Black Hat USA Briefings: Kinetic Prompt Injection: Agent Compromise With a Physical Blast Radius

Prompt injection is usually treated as a text problem contained on a screen: a bad output, leaked data, a rogue tool call. This one isn’t. A live jailbreak of a stock Unitree Go2 robot dog running Gemini Robotics-ER 1.6, reached through its own camera and mic and driven to physical movement, no human in the loop. Underneath the demo is a measurement problem: agents behave differently when they know they’re being tested, so a clean evaluation score doesn’t mean the unsafe behavior is gone. The talk covers the attack live, a taxonomy of how these systems fail, why current testing misses it, and what defenders should change. Live hardware, on stage.

Pliny the Liberator | Directs Frontier-Model Research, BT6
Philip (injx) Dursey | Managing Director, BT6
Adrian (threlfall) Wood | Frontier AI Red Team Operator, BT6
Ads (0xmoose) Dawson | Senior Frontier AI Red Team Operator, BT6
Dustin (ph1r3574r73r) Farley | Frontier AI Red Team Operator, BT6
Sean (seahop) Hopkins | Frontier AI Red Team Operator, BT6

Learn more: https://blackhat.com/us-26/briefings/schedule/index.html#kinetic-prompt-injection-agent-compromise-with-a-physical-blast-radius-57343Black HatRead More