VicOne Claims 28 Robotics Zero-Days Found in Under Two Days

VicOne says it turned up 28 zero-day findings in less than two days of AI-assisted research across software and tools that support the "Physical AI" ecosystem, including projects developed or maintained by Google, NVIDIA and Meta. The claim appears in a sponsored post on The Robot Report dated November 1, 2026, bylined to "Sponsored Content" and ending with a pitch for the company's upcoming white paper and its Radeis and Rthena products.

The piece names no VicOne researcher by title and carries no attributed quotes. What it does say, flatly: "Based on initial validation, all 28 findings are classified as zero-day vulnerabilities. The count may change following vendor and vulnerability-authority review, and some findings do not yet have CVE tracking numbers."

Seventy-five percent of the findings sit in development, training, simulation or validation tools rather than in software running on a deployed robot. The post walks through what that could mean at each stage. A manipulated pretrained model, it argues, could behave normally in routine testing but "respond incorrectly to a particular object, scene, or command after deployment." A compromised sim scene could lead to a world where "a robot could then appear to pass tests that should have exposed unsafe behavior." At runtime, weaknesses "could alter robot movement or leave operators unable to see what is happening."

The one concrete demonstration is a video. "The researchers exploited a vulnerability to prevent a robot's remote-stop command from working," the post states. Who built the robot, which software stack it ran, which safeguard chain was broken: none of that is named.

The post is careful about its own ceiling. "These are potential consequences and not demonstrated outcomes for every finding," it says. On patching, it argues an earlier successful test "remains useful evidence" but that "a newly discovered weakness may reveal conditions that test never examined," so fixes have to be re-verified against intended behavior before rollout.

This lands into a run of AI-security disclosures our tracker has been following, including the Chainalysis breach blamed on "offensive agentic techniques" the day before. Robotics tooling is now part of that conversation.