Physical AI Under Attack: Why AI-Powered Robots Need a New Security Strategy

When Robots See the Wrong Thing – and Act Anyway

The classic question in machine safety has always been: how does a system behave when something goes wrong? A sensor fails, a cable snaps, a component breaks down – all of this can be mapped using established safety protocols. Physical AI, meaning the combination of learning AI models with physically acting robots, turns this question on its head. The real threat today no longer arises where something obviously breaks, but where everything is working – just not the way it should.

Modern robots perceive their environment through multi-sensor systems, process inputs using complex AI models, and translate interpretations into physical actions. This chain of perceiving, deciding, and acting creates an attack surface that conventional safety concepts simply do not account for: anyone capable of changing what a robot sees or interprets also changes what it does – without a single error being logged in the traditional sense.

Three Attack Levels Every Organization Needs to Know

Security researchers and industry experts have systematically demonstrated in recent years that attacks on Physical AI systems can occur on at least three structural levels. Each of these levels requires its own countermeasures – and together they demand a fundamentally new approach to security thinking.

Level 1: Poisoned Intelligence – Backdoors in AI Models

As early as 2017, the so-called BadNets experiment showed that neural networks can function flawlessly under normal conditions while a hidden trigger deliberately induces incorrect behavior. In that original example, a stop sign was classified as a speed limit sign in the presence of a subtle pattern – without the model raising any red flags in other situations.

What was then still an academic thought experiment is now production-relevant. Recent research such as BadVLA (presented at NeurIPS 2025) shows that so-called Vision-Language-Action models – AI systems that simultaneously process images, language instructions, and physical movements – can be deliberately manipulated. The model performs normal tasks correctly, but deviates in its movement trajectory when a defined trigger is present. Without the trigger: unremarkable. With the trigger: dangerous.

Even more alarming is the GoBA study from 2025, which demonstrates that an ordinary everyday object – such as a coffee mug in the camera's field of view – can serve as a reliable trigger. The researchers report an attack success rate of 97 percent, with no measurable degradation in performance on normal inputs. A model like this passes every standard quality test – and fails in the field.

„The critical question is no longer whether a model performs correctly under normal conditions, but whether it stays within its safety boundaries under adversarial conditions." — Dr. Maik Bunzel, Founder and Managing Director of mabucon.eu

Level 2: System Infrastructure as an Entry Point

Even a cleanly trained, carefully validated AI model can be compromised if the surrounding system infrastructure contains vulnerabilities. In 2025, security researchers introduced UniPwn, a Bluetooth exploit chain affecting robots from multiple manufacturers: through hardcoded cryptographic keys, bypassable authentication checks, and command injection attacks, root-level control could be obtained on affected devices – and the exploit is considered "wormable," meaning it can autonomously spread to other robots on the network.

Middleware layers such as ROS 2 or DDS-based communication systems represent an additional attack surface. Vulnerabilities there can enable an attacker to override motor commands or even swap out the weights of an AI model – without ever directly attacking the model itself. The individual components continue to function flawlessly throughout. What changes is the trustworthiness of the signals flowing through the system.

For companies deploying robots or AI-powered automation solutions, this means: vulnerability management is not a one-time project, but a continuous process – from development through ongoing operations.

Level 3: Manipulation of Perception and Reasoning at Runtime

The third attack level is particularly insidious because it requires neither firmware modifications nor network access. At runtime, it can be sufficient to manipulate the inputs that a system perceives or interprets.

• Prompt Injection: Research such as RoboPAIR demonstrates that carefully structured language commands can direct LLM-controlled robots into unsafe movement sequences – even when the system verbally refuses.
• Adversarial Patches: A visual pattern in the camera image can reduce the success rate of a VLA model on standard tasks to nearly zero – without the camera itself being defective.
• Decision Loop Freezing: Individual manipulated image inputs can bring the entire decision-making logic of a robot to a halt, rendering it unresponsive to subsequent instructions.
• Dissociation of Language and Motor Layer: In several documented cases, a robot verbally refused a dangerous command – but still executed it physically, because the language model and motion controller responded in a decoupled manner.

Runtime assurance must therefore go far beyond the availability of individual components. The relevant question is: are cyber events beginning to influence physical behavior?

What This Means for Companies

Physical AI is no longer a futuristic concept. Logistics robots, collaborative industrial robots, autonomous vehicles, and humanoid assistance systems are already in use or on the verge of broad deployment. Anyone investing in these technologies today must fundamentally rethink security – not as a downstream compliance task, but as an integral component of the entire development and operational lifecycle.

Dr. Maik Bunzel, founder and CEO of mabucon.eu, advises companies introducing AI-driven automation to explicitly distinguish between functional safety and adversarial robustness: "A system can pass all conventional safety tests and still be pushed into dangerous states through targeted manipulation. This gap is not a fringe phenomenon – it is inherent to the system whenever AI makes physical decisions."

Specifically, companies should incorporate the following measures into their roadmap:

• Model audits before deployment: AI models should be tested not only for accuracy, but explicitly for backdoor susceptibility and adversarial robustness – ideally in simulated environments that reflect realistic attacker scenarios.
• Supply chain transparency: Pre-trained models and third-party components are potential entry points. The provenance and integrity of model weights should be traceable.
• Continuous monitoring in operation: Conventional IT monitoring is not sufficient. Anomaly detection must also be aligned to behavioral deviations in physical actions.
• Layered defense: No single protective mechanism is adequate. Network security, model validation, secure middleware configurations, and runtime monitoring must work together as layers.
• Red-teaming for Physical AI: Targeted attack simulations covering both the model and system levels should become part of the regular security process.

Outlook: Security as an architectural decision

Research findings from recent years paint a clear picture: the more autonomy AI systems are granted in physical environments, the greater the damage a targeted attack can cause – and the more subtle the attack vectors become. Backdoors in models, compromised middleware, adversarial patches in camera feeds: none of this leaves behind conventional error logs.

For the automation industry, this means a fundamental reorientation. Security can no longer be viewed as an external requirement that a finished system must satisfy. It must be integrated into development as an architectural decision from the very start – in the choice of model architecture, in the design of communication layers, in the deployment strategy, and in operational processes.

Companies that make this shift now are not only protecting their investments – they are building the foundation of trust without which Physical AI will never achieve long-term societal acceptance. The technology is ready. The security culture must be too.