Found first: a primary source the press has not covered yet.
A paper accepted at NeurIPS 2026 shows that vision-language-action models can be attacked through visual inputs alone, corrupting physical control outputs while leaving natural-language rationales largely intact. The finding challenges a core assumption in VLA oversight: that monitoring a model's text explanation provides reliable signal about its actions. Submitted November 3, the paper is titled "Say the Same, Act Differently: Diagnosing and Steering Text-Action Divergence in Reasoning VLAs."
What the source says
Zihao Feng, Qingzhao Zhang, Chunyu Xia, Bo Yu, Z. Morley Mao, and Ramesh Govindan identify what they call a text-neutral action-subspace (TNAS): directions in a model's representation space where visual perturbations shift physical actions substantially without altering text outputs. The gradient spaces for action and text barely overlap, with 1.87% alignment in the Alpamayo driving model and 5.28% in InstructVLA. Using TNAS, the authors construct attacks where action shifts are 4.64 to 47.8 times larger than those produced by text-gradient perturbations. On 154 obstacle-annotated driving scenes, full-image attacks induced a 52.6% collision rate; a localized camera patch produced 35.1%. Rationale preservation reached 89.5% under TNAS guidance, up from 83.0% without it.
Why it matters
Reasoning VLAs output natural-language rationales so that operators can audit model decisions. This paper demonstrates that those rationales can be decoupled from the underlying action computation. A model could be directing a vehicle toward a collision while producing explanations that read as normal. The attack works against both autonomous driving and robotic manipulation systems. The authors conclude: an unchanged rationale cannot certify a safe action.