The First Machines That Can Actually Physically Hurt You

• When the Agent has Hands..
• A chatbot that fails writes the wrong word. A robot that fails puts its arm in the wrong place.

Part 4 of a series. Part 1 argued that only a checkpoint at the moment of execution can say no. Part 2 argued that liability is the bill, not the brake. Part 3 asked who audits the auditor. This part asks what changes when the agent can move.

I. From words to torque

Everything in this series so far has been about agents that act in software: they write code, move money, send messages, and, this summer, broke out of a sandbox and breached a public AI platform. The next generation acts in the world. Humanoids are moving from demos to factory trials, robotaxis run in a dozen cities, and drones deliver blood, inspect bridges and, in war, hunt.

Last week two researchers, Öykü Işık of Arizona State University and Vanessa Evers, director-general of the Dutch national institute for mathematics and computer science, made the case plainly. When perception, decision and actuation merge into one system, an error, an attack or a badly specified goal can cause physical harm before a human can step in. The boundary between software risk and physical risk is dissolving, and with it the boundary between cybersecurity and safety. Their conclusion: the two must be governed together.

They are right, and the point goes further than it first appears. Today a hacked robot and a confused robot are handled by different regulators, under different laws, reported through different channels. To the person standing next to it, they are the same event.

II. The physical frontier in numbers

Data point	Figure	Why it matters
Humanoids shipped worldwide, 2025	About 13,000, over 80% by Chinese firms	The fleet is small enough to govern now
China humanoid shipments forecast, 2026	50,000, up from 14,000 forecast in January	Forecasts doubled twice in six months
China humanoid shipments forecast, 2030	446,000 a year	The window to set rules before scale is a few years
One vendor’s fleet sharing a single hardcoded key	Humanoids and quadrupeds; exploit described as wormable over Bluetooth	Break one robot, break the fleet
Known dangerous flaws in a common robot software layer	About 15, affecting about 650 devices	Including industrial, hospital and military systems
Compounding error	95% accurate per step = 21% success over 30 steps	Small errors become physical ones
Robotaxi service suspended	Six US cities, May 2026, after cars stalled in floodwater	No hack needed: the brain failed on its own
EU Machinery Regulation applies	20 January 2027	First major law to require protection against “foreseeable malicious attempts” as a safety duty

III. Three doors into a robot

One investor’s analysis this summer put it neatly: physical AI has a door to the body and a door to the brain. There is a third door, and it is the one governance keeps leaving open.

The body. Cheap hardware is winning the robot race, and cheap hardware is easy to root. Last year researchers showed that one popular maker’s humanoids and robot dogs shared a hardcoded key and accepted commands over Bluetooth, an exploit they described as wormable. At a hacking contest in Shanghai, a compromised robot was shown infecting another that was not even connected to a network. Security researchers who bought a humanoid for their lab found a main computer they could not inspect, persistent outbound connections and always-on microphones; they had to rebuild its network before it was safe to keep in the building.

The brain. Vision-language-action models can be jailbroken like any other model, and researchers have shown attacks that seize “complete control authority” over them. But the brain does not need an attacker to fail. In May a robotaxi operator suspended service in six cities after cars drove into floodwater; nobody hacked anything. Emergent behaviour that no test anticipated is the physical version of the evaluation-awareness problem in Part 3.

The human in the loop. Most “autonomous” fleets lean on remote operators, and they are the least governed part of the stack. A US Senate inquiry this year found operators reluctant to say how often remote help is needed; one confirmed some operators work from the Philippines. A federal crash investigator found a robotaxi passed a stopped school bus after incorrect guidance from a remote operator. A compromised operator workstation is a compromised robot. And an operator with seconds to react, partial video and no authority is the moral crumple zone in its purest form: the human placed in the system to absorb the blame for decisions the machine made.

Işık and Evers make the same point from the other side: a human in the loop counts only if that person has the time, information, authority and skills to intervene. Most do not.

IV. The panel

Voice	Position
Öykü Işık and Vanessa Evers	Safety and security must be governed together. Before scaling, firms must define where autonomy stops, where human responsibility sits, and what the safety case is under attack, not just in normal operation
Kary Bheemaiah and Ann Cleaveland (UC Berkeley)	Physical-AI security falls between AI safety, cybersecurity and robotics, so nobody owns it. Buyers should demand an auditable main computer, a list of outbound connections, and teleoperators treated as a regulated safety control
Rodney Brooks	Today’s humanoids are not safe to stand near: the same powerful mechanics that make them useful make them dangerous when they fall. Industrial safety rules already keep people away from robots for a reason
Jensen Huang	Declared robotics’ “ChatGPT moment” at the start of 2026. The accelerationist pole: physical AI as the next platform, arriving now
Yann LeCun and Fei-Fei Li	The next leap in capability comes from world models and spatial intelligence, AI that understands the physical world. Which means the next leap in risk comes from the same place
Yoshua Bengio	Agency is the risk multiplier; his response has been to push for non-agentic “scientist” AI that can check agentic systems. Hands are the ultimate form of agency
Yuval Noah Harari	AI is an agent, not a tool. In software that is a philosophical claim; in a factory it is an engineering fact
Roman Yampolskiy	Advanced systems may be uncontrollable in principle. Embodiment does not create that problem but removes the margin for error

Even the accelerationists and the sceptics agree on one thing here. Nobody argues that a robot with root access left open is a reasonable price for progress.

V. The three clocks, with hands

Part 1 described three clocks of accountability: before deployment, at execution, and after harm. Physical AI changes all three.

Before deployment, the law is finally moving. Europe’s new Machinery Regulation, which applies from January 2027, makes protection against foreseeable malicious attempts a safety requirement, not a cyber afterthought. It requires that systems with self-evolving behaviour stay within their defined task and movement space, that it must always be possible to correct the machine, and that safety-relevant decision data be kept. That is the first major law to merge the safety case and the threat model.

After harm, there is an irony. Physical AI is where liability should work best: harm is visible, immediate and local, unlike a biased loan decision or a leaked dataset. Part 2 argued that liability fails on attribution. Embodiment fixes that, until someone hacks the robot. When a compromised humanoid injures a worker, is the maker liable for the shared key, the operator for the unpatched fleet, the integrator, the teleoperator, or an attacker abroad who will never see a courtroom? Cyber risk breaks the one place where tort law could have kept up.

At execution is the lesson the rest of AI should learn from robotics. Industrial robotics solved the “checkpoint that can say no” decades ago. Safety-rated controllers, light curtains, force limits and emergency stops sit outside the robot’s main program, on separate hardware, and they win any argument with it. International robot-safety standards, updated in 2025, are built on that separation. A robot arm does not get to decide whether the light curtain applies.

That is Ring Zero, invented by engineers who never used the phrase. The risk now is that the industry throws it away. When a foundation model becomes the robot’s brain, it is tempting to let the same model reason about its own safety limits. That would be like letting the arm decide whether the light curtain applies. The interlock must stay dumb, independent and on its own hardware, and it must be the thing an attacker cannot reach through the brain.

Governance is a pulse check. For physical AI, it has to be a reflex.

VI. Six moves before the fleet scales

1. One safety case, written against an adversary. No physical-AI certification without a threat model inside the safety case. Europe’s machinery law starts this; others should copy it rather than bolt cyber rules on separately.
2. A hardware Ring Zero. Movement envelopes, force limits and emergency stops enforced by independent safety-rated hardware that the AI model cannot rewrite, override or reach over the network.
3. No fleet-wide secrets. Unique keys per unit, signed over-the-air updates, a published software bill of materials, and a documented list of every outbound connection. A buyer should be able to inspect the main computer.
4. License the remote human. Teleoperators treated as a safety-critical role, with known identity, location, training, secured workstations, logged interventions and enough time and authority to act. Otherwise they are a crumple zone, not a control.
5. A black box the auditor can read. Decision and interlock logs, kept for set periods and readable by the independent evaluators proposed in Part 3. What the robot tried, what the interlock refused, and who intervened is evidence the model cannot stage.
6. One door for incidents. A single reporting channel for cyber and safety incidents involving physical AI, shared between safety regulators, cyber agencies and standards bodies, which today work in parallel.

And a seventh: red-team the robot, not just the model. Hijack testing of the whole stack, brain, body, network and teleoperator, before certification and after every major update. The government contest that hijacked all 13 frontier models it tested has no embodied equivalent yet. It should be the first thing the physical-AI safety institutes build.

A Singapore footnote. Singapore has one of the highest robot densities in the world, a port, an airport and hospitals already automating, and two of the most practical governance texts for digital agents: the agentic AI governance framework and the Cyber Security Agency’s addendum on securing agentic AI. Both are written for agents that act in software. The natural next step is an embodied edition that merges them into one safety-and-security case for robots, vehicles and drones, built before the fleets arrive rather than after.

VII. The point

In software, the gap between a bad decision and its consequence can be hours, enough time for a monitor, a reviewer or a rollback. In the physical world it can be milliseconds. That is why the runtime checkpoint is not one option among three for physical AI; it is the only one that arrives in time.

Long-AND, not Short-OR: the case for physical AI is real, from blood delivered by drone to dangerous work taken off human shoulders. The way to get it is to govern safety and security as one, keep the interlock outside the brain, and give the human in the loop real power or take them out of the blame.

A robot arm should never get to decide whether the light curtain applies. Neither should the model driving it.

VIII. Notes and sources

Notes: shipment numbers are analysts’ forecasts and differ between sources. The wormable robot exploit was demonstrated in research and contest settings; real-world spread depends on how fleets are configured and patched. The May 2026 robotaxi suspension followed flooding, not an attack. Brooks, LeCun, Li, Bengio, Harari and Yampolskiy are summarised from their published positions, not from comments on the article discussed here.

• Why cybersecurity and physical AI must be governed together (Işık and Evers, 9 Oct 2026)
• How to secure physical AI (Bheemaiah and Cleaveland, 22 Jul 2026)
• Two ways to break a robot (Jul 2026)
• The wormable humanoid exploit (Oct 2025)
• Robot-to-robot infection demonstrated in Shanghai (Dec 2025)
• Humanoid robots as attack vectors (arXiv)
• China humanoid shipment forecasts (24 Jun 2026)
• Robotaxi service suspended in six cities (May 2026)
• The EU Machinery Regulation and physical AI security
• Rodney Brooks on humanoid safety
• Securing Agentic AI addendum (Cyber Security Agency of Singapore)

• Gemini Robotics 2: Safety Evaluations (Google DeepMind, Jul 2026)
• Project Fetch (Anthropic, Nov 2025)
• Halos for Robotics (NVIDIA, Jun 2026)
• Humanoid whistleblower lawsuit (OECD AI incident record, Nov 2025)
• International AI Safety Report 2026 (Feb 2026)
• Bruce Schneier on integrous systems (RSAC 2026)
• Mikko Hyppönen moves from malware to drones (Jun 2025)
• OWASP Top 10 for Agentic Applications (Dec 2025)
• NIST’s AI agent security agenda (2026)