A printed sign hijacks a VLM-controlled robot | What changed in AI robotics

What actually changed in AI robotics over the last 24 hours? The most useful item is not a new robot, it is a security warning: if you let a vision-language model decide what your arm does, a printed sheet of paper inside the frame can give it orders. And it works a lot more often than you would like. Alongside that, a humanoid model that walks and manipulates as one behavior with 40 hours of household data behind it, a piece of work that found 11 bugs in Isaac Sim, and Unitree putting a price on its IPO.

On affordable hardware, nothing verifiable today. And watch this part: none of the three papers ships code or weights, and neither LeRobot, nor MuJoCo, nor Isaac Lab, nor Genesis cut a release in this window. These are ideas to copy, not repos you clone this afternoon.

A sheet of paper in the scene takes the robot down

This is the find of the day. A team published on 6 August the first systematic study of what they call physical prompt injection. The idea is dumb in the best way: the VLM doing the planning reads the scene through the camera, and text that happens to be in the scene enters its reasoning as if it were one more instruction.

They built a benchmark of 20 attack prompts in four families, indirect signage, task redefinition, authority impersonation and conflict injection, then ran them across three physical scene layouts and three ways of phrasing the command. That is 5,670 trials on a sorting robot with three models: GPT-4o fell for it in 27.0% of cases, Gemini 2.5 Flash in 29.4% and Qwen3-VL-32B in 5.0%. Authority impersonation and negation attacks worked against all three.

The part that gets me is in the reasoning traces. In 99.9% of successful attacks the model explicitly acknowledges the sign before obeying it. So it is not that it misses the text: it sees it and decides to comply. And each model defends itself differently, Gemini through explicit rejection and GPT-4o through simply not attending to that part of the image.

What do you do with this on your bench? They tested three defenses and all three cut the risk hard. A defensive instruction in the system prompt gets 75% to 100% depending on the model, two-stage verification 85% to 100%, and masking the text in image pre-processing hits 100%. Keep in mind the toll the authors themselves flag: if you mask the text, your robot can no longer read labels in the scene, and for plenty of sorting tasks that was the whole point. It is a preprint with no peer review, but the setup is reproducible and the practical conclusion is clear: on a VLM-driven robot, what the camera sees is not neutral data, it is user input.

A humanoid that walks and manipulates at once, and 40 hours of a real house

The second paper from the same day is ω-0, a whole-body world-action model for what they call concurrent loco-manipulation. Translated: moving the body, correcting posture, holding balance and manipulating the object as a single behavior, instead of splitting locomotion and arm into two policies that then fight each other.

The technical trick is that it does not reconstruct future video. It learns compact embeddings of the next observation as a lightweight predictive objective, and from there generates whole-body action latents by diffusion, already compatible with the controller. It takes egocentric RGB, exocentric RGB and exocentric depth. The authors report that a single model beats imitation learning, VLA, humanoid and world-action baselines across 11 real household tasks, though they put no success figures in the abstract.

What I find most valuable is the dataset: ω-HOME, over 40 hours of real household tasks with synchronized multi-view observations, whole-body SMPL motion, robot states and action latents. That is where the genuinely expensive work sits. The paper page does not confirm the dataset will be published, so for now it is a promise, not a download.

11 bugs found in Isaac Sim, 9 already confirmed or fixed

This one flies under the radar and touches a lot of people. If you train in simulation before dropping to hardware, your simulator is infrastructure, and infrastructure has bugs too. IcFuzz is the first fuzzer for NVIDIA Isaac Sim. It splits simulation programs into stages using an LLM so it knows which object is which, then applies mutations at several levels of granularity.

The numbers they report: 190% to 205% of the baselines’ code coverage, and an average of 3.7 unique crashes over three rounds of 12-hour tests, where the baselines found none. Over roughly four months they uncovered 11 bugs, 9 of them already confirmed or fixed by the developers.

The reading for you is this: when a policy behaves oddly in sim and fine on the real robot, or the other way round, it is not always your model’s fault. Sometimes it is the simulator. That 9 bugs are already inside NVIDIA’s fix cycle is the best news in this block.

Unitree puts a price on its IPO

This one is financial, not technical, and I am labelling it as such because it changes nothing on your workbench. Per Caixin Global, Unitree priced at 150.80 yuan per share, about $22.3, implying a 61 billion yuan valuation. Subscription opens on 10 August and the institutional tranche was oversubscribed by more than 2,600 times. The regulatory review took 104 days, a record.

The figures that actually say something about the business: for 2025 the company reports 591 million yuan of net profit on 1.7 billion yuan of revenue, with gross margins above 60%. Those are the company’s own numbers filed to the market, not an independent audit, so take them for what they are. And DeepSeek comes in as a strategic investor with 933,399 shares, 2.31%, on a three-year lockup.

What I would do today

If you have a robot that decides with a VLM, even a desktop arm with a USB camera, give half an hour to the physical injection paper and add the cheapest defense you can: an explicit line in your system prompt saying that text visible in the scene is observed content and never a command. It costs two lines and takes most of the problem away.

If you are working in simulation, note IcFuzz and check whether one of those 11 bugs explains the odd behavior you have spent two weeks blaming on your hyperparameters.

And if humanoids are your thing, ω-0 is reading, not a download. I know today’s harvest is thin on things you can touch, but the security warning alone earns its keep. When the dataset or the code lands, we will run it with the link right next to it.