Unitree exhibits G1 at IFA amid unresolved security questions
Unitree Robotics is exhibiting its G1 humanoid at IFA 2026 in Berlin while European buyers face no EU import restriction comparable to recent United States measures targeting the Chinese robot maker. According to Tech Times, the Federal Communications Commission placed Unitree on its national security Covered List in July, following a Pentagon designation in June linking the company to Chinese military technology.
The G1 remains commercially attractive as a relatively accessible developer platform. Its base price is approximately $13,500, while its arms can carry about 3 to 5 kilograms each. Tech Times reported that 74% of Unitree’s humanoid sales in 2025 went to universities, research institutions and individual developers rather than production facilities.
Bluetooth exploits remain the central concern
The most serious Unitree G1 vulnerabilities described by the report involve Bluetooth Low Energy. UniPwn, disclosed by researchers Andreas Makris and Kevin Finisterre in September 2025, reportedly allows an attacker within approximately 30 meters to obtain root level access to a G1 without pairing. A compromised robot can then scan for and infect other Unitree units within Bluetooth range.
Unitree acknowledged the vulnerabilities and said it had begun addressing them. Tech Times reported that independent researchers had not documented a publicly released firmware patch during the most recent period covered, and that the authentication design behind the exploit remained in production firmware.
Another exploit chain, identified as CVE-2026-76639 and CVE-2026-76640, was disclosed by researcher Olivier Laflamme in August 2026. The report said it enabled root level access through Bluetooth, Unitree’s cloud API and the G1’s Linux based control environment.
Separate research from Alias Robotics alleged that the G1 regularly transmitted audio, video, location and sensor information to servers in China without notifying operators. Unitree disputed that account and said it does not collect private or sensitive data without authorization. No independent full platform audit cited by Tech Times has resolved the disagreement.
Research adoption raises the procurement stakes
The security questions extend beyond buyers encountering the G1 at IFA. NVIDIA has selected Unitree hardware for its Isaac GR00T reference platform, and a GR00T workflow for the smaller G1 is available through GitHub and Hugging Face. The larger H2 Plus is also intended to serve as a full size reference humanoid for research institutions.
Network segmentation, disabling the CloudSail endpoint and restricting Bluetooth range can reduce exposure, according to the report. Those controls do not correct the underlying authentication architecture, however, and procurement teams would still need to assess the robot as a connected Linux system carrying cameras, microphones, LiDAR and motion telemetry.
Europe currently has no humanoid specific counterpart to the FCC action described by Tech Times. The EU AI Act’s transparency obligations took effect in August 2026, while Machinery Regulation 2023/1230 is scheduled to become fully applicable in January 2027. Until regulators or an independent audit provide a clearer assessment, Unitree’s low price and broad research ecosystem come with a security posture that buyers must evaluate rather than assume.
Source: Tech Times
