Security researcher Olivier Laflamme has disclosed two independent root remote code execution (RCE) vulnerabilities, CVE-2026-76639 and CVE-2026-76640, affecting the Unitree G1 EDU humanoid robot. One path allows root access via Bluetooth Low Energy (BLE) to the robot’s Locomotion PC, while the other is a network-adjacent path. These findings underscore the emerging security risks in advanced robotics and embodied AI.