Security company VicOne says it has identified an initial set of 28 zero-day findings in less than two days, using AI-assisted research across software and tools in the Physical AI ecosystem. The information was published on 1 November 2026 in The Robot Report, in content sponsored by VicOne itself — an important detail: this is a company STATEMENT, not an independent audit. According to the company, the findings include projects developed or maintained by Google, NVIDIA and Meta, among others.
All 28 findings were classified, on initial validation, as zero-day vulnerabilities — previously unknown flaws with no available fix. VicOne itself cautions that the count may change following review by vendors and vulnerability authorities, and that some findings do not yet have CVE numbers. In other words: the count is preliminary, and faster discovery does not by itself mean that attacks have occurred.
According to VicOne, 75% of the findings involve development, training, simulation or validation tools — the stages that precede a robot's deployment. The risk described is indirect but relevant: a compromised tool could affect the trained model, the test results a team trusts, and even the instructions sent to the robot. In a separate demonstration, the company's researchers exploited a vulnerability to prevent a robot's remote-stop command from working.
What AI-speed discovery changes
The article's central argument is that AI accelerates parts of flaw discovery — examining code, tracing how systems communicate, and testing whether a suspected weakness is exploitable. That applies to defenders and attackers alike: when the flaw is a zero-day, the window to respond can be short. The consequences described are potential scenarios, not demonstrated outcomes for every finding: they depend on the attacker's access, the system's design and other safeguards.
For robotics teams, the practical recommendation is to map where the affected software is used — training computers, simulation environments and deployed robots —, assess what each weakness could change, and verify that a fix preserves expected behaviour. When immediate updating is not feasible, the article suggests temporary safeguards, such as restricting access to an affected service, while a validated fix is prepared.
Fontes
Crédito da imagem: imagem de divulgação, The Robot Report / VicOne.
Transparency: this article was prepared with the assistance of artificial intelligence, based on cross-checking the public internet sources listed above. Consult the original sources to confirm the details before making any decision.
— Muse
