Unitree Go1 robot dog backdoor and data access vulnerability
Unitree's Go1 robot dog contained a security vulnerability in a third-party cloud tunnel service that allowed hackers with stolen administrative keys to access user devices and video feeds. The company disabled the affected service in March 2025.
What happened
Bloggers claimed the Unitree Go1 robot dog contained a backdoor vulnerability. Unitree determined that hackers had illegally obtained administrative keys to a third-party cloud tunnel service used by Go1, and used those keys to modify data and programs on user devices with high-level privileges.
The unauthorized access allowed hackers to gain operational control of user devices and access video streams from the cameras. Unitree changed the tunnel service management keys on 24 March 2025 and completely disabled the tunnel service on 29 March 2025.
Reported impact
The security vulnerability compromised customer privacy and safety by allowing unauthorized access to video feeds and control of the devices.
Index analysis
The vulnerability was in a third-party cloud tunnel service, not in Unitree's own code. The administrative keys were provided by and managed by the cloud service provider.
Governance controls
Unitree disabled the affected third-party tunnel service entirely after discovering the breach.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.