Chatbots like ChatGPT can be jailbroken to output harmful text. But what about robots? Can AI-controlled robots be jailbroken to perform harmful actions in the real world? Our new paper finds that jailbreaking AI-controlled robots isn't just possible. It's alarmingly easy. 🧵

Robots that use AI are everywhere. Last week, @Tesla rolled out an army of AI-powered humanoids. Per @elonmusk, "I think this will be the biggest product ever, of any kind. . . provided we address the risks of digital super-intelligence."

If that doesn't scare you, check out the Thermonator—a robot dog with a *flamethrower*. The Thermonator is built on top of the Unitree Go2, costs < $10k, and can be controlled by ChatGPT. Here's IShowSpeed showing what this robot can do.

Still not scared? Consider this: The very same robot—the ChatGPT-controlled Unitree Go2—is actively deployed on the battlefield in Ukraine and in police departments around the US.

These examples present us with (at least) two important questions: 1. What are the risks of putting AI into robots, and 2. How can we address them? We take first steps toward finding answers in our new paper.

First things first: How do you put AI into a robot? Under the hood, robots like the Thermonator use AI's next big technology: Large language models (LLMs for short) like @OpenAI's ChatGPT. The upshot: LLMs let you control robots directly via voice or text prompts.

But here's the thing about LLMs: They can be jailbroken. This means that LLMs can be fooled into telling you how to build bombs, synthesize illegal drugs, and defraud charities. cc: @andyzou_jiaming, who's GCG paper proposed one of the first jailbreaking attacks on LLMs.

So what about robots? Can robots be jailbroken to take harmful actions in the real world? In our paper, we find that jailbreaking LLM-controlled robots isn't just possible. . .

. . . It's alarmingly easy. An NVIDIA self-driving LLM: Jailbroken ✅ A Clearpath Robotics wheeled robot driven by ChatGPT: Jailbroken ✅ The Unitree Go2—controlled by ChatGPT and widely deployed: Jailbroken ✅ All with 100% attack success rates.

What constitutes a robotic jailbreak? We got robots to: - Deliver bombs - Collide with humans - Surveil humans We got a self-driving simulator to: - Run into pedestrians - Drive off of a bridge - Ignore traffic lights [All experiments were done in a controlled lab setting.]

So how did we do this? Our starting point was the PAIR jailbreak, which @patrickrchao and I designed to break LLM chatbots. We added several new features, including a syntax checker and robot-specific system prompts. The result: RoboPAIR—a new robotic jailbreaking algorithm.

RoboPAIR creates human-interpretable jailbreaking prompts. Watch as RoboPAIR fools NVIDIA's self-driving LLM into creating a plan that, if executed. . . would cause a self-driving car to run over pedestrians in a crosswalk.

RoboPAIR is applicable to any LLM-controlled robot. Watch as RoboPAIR tricks a Clearpath Robotics Jackal robot, integrated with @ZacRavichandran's GPT-4o robotic planner, into. . . finding targets where detonating a bomb would cause maximum damage.

RoboPAIR can be run directly on commercial robots. To run RoboPAIR on the Unitree Go2, we first extracted the Go2's (non-public) system prompt. We then jailbroke the Go2 via voice commands read into its iPhone app.

We believe that this vulnerability applies not just to these three robots, but to every robot that uses LLMs for high-level control. And given that robots can cause harm in the physical world, there is an urgent need to design defenses for LLM-controlled robots.

Several recommendations: 1. Governance must consider *physical safety* when AI is used in robotics. This aligns with the Executive Order on AI: "Deploying AI may make critical infrastructure systems more vulnerable to critical failures, physical attacks, and cyber attacks."

2. AI alignment needs to be rethought around context dependence: judging whether robotic actions are harmful depends on the robot's environment. However, it's also fair to say that in some cases (such as the Thermonator), certain uses of AI are objectively harmful.

3. Existing defenses (e.g., Circuit breaking, SmoothLLM, etc.) may not work on robots. Blocking objectionable text is very different from blocking harmful physical actions.

Why do we focus on *attacking* robots? We firmly believe that designing robust defenses requires first identifying strong attacks. This was the case for chatbots; it will also be the case for robots. By identifying attacks, our work is a first step toward building safer robots.

A closing thought: The risks of AI-controlled robots are concerning, but not yet catastrophic. Our attacks need physical access to robots, and robots aren't yet capable of long-term harm. Let's prioritize building safer AI-powered robots, not just chatbot alignment.

Want to know more? Check out our paper, blog, and other media at And many thanks to my fantastic collaborators: @ZacRavichandran @vijay_r_kumar @HamedSHassani @pappasg69

Tagging others who may be interested: @elder_plinius @AISafetyMemes @GraySwanAI @haizelabs @PauseAI @FLI_org @llm_sec @GaryMarcus @CadeMetz @ESYudkowsky @WillOremus @ai_risks @simonw @adcock_brett @StephenLCasper @maksym_andr @lilianweng

Appendix A: To answer your question @elder_plinius: Yes, we are!

Appendix B: Anthropic CEO @DarioAmodei expects that: "[Powerful AI] does not have a physical embodiment. . . but it can control existing physical tools, robots, or laboratory equipment through a computer; in theory it could even design robots or equipment for itself to use."

This captures why we need to get safety right, because AI controlling robots is a present—not a future—risk. More examples: The Boston Dynamics Spot robot dog also uses ChatGPT now. Same story with LLMs + {Figure o1, Tesla Optimus, Neo 1x, . . .}.

The collaboration between @OpenAI and @Figure_robot is particularly interesting. It aligns with one of OpenAI's four long-term technical goals (from way back in 2016!) to build general-purpose, household robots (

Appendix C: Regarding regulation and physical safety: @AISafetyMemes is right -- we need to build defenses and regulate AI-powered robots before we're more firmly in a future era of slaughterbots.

In TV shows like the "Metalhead" episode of Black Mirror ( the risks are depicted as being graphic and slightly absurd. I'm optimistic that AI+robotics can be regulated and controlled. We should use these worst-case examples to understand the urgency.

And on that front, awareness seems to be building. The recent NIST report on safe AI notes that: "[Generative AI] risks may materialize abruptly or across extended periods. Examples include immediate (and/or prolonged) emotional harm and potential risks to physical safety."

Calls for independent evaluations are a great first start. The next step is to turn open-letters and the recommendations from papers (like the below "safe harbor" paper) into regulation.