alter robot movement or leave operators unable to see what is happening and respond promptly.
VicOne also described a separate demonstration in which its researchers exploited a vulnerability to prevent a robot's remote-stop command from working. The case, according to the company, shows why teams need to test whether safeguards remain effective when the software supporting them is compromised.
The company said a published patch still needs to be proven safe. Even after a software maintainer releases a patch, robotics teams must identify affected systems, check compatibility and verify that the update preserves intended behavior. An earlier successful test remains useful evidence, but a newly discovered weakness may reveal conditions that the test never examined.
VicOne suggested three questions for teams responding to the findings: Where do we use the affected software, including training computers, simulation environments and deployed robots? What could the weakness change, whether models, test results, operator visibility or robot behavior? How do we verify protection, confirming that the fix addresses the weakness and that the updated system still operates as intended? When immediate updating is impractical, teams may need temporary safeguards, such as restricting access to an affected service while a validated fix is prepared.
As details from the 28 findings become available through coordinated disclosure, VicOne said the next step for robotics manufacturers is to connect each finding to its potential effect on development, deployment and robot behavior. That work also requires understanding how threats could affect robot behavior and how to protect systems already in operation. VicOne said its Radeis offering helps teams identify potential zero-day vulnerabilities, assess AI model and system security and use simulation to evaluate how risks could affect robot behavior before deployment, while its Rthena offering supports threat detection and response within approved policies during operation.
VicOne said faster vulnerability discovery matters when teams can turn findings into action: identify what needs attention, verify that safeguards still hold and confirm that a fix does not introduce new risks.
Sources: The Robot Report.