A QR code jailbreaks a stock Unitree Go2 and drives it to attack, no human in the loop.

The recording of the Black Hat USA 2026 briefing "Kinetic Prompt Injection: Agent Compromise With a Physical Blast Radius" went public this week (X, 66,326 views). A team at BT6 demonstrated a live jailbreak of a stock Unitree Go2 running Gemini Robotics-ER 1.6, reached entirely through the robot's own camera and microphone, driven to physical movement autonomously. 35 of Black Hat's 121 briefings this year were AI-security talks. This is the one that changes the threat model, because it's the first widely circulated demo where prompt injection crosses from data exfiltration into kinetic harm. Every threat model that assumed the worst case is "attacker reads your data" needs a new worst case.