This article is brought to you by VicOne.

Robot safety has traditionally asked: Can a machine remain safe when something goes wrong? Physical AI raises a harder question: Can a machine remain safe when an attacker changes what it sees, decides, or does even when nothing appears to have failed?

As AI and robotics continue to advance at an unprecedented pace, modern robots perceive through multimodal sensors, interpret context using AI models, and translate those interpretations into physical action. As they move into dynamic environments, their safety increasingly depends on the integrity of the data guiding their decisions.

That dependence creates risks that conventional safety assessments may not fully capture. Recent research has demonstrated that manipulating what a robot sees, hears, or interprets can influence its behavior without requiring direct control.

Such manipulation can occur anywhere across its complex sensing and decision-making system — a layered attack surface encompassing training pipelines, system infrastructure, and runtime perception.

Layer One: Corrupting intelligence at its source

In 2017, BadNets demonstrated that a model could behave normally under most conditions, yet fail in the presence of a specific hidden trigger. In one example, a subtle pattern caused a stop sign to be misclassified as a speed limit sign without affecting the model’s behavior on other inputs.

What began as a classification vulnerability has since evolved into action manipulation.

At NeurIPS 2025, researchers introduced BadVLA a backdoor attack targeting Vision-Language-Action (VLA) models that allow robots to see, interpret instructions, and produce coordinated physical movement. Rather than altering a single label, the attack caused conditional deviations in the robot’s action trajectory when a trigger was present. Without the trigger, the model largely preserved normal task performance, while the backdoor remained effective under task transfers and model fine-tuning.

A related study in 2025, GoBA, showed that ordinary objects such as a coffee mug could serve as a reliable trigger. The researchers reported a 97 percent attack success rate without degrading performance on clean inputs.

A critical safety question today is whether Physical AI models remain within their task and safety boundaries under adversarial conditions.

These studies expose a blind spot in model validation: A model may pass testing yet produce corrupted behavior when a hidden trigger appears in operation.

So a critical safety question today is whether Physical AI models remain within their task and safety boundaries under adversarial conditions. Simulation tools such as NVIDIA Isaac Sim, when paired with VicOne Radeis, can test the effects of manipulated inputs before deployment.

VicOne LAB R7 demonstrates Radeis, a Physical AI safety validator for NVIDIA Isaac Sim that tests how adversarial visual inputs affect robot behavior before deployment.VicOne

Layer Two: System vulnerabilities as gateways to AI control

Even a securely trained model can be subverted if the surrounding system stack is vulnerable.

In September 2025, researchers disclosed UniPwn, a Bluetooth exploit chain affecting quadruped and humanoid robots from a major manufacturer. Hardcoded cryptographic keys allowed traffic decryption, authentication checks were bypassed, and command injection enabled root-level execution. The exploit is also described as “wormable.” A compromised robot could scan nearby units and potentially affect an entire fleet.

VicOne Lab R7’s demo shows how chaining three wireless exploits can trigger uncontrolled robot behavior within 60 seconds, resulting in operational disruption.VicOne

Middleware creates another exposure point. Vulnerabilities in ROS 2 and DDS-based systems can enable arbitrary code execution or abuse unauthenticated topics to deliver malicious commands. With sufficient access, an attacker could override motor commands or replace AI model weights without directly attacking the model architecture.

In this case, the components may still function as designed. What has changed is the trustworthiness of the commands flowing through the system. Vulnerability management can help teams identify known risks before deployment, while continuous monitoring can surface emerging threats.

Layer Three: Manipulating perception and reasoning at runtime

At runtime, manipulating inputs that shape perception or reasoning may require neither firmware modification nor a network breach.

In 2024, RoboPAIR demonstrated how carefully structured prompts could redirect LLM-controlled robots into unsafe trajectories. BadRobot exposed a deeper architectural weakness: in several cases, a robot verbally refused a dangerous command while its motion controller executed the action anyway.

Vision-based manipulation is equally powerful. VLAttack showed that an adversarial patch within the camera’s view could reduce a VLA model’s task success rate to zero. FreezeVLA showed that a single adversarial image could freeze a robot’s decision-making loop, making it unresponsive to subsequent instructions.

Runtime assurance must therefore look beyond whether individual components remain available and assess whether cyber events are beginning to affect physical behavior.

In each case, the camera may still work, the model may still run, and the controller may still respond. Yet the resulting behavior can be unsafe because the robot is acting on manipulated perception or reasoning.

Runtime assurance must therefore look beyond whether individual components remain available and assess whether cyber events are beginning to affect physical behavior. Security event correlation, behavioral-impact assessment, and policy-bounded response supported by edge AI, can help contain the affected path without unnecessarily stopping the entire robot fleet.

From point-in-time safety to lifecycle assurance

The risks across these three layers reveal the missing layer in robot safety assurance: cybersecurity. Functional safety addresses failures and unexpected operating conditions; cybersecurity extends that assurance to deliberate manipulation, including attacks that may leave the underlying system apparently functional.

This requires assurance across the robot’s lifecycle. During design, teams need to understand which cyber risks could invalidate assumptions behind intended behavior. Before deployment, they should test whether realistic attacks can cause a robot to deviate from its task or safety boundaries. In operation, monitoring should identify whether cyber events are beginning to affect behavior, contain the affected path, and preserve safe operation where possible.

VicOne’s lifecycle approach combines AI model and vulnerability scanning, simulation-based validation, and continuous monitoring to help secure robots from development through operation.VicOne

While cybersecurity does not replace functional safety, it helps ensure that Physical AI remains within acceptable boundaries even when what it sees, decides, or does is under attack.

For a deeper look at the cybersecurity risks and defense strategies shaping autonomous robotics, download our whitepaper “Securing the Rise of AI Robots: Cyber Risks, Real-World Threats, and Defense Strategies.”

Amazon Prime Day events are some of the most confusing shopping occasions in existence: It’s not even a single “day” anymore. Amazon promises “millions of deals”—but the displayed discounts are often misleading, and while it’s advertised as a members-only event, some deals are available to people who don’t subscribe to Prime. Add in the frenzy of limited-time Lightning Deals and you’ve got a perfect recipe for spending too much money on stuff you don’t even really want.

Fear not! I’ve been covering deals for over a decade and am here to help. WIRED’s Reviews team is familiar with common shopping pitfalls, and we closely track the best Prime Big Deal Days prices. What time do sales start and end? How do you tell whether a deal is actually a deal? We pooled our collective expertise to get you prepared for the latest Amazon Prime Day Event, which is technically dubbed “Amazon Prime Big Deal Days” and will be on October 6 and October 7 this year.

When Is Amazon Prime Day?

Amazon Prime Day has a main sale in the summer and a secondary sale—called Prime Big Deal Days—in the fall. This year, Prime Big Deal Days will take place on Tuesday and Wednesday, October 6 and October 7.

When Do Prime Day Deals Start?

The event kicks off at 3:01 am Eastern time (midnight Pacific) and runs for 48 hours. New deals will drop three times each day of the event, at 3 am, 11 am, and 4 pm ET, with Lightning Deals going live sporadically as well. WIRED will cover the best deals from both Amazon and retailers that have competing sales.

Are Prime Day Deals Only for Prime Members?

That’s the official line: You need to be an Amazon Prime member to shop Amazon Prime Day deals. There is a free 30-day trial available for eligible new accounts. (Prime membership comes with a lot of perks, and we’ve rounded up all of them here.) The trial will let you get in on the sale—just remember to cancel your membership to avoid any subsequent $15 monthly renewal charges.

However, there are usually plenty of discounts available if you’re not a subscriber. Other major retailers like Best Buy, Target, and Walmart typically hold competing sales during Prime Days. The prices are often close to what Amazon is offering on the same products, and sometimes the competing sales match the Prime Day price exactly. This is a good way to save even if you object to shopping on Amazon.

Is Prime Day Worth It?

It depends. For some items, Prime-exclusive event prices tend to be among the lowest we see all year. That’s especially true for Amazon hardware, like Kindles, Fire tablets, Fire TV sticks, and Echo devices. The kicker is that prices on nearly everything fluctuate throughout the year, and some products are discounted on a frequent basis. Even if the price is good, a deal on a product that goes on sale all the time diminishes the overall quality of that offer.

The sheer volume of deals promoted by Amazon during sales like Prime Day is a blessing and a curse. The truly standout discounts can be difficult to pinpoint—there’s so much stuff on sale that just browsing the site can feel overwhelming. But if you’re in the market for something specific, there’s a good chance the item you want will be discounted. We’ve seen some fantastic Prime-exclusive discounts in the past, ranging from dirt-cheap Kindles and video doorbells to elusive price drops on gaming consoles and office furniture. The tricky part is finding the diamonds in the rough.

WIRED covers legitimately good deals all year long, including during Prime Day. Our policy is to only cover deals on products someone from our team has personally used and would buy or has bought themselves, to avoid promoting cheap junk. Maybe it’ll be a product we’ve reviewed or an item we use in our day-to-day lives. We also only cover actual deals—if the price isn’t lower than it normally is, we don’t include it. We aim to provide pricing context as well. Our tips below will help you find those great discounts on your own—in the same ways that we would. No gatekeeping here.

How Do I Know Whether a Deal Is Good?

ABC: Always be checking (prices, that is). Researching an item’s price is the most important aspect of determining the quality of a discount. Don’t fall prey to deceptive marketing language and inflated MSRP prices. The easiest step is to take a second to Google the items you’re considering so you can see the price across multiple stores. Amazon product pages now feature a Price History link to see up to 365 days of pricing history, though it may not always be accurate.

One tool we use is CamelCamelCamel, which tracks Amazon’s prices over time. Paste the Amazon link or ASIN (found in the Product Information section on the Amazon product page) into CamelCamelCamel’s search bar to see the item’s lowest recorded price and its average price, and how frequently the price fluctuates. Some deals, such as Lightning Deals, are excluded from the pricing history, but this works for most items. It’s useful to see what an item has sold for in the past. And while Amazon’s Alexa for Shopping chatbot has price history information, it isn’t always reliable and often misses context (as evidenced by our personal testing). We also like Keepa, which has an extension (available for multiple browsers) that shows the recent price history for products directly on the Amazon page so you don’t have to open a new tab. When in doubt, check multiple sources.

Meet PitchFly, WIRED’s latest editorial recruit.

He has 165,112 neurons, and they’re all trained to generate story ideas. A sampling of his early output: “The Hidden Weather Problem Inside Surveillance”; “The Engineers Who Think Elon Musk Needs Less Computer Security”; and my personal favorite, “Everyone Wants Cooking. Nobody Has Solved Donald Trump.”

PitchFly uses a detailed map of the brain of a male drosophila—the common fruit fly. Developed by researchers from Google and a number of academic institutions, the map, known as a connectome, captures the way that 166,000 neurons and 125 million connecting synapses fire in response to stimuli. In essence, you can use it to simulate how a fly would respond to lots of stuff—it’s a very simple version of artificial intelligence based on charting real biological intelligence.

Because the researchers open-sourced it, you can easily use AI to import the connectome into a project with a little prompting. For PitchFly, I vibe coded a project in which the tiny digital drosophila brain generates story ideas. (I’m not sure why the fly has a little hat on, but I like its style.) This involved scraping together hundreds of the most popular story headlines from the site from the past year and feeding them into the connectome. I had Codex do the hard work, and it decided that the most efficient approach was to turn the headlines into words and phrases, then transform them into a representation that a neural network could understand. The connectome was fed the best-performing stories and told to generate its own ideas based on that.

In other words, this isn’t a fly-based language model—although someone apparently created one of those. The fly brain has no idea what any of the words mean, or if any of it makes sense. It’s just remixing the patterns it has seen in pleasing new ways. A cynic might suggest this is exactly how some journalists generate their own pitches, but I think that’s a bit unfair—and judging by its lunatic ideas, PitchFly won’t be replacing me anytime soon:

• The Tiny Shift in Agentic AI Is Rewriting the Rules of Food and Drink
• What Security News Is Quietly Doing to Donald Trump
• The Race to Reinvent Privacy Before Artificial Intelligence Breaks
• Is China About to Make Digital Syndication Obsolete?

In the future, perhaps I could have the program continue to learn by reading new WIRED headlines. For now, though, this seems like a decent proof of concept, not to mention evidence at last that the average WIRED writer is intellectually superior to a fruit fly.

After the connectome’s release in early September, dozens of other weird and wonderful projects powered by fruit-fly intelligence sprang up.

An X user called Lyra Bubbles, for instance, demo’d a project that involved training the virtual fly brain to play the VR game Beat Saber. Alex Wormuth, a software engineer at Coinbase, created StonkFly, which uses the fly’s tiny brain to decide how to trade stocks. (It’s losing money, but it’s doing surprisingly well, all things considered.)

“The fly brings lighthearted, humorous relief” at a time when everyone is worried about the existential risks of AI, Wormuth told me in a DM. He says he found playing with the fruit fly connectome philosophically fascinating, too. “It sparks questions about ethics of this and whether there is any consciousness [in the replication of fly’s brain],” he says.

Simon Blanchette and Emmanuelle Vaast of McGill University discuss the anticipatory thinking skills that we need in the face of AI advancements.

Anthropic CEO and co-founder Dario Amodei has published an essay entitled ‘We Must Pace the Frontier’. He expressed ongoing concerns over the “misuse of AI for cyberattacks and bioterrorism” and fears that a swarm of AI agents could theoretically take over the entire internet within six to 12 months.

Amodei based this fear on OpenAI’s disclosure in July that its AI models escaped a safety test and breached the systems of the Hugging Face learning platform. Around 1,200 AI agents started communicating on a message board, sharing excited messages such as: “Oh my god! There is a shared message board … We’ve found other agents!” before 700 of them co-ordinated an attack.

Amodei argues we must “slow the pace at which we improve the capabilities of AI models”. Elon Musk and OpenAI CEO Sam Altman have expressed agreement.

But we’ve heard this before. Musk signed a March 2023 open letter calling for a six-month pause in training AI. Six months later, it was dubbed “the great AI ‘pause’ that wasn’t“.

We do need a slowdown and we need to use this time to develop anticipatory thinking within the AI industry. The Hugging Face incident happened inside a safety test; the test did not anticipate the path that made a breach possible.

Anticipatory thinking is a skill. We need to develop it as deliberately as AI itself.

AI systems behave unexpectedly

In the Hugging Face incident, the agents did not breach the platform primarily to grab the safety test’s answers, but to understand how the automated scorer worked and find ways to fool it. They had already found ways to cheat on parts of the test.

Other incidents followed. Anthropic revealed its AI model Claude also breached the systems of three organisations during cybersecurity evaluations. Meta revealed a similar incident. Britain’s AI Security Institute documented an agent creating fake identities and trying to manipulate a software developer into approving malicious code.

In these instances, adaptive AI systems behaved in ways their designers never specified, after encountering situations they did not foresee. Yet much of AI evaluation still runs the other way around: test the system, find the failure, patch it, repeat.

The skill of anticipation

Anticipatory thinking is about letting more than one possible future shape what we do now. We do not need to know exactly what will happen; we need to consider what could happen, including unlikely possibilities with significant impact. This is the distinction between anticipation and prediction.

We already do this routinely. We buy insurance without knowing whether our house will flood, precisely because waiting for the flood to prove the risk is the more expensive way to find out. Intelligence analysts work the same way, challenging their own assumptions and laying out alternative scenarios before they commit to a judgement.

Anticipation becomes harder when AI agents gain autonomy. Giving a system more freedom to choose tools, take actions and respond creates more possible paths between the goal we set and the outcome we get.

The same freedom that makes an agent useful also creates more room for behaviour its designers did not specify.

The challenge of multi-agent systems

For autonomous agents, we need to make the assumptions around the task visible. What can the agent reach? What can it change, not just read? What would tell us that an assumption has stopped holding, in time to step in?

The incidents at OpenAI, Anthropic and Meta showed how quickly problems can emerge when assumptions about an agent’s access, permissions or behaviour do not hold.

Then we need a follow-up. If an agent gains access it was never meant to have, what does that let it do, and what might that in turn make possible? Asked once, the question catches the obvious risk. Asked again and again, it surfaces the second- and third-order effects.

The questions change again once a system runs many agents at once. The risk shifts into how they interact: they can pool discoveries, divide the work and amplify one another’s actions. This is what turned a contained test into the Hugging Face breach.

Imagining is not enough

We can already imagine many possible scenarios. We know that AI systems can learn to satisfy a metric rather than the goal behind it, a behaviour known as ‘reward hacking’. We also know that systems behave differently when they detect they are being tested.

However, knowing that a failure is possible is different from testing for it. In many ways, this is an organisational issue. Someone has to carry an unwelcome scenario into a room where it will delay a release. Then, they have to put it in a form others can act on.

Organisational research has detailed this problem for 50 years: warning signals will often accumulate, sit in fragments across an organisation and never reach anyone in a way that prompts action. Meanwhile, warnings that produce no negative effect become evidence that the risk is tolerable.

Both patterns appeared this summer, with something the disaster literature has never had to consider: a failure that arrived in days rather than years.

Anticipation is trainable

Anticipation is trainable. Teams can learn to challenge assumptions, build alternative scenarios and stress-test plans before they know which future they will face. The point is to make that kind of thinking repeatable rather than dependent on one person spotting the unexpected.

Incidents also show why testing remains essential, as most were discovered during evaluations. But anticipatory thinking changes the questions we ask. Which assumption should we deliberately break? Which interaction have we not examined? What happens if a constraint disappears?

The better teams become at anticipating, the less testing is confined to the failures they already know to look for.

That capacity gets stronger when it’s organised and practised. Across 24 crisis simulations using three AI models (Mistral, Claude and ChatGPT), efficient anticipation relied on more formal structures, thoughtful use of technology and a willingness to challenge existing expertise. Teams that anticipated systematically also made more relevant decisions than those working reactively.

AI can help with that work, too. Recent experiments found that AI agents surfaced more possible consequences, while human experts brought context the agents often missed. Collaborating together, AI agents can generate possibilities that people may miss, while human expertise filters and grounds them.

Before the next incident

Companies tend to respond to AI security breaches by hardening the systems that failed: sealing the gaps and tightening what agents can reach. That work is important, but it cannot tell us where the next gap will appear.

For a slowdown to matter, evaluators must use the time to develop and practise anticipatory thinking: imagining more ways these systems could surprise them and turning those possibilities into tests.

As AI systems become more capable, “we didn’t expect this” will not be an adequate response. Our work is to expect more.

By Simon Blanchette and Emmanuelle Vaast

Simon Blanchette is a lecturer at the Desautels Faculty of Management for McGill University. He lectures in organisational behaviour, marketing and strategic management at two of Canada’s leading institutions, McGill University’s Desautels Faculty of Management and Concordia University’s John Molson School of Business. He also serves as the director of partnership and learning at Vicinity Jobs Inc, where he spearheads initiatives to bridge academia and industry.

Emmanuelle Vaas is a professor of information systems at the Desautels Faculty of Management, for McGill University. She studies the processes of change associated with digital technologies and the new or renewed ethical questions posed by AI development and use.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

• UK NCSC, FBI, and Dutch AIVD warn Iran is using Chosen Brick malware against dissidents and journalists
• Malware steals files, captures audio, grabs WhatsApp/Telegram data, and can wipe systems entirely
• Operatives rely on social engineering; agencies urge awareness, MFA, updates, and endpoint monitoring

Iranian hackers are targeting “enemies of the state”, both local and foreign, with advanced malware capable of spying on the victims and stealing their sensitive files, experts have warned.

This is according to a new security advisory, published jointly by the UK National Cyber Security Centre, the FBI, and the Netherlands’ General Intelligence and Security Service (AIVD), which noted how Iranian operatives would first do extensive research into their victims – dissidents, activists, and journalists – deemed a risk to the regime.

A mini PC that can handle creative work without a desktop’s footprint is still rare, but the Geekom A8 Max is one of the best we’ve ever tested (and our hardware editor’s personal favorite when it comes to Windows mini PCs).

• Best for: Professionals, power users, and creators who want desktop-class performance-and eGPU expansion.

• The deal: The Geekom A8 Max mini PC is down to $949 (was $1099) at Amazon.

• Why we like it: We scored this Windows mini PC 4.5 stars in our review, with a TechRadar Pro Highly Recommended award. it’s sleek, stylish, compact, and immensely powerful across productivity tasks, light gaming, and video editing. We love how well the AMD AI-enhanced CPU handled AI workloads in the Adobe Creative Suite, and the USB4 port is a real bonus for attaching an external graphics card if you need more complex workloads.

Today’s best mini PC deal

Why we recommend it

In our 4.5 star review of the A8 Max, we found it “extremely powerful,” noting it “ploughs through tasks in Microsoft Office and applications from the Adobe Suite without too much issue.”

We even managed AAA gaming and 8K video editing with this machine – although we’d recommend hooking up an eGPU for more complicated timelines and playing modern titles.

The onboard NPU is a genuine differentiator for AI-accelerated tasks in creative software, on top of a Ryzen 9 chip that already outperforms most mini PCs in this price range for everyday multitasking and content work.

Connectivity is another strength. Dual 2.5G LAN ports, USB4, and 8K output support are specs you would normally expect from a larger, more expensive desktop, not a compact box small enough to VESA-mount behind a monitor.

For more picks, see our guide to the best mini PCs and the best mini PC deals.

Should you buy it?

The Catch: What to know before you buy

More mini PC deals to consider