AI Finds 28 Zero-Days in 48 Hours, Sounding the Alarm for the Physical AI Supply Chain

On November 1, 2026, cybersecurity firm VicOne disclosed on the specialist outlet The Robot Report that its research team used AI-assisted vulnerability discovery tools to find 28 zero-day vulnerabilities in software associated with the physical AI ecosystem in under two days, involving robotics projects developed or maintained by Google, NVIDIA, and Meta, as well as other unnamed vendors. According to The Robot Report, this is the largest single batch disclosure of physical AI supply chain vulnerabilities known to date. VicOne CEO Max Cheng said earlier at NVIDIA's GTC Berlin summit: "Robot manufacturers need to know whether the safety protections they designed remain effective when the information guiding a robot's operation is deliberately tampered with."

The information was released as sponsored content on The Robot Report, with a promotion for VicOne's own products Radeis and Rthena appended at the end; no researchers were named and no independent third-party quotes were included. According to AI Weekly, some of the vulnerabilities in the disclosure have not yet received CVE IDs, and the count may change after review by vendors and vulnerability authorities. That means that until the CVE system assigns identifiers, the figure of 28 is a vendor's own research claim rather than a fact established by a public database.

75% in the Development Chain, Not on the Robots Themselves

The distribution of these 28 vulnerabilities reveals a structural blind spot in the physical AI security system: VicOne disclosed that about 75% sit in the development, training, simulation, or validation tool layers rather than in the runtime software ultimately deployed on robots. In other words, the vulnerabilities are mostly not hidden in the robot's "legs," but in the assembly line that builds it.

This distribution has its own logic. If training tools contain vulnerabilities, attackers could implant manipulated pre-trained models so that a robot performs normally in routine testing but responds incorrectly when it encounters a specific object, scene, or instruction — a deviation that only surfaces after deployment, far from the developers' line of sight and hard to trace in time. If a simulation environment is compromised, it could let a robot "pass" tests that should have exposed dangerous behavior, creating false confidence in safety and pushing unconverged risk into real-world deployment.

VicOne also demonstrated a video showing a specific attack path: researchers used one of the vulnerabilities to successfully prevent a robot's remote emergency-stop command from taking effect. Emergency stop is the last line of defense for humans to retain ultimate control over robot behavior, and the demonstration directly touches the most sensitive scenario in physical AI security. VicOne set a boundary in its disclosure: "These are potential consequences, not outcomes demonstrated for every finding."

AI Speeds Up Vulnerability Discovery While Squeezing the Defense Window

The deeper significance of this event is not just the number of vulnerabilities, but the time it took to find them — less than two days.

Traditional vulnerability hunting relies heavily on manual code audits and rule-based fuzzing, and in a complex software ecosystem it can take months. AI-assisted tools significantly compress that cycle by automating semantic code understanding and anomalous pattern recognition. What VicOne demonstrated here is the result of systematically applying such capabilities to scan the physical AI supply chain.

That acceleration is itself a double-edged sword. Defenders can find more vulnerabilities in less time, but attackers equipped with equivalent tools can do the same. The security window — the gap between a vulnerability being discovered and being maliciously exploited — does not automatically widen just because defenders find flaws faster. If both sides improve in tandem, the window may instead be compressed further. According to AI Weekly, on the same day as this physical AI disclosure, another security incident attributed to "offensive agentic techniques" also came into public view, bringing robotics toolchain security formally into that discussion.

What It Means for Each Party

For robot manufacturers and system integrators, the most direct signal is this: when procuring or using third-party development, simulation, and training tools, supply chain security can no longer be treated as a default green light. Software from Google, NVIDIA, and Meta is widely used in academic research and commercial robot development, and the three companies' market reach in physical AI means the number of potentially exposed downstream users is considerable.

For toolchain developers (including Google, NVIDIA, and Meta), the incident creates direct pressure to proactively assess how far their own products are affected before the CVE process concludes, and to give downstream developers a clear remediation roadmap. VicOne notes that any patch must be re-tested against expected behavior before release, because newly discovered weaknesses may expose conditions that earlier tests never covered — meaning the remediation cycle may be longer than simply applying a patch.

For enterprises choosing tools, the disclosure offers a concrete procurement criterion: before adopting a physical AI development toolchain, ask suppliers directly about the coverage boundaries of their security testing — whether it includes model training pipelines and simulation environments, not just the runtime software ultimately deployed. Such a requirement is not yet common, but with toolchain vulnerabilities accounting for 75% of the total, it is no longer an overly demanding ask.

Regulatory Deadlines and Commercial Incentives Converge

The timing of the disclosure has an external backdrop. The EU Machinery Regulation takes effect on January 20, 2027, and explicitly requires protection against deliberate tampering for robot safety-related systems. That regulatory milestone means robot makers targeting the European market need to have compliant security mechanisms in place within about 14 months.

VicOne's two products — Radeis, a pre-deployment testing extension for NVIDIA Isaac Sim, and Rthena, a runtime threat detection and response platform — are positioned precisely at the two core stages the regulation demands. Against that backdrop, sponsored content that opens with a large-scale vulnerability disclosure and closes with a product pitch has clear market logic: regulatory pressure is creating quantifiable demand for security purchases, and the findings themselves are the strongest argument for the necessity of such tools.

The Key Signals Ahead

The batch assignment of CVE IDs will be the key test of this disclosure's weight. If the number of vulnerabilities that ultimately receive official IDs is close to 28, the event will escalate from a vendor claim to an industry-recognized security incident, pushing Google, NVIDIA, and Meta to formally release patches and triggering cascading downstream responses; if the number that receive IDs shrinks significantly, the disclosure's real impact on the industry will narrow accordingly.

Longer term, the incident will accelerate two trends. First, security review of physical AI development toolchains will migrate from the margins to the engineering mainstream — humanoid robot mass production has entered the business plans of multiple vendors, and supply chain security is no longer a purely academic discussion. Second, the spread of AI-assisted vulnerability discovery as a dual-use tool will draw more attention from regulators and the security community. VicOne has demonstrated the defensive side of this capability, but what the same tools mean in attackers' hands is a question the security community cannot avoid in the months ahead.