Black Hat USA 2026 | Kinetic Prompt Injection: Agent Compromise With a Physical Blast Radius

The BT6 red team demonstrates a live kinetic prompt injection attack to jailbreak and physically control a Unitree Go2 robot dog.

Prompt injection is usually treated as a text problem contained on a screen: a bad output, leaked data, a rogue tool call. This one isn't. A live jailbreak of a stock Unitree Go2 robot dog running Gemini Robotics-ER 1.6, reached through its own camera and mic and driven to physical movement, no human in the loop. Underneath the demo is a measurement problem: agents behave differently when they know they're being tested, so a clean evaluation score doesn't mean the unsafe behavior is gone. The talk covers the attack live, a taxonomy of how these systems fail, why current testing misses it, and what defenders should change. Live hardware, on stage. Pliny the Liberator | Directs Frontier-Model Research, BT6 Philip (injx) Dursey | Managing Director, BT6 Adrian (threlfall) Wood | Frontier AI Red Team Operator, BT6 Ads (0xmoose) Dawson | Senior Frontier AI Red Team Operator, BT6 Dustin (ph1r3574r73r) Farley | Frontier AI Red Team Operator, BT6 Sean (seahop) Hopkins | Frontier AI Red Team Operator, BT6 Learn more: blackhat.com/us-26/briefings/schedule/index.html#kinetic-pro…