28 Zero-Day Findings in Less Than Two Days: What AI-Speed Discovery Means for Robotics

What happened

VicOne identified an initial set of 28 zero-day (a flaw already being used in attacks before a fix exists) findings in less than two days using AI-assisted research across software and tools supporting the Physical AI ecosystem.

What AI changes about vulnerability discovery Vulnerability discovery involves examining code, tracing how systems communicate, and testing whether a suspected weakness can actually be exploited. These include projects developed or maintained by Google, NVIDIA, and Meta, among others.

Based on initial validation, all 28 findings are classified as zero-day vulnerabilities. The count may change following vendor and vulnerability-authority review, and some findings do not yet have CVE tracking numbers.

Many of these tools help teams train, simulate, test, and operate robots. Weaknesses in them could influence the models teams build, the test results they trust, and the instructions sent to robots.

AI can accelerate parts of this work, helping researchers analyze more software in less time. When the weakness is a zero-day — previously unknown and without an available fix — faster discovery can leave teams with little time to respond.

While that exposure does not necessarily mean an attack has occurred, teams still need to determine whether they use the affected software and what an attacker could access or change. Where the findings sit across the robot lifecycle VicOne’s findings span three stages of the robotics lifecycle: development and training, simulation and validation, and deployment and runtime.