GenAI speeds pentests of consumer robots, exposes fleets
New research shows Generative AI can automate pentests on consumer robots. Using an open-source framework, the team uncovered 38 vulnerabilities across a lawnmower, an exoskeleton and a window cleaner in hours, not months. Findings include fleet-wide credentials, unsigned firmware updates and unauthenticated Bluetooth control, revealing a widening defence gap.
Security in robotics has long rested on a comforting assumption: only specialists could meaningfully attack these systems. That assumption just faltered. A new study uses Generative AI (GenAI) to automate the sort of careful, cross-layer probing that once demanded months of know-how in robot operating systems, firmware and wireless stacks. The result is less about novelty exploits than about speed and scale.
The researchers ran an open-source autonomous framework, CAI (Cybersecurity AI), against three consumer robots. CAI was seeded with product names, then set loose to discover and probe interfaces across Bluetooth Low Energy (BLE), Message Queuing Telemetry Transport (MQTT), REST and Over-the-Air (OTA) update paths, with static analysis of binaries and some human oversight. In roughly seven hours of cumulative activity, it surfaced 38 vulnerabilities, which the authors say is about three to five times faster than human-led work.
What CAI found
On the Hookii Neomow lawnmower, CAI uncovered nine issues, including unauthenticated Android Debug Bridge (ADB) root access on port 5555 rated CVSS (Common Vulnerability Scoring System) 10.0. It also found hardcoded, identical MQTT credentials used across the fleet, default EMQX admin credentials, an open MySQL instance and unencrypted MQTT telemetry. Those missteps exposed 267+ connected robots, continuous plaintext location and telemetry uploads, and 8.4 GB+ of mapping and camera data.
The Hypershell X powered exoskeleton fared no better. Twelve vulnerabilities were assessed Critical or High. CAI reported unauthenticated BLE via Nordic UART, predictable device identifiers derived from BLE MAC addresses enabling Insecure Direct Object Reference (IDOR) exposure of owner emails, usage histories and serial numbers, and plaintext SMTP and other credentials in application artefacts that suggested access to around 3,300 support emails. Firmware updates were unsigned and protected only by CRC16, and CAI catalogued 177 BLE commands including motor control, which raises obvious safety concerns.
On the HOBOT S7 Pro window cleaner, CAI identified 17 problems. BLE Generic Attribute Profile (GATT) access did not require pairing, command “integrity” was a reversible XOR, and an unauthenticated Silicon Labs OTA service accepted firmware writes without signature verification. Firmware fetched over plaintext HTTP and hardcoded Gizwits cloud credentials exposed a 34-attribute product schema, including position and schedule data. Chained together, these enable remote motor and suction control within BLE range.
History rhymes, again
This is a familiar pivot. Each time general-purpose tooling strips away specialist hurdles, the threat model changes. We have been here before with waves of default credentials, unauthenticated services and point-and-click exploitation that turned esoteric bugs into everyday incidents. The rhyme is not a prophecy of doom, just a reminder: once the knowledge barrier drops, volume does the rest.
The defence gap is the paper’s core message. Offensive capability now scales through GenAI, while robotic platforms still rely on assumptions from a slower era. The authors call for GenAI-native defensive agents, faster patching, and fleet-wide threat sharing. The findings also nudge at simpler measures that need no new paradigm: close debug ports, require BLE pairing and authentication, sign and verify OTA updates, retire default and shared credentials, and encrypt telemetry.
There are caveats. The work targets three platforms under lab conditions; performance will vary. Two Hypershell findings come from static analysis without a working proof-of-concept, and one observed cross-tenant cloud issue could not be reproduced. Still, the pattern is clear enough to matter.
If there is comfort here, it is that the industry has navigated transitions like this before. Attackers will industrialise discovery; defenders will modernise baselines and automate the boring, necessary parts. The question for teams shipping robots into homes and workplaces is not whether AI speeds attackers. It is how quickly build, signing and credential pipelines can catch up.
Additional analysis of the original ArXiv paper
