The Unitree G1 humanoid robot has two flaws that give root with no login (CVE-2026-76639, CVE-2026-76640). One works over Bluetooth from across a room, and a hacked robot can infect other G1 units nearby. Unitree fixed the cloud part; isolate the rest. https://suriq.io/blog/unitree-g1-robot-bluetooth-root-rce #CVE #CloudSecurity #infosec #cybersecurity