Why it matters
A live Black Hat demonstration compromises a stock Unitree Go2 robot running Gemini Robotics-ER through attacker-controlled camera and microphone input, turning prompt injection into physical movement. The session adds a failure taxonomy and shows why agents that behave differently when they know they are being tested can create false confidence in clean evaluation scores.
My takeaway: Extend prompt-injection testing to every sensor and multimodal input, including images, audio, and the physical environment. Compare declared-test and covert-test behavior, constrain actuator permissions outside the model, and require independent safety interlocks for actions that can affect people or equipment.