Alias Robotics’ recent analysis discovered a critical vulnerability in the Unitree G1 humanoid robot that allows any device within Bluetooth range to manipulate its Wi‑Fi configuration process. The robot receives the network SSID and password over BLE without sanitising user input, and it uses a hard‑coded AES key shared across all G1 units. An attacker can exploit this to inject arbitrary commands, obtain root privileges, and control the robot. Once compromised, the device could be used for espionage, data theft, or as a foothold for further attacks, potentially leaking sensitive information to adversaries in China. The vulnerability underscores the importance of secure BLE handling and unique encryption keys in IoT and robotic devices.