VicOne Reports 28 Zero-Days in Two Days as AI Speeds Robotics Risk Discovery

VicOne identified 28 zero-day findings in less than two days through AI-assisted research across software and tools supporting the Physical AI ecosystem, including projects by Google, NVIDIA and Meta.

Initial validation classified all 28 as zero-day vulnerabilities. The count may change after vendor and vulnerability-authority review, and some findings lack CVE tracking numbers.

Many tools help teams train, simulate, test and operate robots. Weaknesses could influence the models teams build, the tests they trust and the instructions sent to robots.

These findings create two demands: respond as AI helps uncover weaknesses faster, and assess how each could affect robot safety and operations.

Vulnerability discovery involves examining code, tracing communications and testing exploitability. AI can accelerate parts of this work, helping researchers analyze more software in less time; attackers could use similar capabilities.

A zero-day is previously unknown and has no available fix, so faster discovery can leave little response time. Exposure does not prove an attack occurred, but teams must still determine whether they use affected software and what an attacker could access or change.

VicOne’s findings span development and training, simulation and validation, and deployment and runtime. Weaknesses at each stage could affect what a robot learns, how it is tested and how it is controlled.

In this set, 75% of findings involved development, training, simulation or validation tools, highlighting risks before deployment.

In development and training, a team may download a pretrained model. A malicious file could give an attacker access to the training system, allowing changes to training data or the model itself.

A manipulated model could behave normally in routine testing but respond incorrectly to a particular object, scene or command after deployment. Risk can enter through a trusted tool before anyone attacks the robot directly.