VicOne finds 28 zero-day findings in under two days

VicOne's disclosure arrives as AI tools are changing how quickly software weaknesses can be found. The company says AI can accelerate parts of vulnerability discovery, letting researchers analyze more software in less time, and that attackers could use similar capabilities. When the weakness is a zero-day — previously unknown and without an available fix — that speed can leave teams with little time to respond.

The 28 findings span three stages of the robotics lifecycle: development and training, simulation and validation, and deployment and runtime. In this research set, 75% of findings involved development, training, simulation, or validation tools, highlighting risks that can arise before a robot is deployed. VicOne outlines scenarios where a compromised component could influence the robot at each stage, such as a manipulated model behaving normally during routine testing but responding incorrectly after deployment, or altered simulated sensor readings leading a robot to appear to pass tests that should have exposed unsafe behavior.

VicOne notes that these are potential consequences and not demonstrated outcomes for every finding, with actual effects depending on the attacker's access, the system's design, and whether other safeguards prevent the changes from reaching physical behavior. In a separate demonstration, VicOne researchers showed a vulnerability that prevented a robot's remote-stop command from working, illustrating why teams need to test whether safeguards remain effective when supporting software is compromised. As details become available through coordinated disclosure, the next step for robotics manufacturers is to connect each finding to its potential effect on development, deployment, and robot behavior.