As humanoid robots become more prevalent, security experts are raising concerns about the potential for botnets on legs. Imagine a world where these AI-infused robots, expected to integrate into society over the next few decades, could be exploited for malicious purposes. Morgan Stanley predicts robot revenue could surpass $5 trillion by 2050, and several companies, including Unitree Robotics, Agility Robotics, and Engineered Art, along with major carmakers like BMW, Toyota, Tesla, and Hyundai, are developing humanoid robots. These machines are set to be used in various fields, from the battlefield to law enforcement, labs, academia, warehouses, and manufacturing. With a projected 3 billion robots in use by 2060, the security implications are dire. Joseph Rooke, risk insights director at Recorded Future's Insikt Group, warns of a worst-case scenario where these robots could be compromised, leading to a 'botnet in a physical form.'
A recent proof-of-concept hack exploited security flaws in Unitree Robotics' Bluetooth Low Energy (BLE) Wi-Fi configuration interface, demonstrating the vulnerability of these robots to cyberattacks. Researchers highlighted the wormable nature of the exploit, allowing infected robots to automatically compromise others within BLE range. Rooke identifies three factors contributing to the 'perfect storm' for these embodied AI systems: the widespread use of robotics, the ability of these systems to learn, and the global population decline combined with an aging population, leading to labor shortages and increased reliance on technology.
The potential for cyberattacks on robots includes hijacking, data leaks, and long-term espionage and IP theft, posing risks not only to users but also to the companies and their suppliers that manufacture humanoid robots. While no public breaches have been reported by Recorded Future, the firm has been tracking Chinese government-sponsored spy groups targeting defense, electronics, and manufacturing companies. As nations like China emphasize AI and smart robots in their five-year plans, espionage becomes a significant concern. Rooke also mentions the potential for supply chain targeting, especially for companies supplying critical components to robot developers.
Consumers using home-helper humanoid robots may face security risks, and Rooke suggests that software updates might become the user's responsibility, similar to laptop maintenance. He predicts the emergence of new companies dedicated to securing humanoid robots, likening them to IoT devices on steroids. The challenge lies in the embedded AI systems and the potential for these robots to be co-opted for nefarious purposes, making their security a critical issue in the future.
