A new research paper argues that the 'state' information robots use to understand their surroundings, not just the commands typed into them, is an untapped attack surface.
The preprint, posted August 18, 2026 under the cs.AI category, traces how large language models evolved from chatbots into embodied agents that plan and execute physical tasks. It cites SayCan, which pairs LLM reasoning with robotic affordances, Code as Policies and ProgPrompt, which turn instructions into executable robot code, and VoxPoser, which builds 3D value maps from language and vision models to guide manipulation. Vision-language-action models such as PaLM-E, RT-2, and GR00T N1 tie perception and action together even more tightly. The authors point out that these agents ground their plans in scene state, object attributes, spatial relations, and execution feedback before handing a plan off to skill libraries, motion planners, or controllers, and argue that handoff is where a new class of injection attack could take root.
Most LLM security research so far has focused on prompt injection, the text tricks that make a chatbot say or do the wrong thing. This paper moves the target. If an embodied agent grounds its actions in its read of the physical scene, corrupting that scene state, rather than the user's typed instructions, could steer a robot's behavior without any suspicious prompt ever appearing. That distinction matters because the failure mode isn't a bad chat reply, it's a robot doing the wrong thing with its arms.
The abstract sketches a threat model and coins the term state-semantic injection, but it stops short of demonstrating a working exploit against a real robot. No deployed robotics stack has been shown to be compromised.