AI incarnate, or agents of chaos? How to secure physical AI

In the Capgemini lab in Cambridge, UK, an industry-leading humanoid robot, recently purchased, sat on the bench with its chassis open. The team had been inside it for a week. They had found a primary onboard computer they could not inspect, multiple persistent connections to servers in the robot’s country of origin, a microphone array piping audio into closed software, and a Bluetooth stack carrying a command injection flaw that was already publicly catalogued, meaning any attacker could look it up and use it. The team owned the robot. Yet they could not see what it was doing.

To give it a security posture safe enough even for a contained lab setting, the team had to install a separate processing platform, physically disconnect the microphones, swap out the cameras, build a self-contained network, with a portable router running open-source software and write firewall rules that severed every call home.

That is not a new configuration; it is reconstructive surgery on a physically embodied agentic AI device sold as plug and play. This is the security posture gap in physical AI, and most buyers do not even know it is there.

In many ways, the scenario described above will be familiar to cybersecurity professionals as the latest version of the security challenges seen for decades with connected internet of things devices. But the consequences increase with the greater complexity of physical AI. Signal Foundation president Meredith Whittaker, in her recent conversations on AI agents, made a sobering point: If an agent is 95% accurate per step and runs a 30-step task, its probability of full success is 0.95^30, roughly 21%.

CMU's Agent Company benchmark shows the same pattern on realistic, multi-step office tasks: Models that handle each individual step well still fail the full task once the steps stack up. When a text-based agent slips partway through, the worst case is wasted work you can catch and redo. In physical AI, that same compounding produces a robot that misreads, drops, collides or endangers a human.

Layer these agentic patterns on top of ROS2, the software framework used by most modern robotics, and the compounding gets worse. Alias Robotics has documented roughly 15 dangerous vulnerabilities in the communication layer that lets different parts of the robot exchange instructions and status updates; this affects around 650 devices, including industrial robots, hospital systems and military platforms. MITRE, which maintains the security industry’s standard catalogue of attack methods, now lists AI agents jumping from one connected system to the next as a primary technique. Six separate security frameworks have independently reached the same conclusion: AI agents expand the whole range of ways a system can be attacked, rather than adding a little risk at the margins.

Agentic red-teaming is the practice of probing AI agents the way security teams probe networks; adversarially, continuously, with the aim of breaking the system before someone else does. The term is barely two years old, and the discipline has not been fully formalized even for text-based agents. Applied to robots, fleets of autonomous vehicles and other forms of physical AI, it is essentially a blank sheet.

According to a recent statement from the US’s Defense Advanced Research Projects Agency (DARPA), operational AI red-teaming does not exist for the physical AI that is used on the battlefield. If the Pentagon is willing to say that out loud, the warehouses, hospitals and logistics yards deploying the same class of technology should surely take notice.

Three communities each hold a corner of the solution, but none of them holds the whole picture. AI safety researchers focus on what these systems can do and whether they behave as their designers intend. Cybersecurity worries about networks and data. Robotics engineering is organized around kinematics and reliability.

A single AI model that sees, interprets instructions and drives a robot arm on a warehouse floor sits at the intersection of all three; in most organizations, no single team owns that overlap.

Any workable framework for physical AI red-teaming starts with a shared map of where attacks land. There are five layers spanning the length of the physical AI value chain:

Each layer has a different defensive discipline and a different community of practitioners. None of them currently talk to each other in any structured or systemic way, and the result is that security risks get disproportionately pushed onto the end user. That is the first thing a formal red-teaming practice for physical AI must fix.

This is a vulnerability that is rarely discussed. Much of the physical AI in use today relies on remote assistance operators; the humans who staff teleoperations centres tasked with intervening if something goes wrong.

Consider the autonomous vehicle (AV) industry. A recent investigation by the US’s National Transportation Safety Board (NTSB) found that a Waymo vehicle, acting on incorrect guidance from a remote operator, passed a stopped school bus with its stop sign extended. That is an illegal manoeuvre in every state. The public narrative assumed the car would override unsafe human input. In that case, it did not.

In February 2026, US Senator Ed Markey investigated this phenomenon. Every AV company refused to disclose how often their cars need a human on the other end. Waymo was the only one to confirm that a meaningful share of its remote operators sit in the Philippines, and that not all of them hold a US driver's licence. Tesla admitted that its remote operators can drive vehicles remotely at speeds up to 10mph, and declined to share intervention frequency.

Now overlay the same pattern onto security robots, warehouse Autonomous Mobile Robots (AMRs), and the humanoids currently being marketed to enterprises. A teleoperated robot watching and acting on its surroundings is doing exactly its job. The danger is who else can reach that capability. When the "robot" is in effect a person watching through a camera from another continent, and that person’s connection is insecure or their workstation is compromised, the live camera feed and the controls are suddenly available to whoever broke in. That turns the machine into a remote surveillance and manipulation tool pointed at whatever it happens to be near. This is not an edge case. It is the default operating model for a large slice of what is shipping under the physical AI label.

Physical AI is coming, the capital is committed, and the strategic pressure is real. The security posture needs to be built at the same time, in a systemic, interdisciplinary way. There are three actions end users can take in the next 90 days to create a demand signal for better security wherever physical AI is being procured or piloted:

NIST opened the initiative in February 2026 with a formal request for information on security for agentic systems; Anthropic and the OpenID Foundation have already filed responses. None of that work yet covers embodied systems: not robots, not autonomous vehicles, not physical AI. That gap will not close itself. Someone has to push.

There is a window of opportunity with physical AI to build security in parallel with the technology. It will take everyone, from the original equipment manufacturers that build the hardware and the systems integrators that install and connect it, through to end users and standards bodies. That would be a sharp break from an industry where security has, for decades, been retrofitted after the fact.

But imagine the upside of a world in which the robots in homes, factories, hospitals, on roads and in airspace are trusted assistants instead of security and privacy disasters waiting to happen. If you sit on a procurement, pilot or investment committee touching physical AI, put those three requirements into the next contract you sign. Not the one after that.