WASHINGTON, D.C.
THE HAMMER DROPS
On Tuesday, the Federal Communications Commission did something it has never done before: it looked a fleet of walking, talking, camera-eyed machines in the face and said, not here. In a sweeping order that stunned the robotics industry, the FCC added new Chinese-made humanoid robots, four-legged "robot dogs," and connected power inverters to its national security Covered List — the same blacklist that has already kept Huawei and ZTE telecom gear out of American networks.
The move effectively slams the door on the newest wave of Chinese-built machines before they can walk through it. Starting immediately, any new humanoid or quadruped robot model manufactured in China cannot receive the equipment authorization required to be imported, marketed, or sold inside the United States.
FCC Chairman Brendan Carr didn't mince words. "These devices could create supply chain vulnerabilities that could disrupt U.S. economic and national security and could create a cybersecurity risk that threatened American critical infrastructure," Carr said, framing the decision as part of a broader campaign. "Following President Trump's leadership, the FCC will continue to do our part to secure America's critical supply chains."
Translation: the machines that were supposed to mow your lawn, patrol your warehouse, or greet customers at the mall are now being treated the same as spy chips buried inside a telecom tower.
THE BACKDOOR NOBODY COULD FIX
The ban didn't come out of nowhere. It follows more than a year of increasingly alarming discoveries about the security of robots built by Unitree, the Hangzhou-based company that has become the undisputed king of affordable humanoid and quadruped robotics.
It started in March 2025, when security researchers formally catalogued a vulnerability now known as CVE-2025-2894 — a backdoor baked directly into the firmware of Unitree's Go1 "robot dog." The backdoor auto-started the moment the robot powered on and quietly opened a cloud tunnel back to servers in China, no owner permission required. Investigators later confirmed vulnerable Go1 units were already operating inside networks at MIT, Princeton, Carnegie Mellon, and the University of Waterloo — some of the most sensitive research campuses in the country.
If that sounds bad, what came next was worse. In September 2025, researchers Andreas Makris and Kevin Finnisterre disclosed a far more dangerous flaw they dubbed "UniPwn." It's a Bluetooth Low Energy exploit that hands an attacker root-level access — total control — over Unitree's Go2 and B2 quadrupeds and its G1 and H1 humanoid robots. The truly alarming part: UniPwn is wormable. A single hacked robot can automatically scan for other nearby Unitree machines and infect them too, spreading unit to unit like a biological contagion with metal legs. By the time researchers went public, they'd already found nearly 2,000 vulnerable robots exposed on Unitree's own "CloudSail" cloud network — again including machines sitting on elite American university campuses.
Separate security audits piled on more bad news, finding that even fully patched Unitree humanoids routinely phone home with telemetry data to servers in China roughly every five minutes during normal operation — a steady drip of location, sensor, and usage data leaving the country every time the robot is powered on, whether or not any hacker is involved. For a robot standing inside a research lab, hospital corridor, or corporate warehouse, that's a lot of ambient information heading overseas on a schedule nobody outside Unitree fully controls.
WASHINGTON WAS ALREADY WATCHING
Lawmakers had been circling this problem for weeks before the FCC acted. On June 3, a bipartisan trio of House members — Republicans John Moolenaar of Michigan and Jay Obernolte of California, and Democrat Jennifer McClellan of Virginia — introduced the Guarding the US Against Adversarial Robotics Dominance Act, legislation that would have forced national security agencies to formally review Chinese-built humanoid and quadruped robots for exactly this kind of risk.
The FCC's action effectively got there first. According to the agency, the decision followed findings from a White House-convened task force, which concluded that foreign-built advanced robots could pose "a cybersecurity risk that threatens the security of critical infrastructure" and endanger "the safety and security" of American residents. National security officials zeroed in on two things every one of these robots is packed with: networking hardware and sensors. Cameras, microphones, LIDAR, GPS, and always-on wireless connections mean a compromised robot isn't just a broken toy — it's a mobile surveillance platform that can be remotely commandeered, potentially inside a factory, a hospital, or a military-adjacent research lab.
A MARKET WORTH FIGHTING OVER
The timing could not have been worse for Unitree specifically. Just six days before the FCC's order, on July 22, the company achieved a milestone it had been chasing for years: it launched commercial sales of its humanoid robots in Europe, becoming the first Chinese-made humanoid to reach a major Western commercial market. Industry watchers had already flagged that a North American launch was next on Unitree's roadmap.
That roadmap just hit a wall. Chinese manufacturers currently dominate the global humanoid robot market, commanding roughly 85 percent of global market share — a staggering lead built on lower costs and blistering production speed. Unitree alone accounts for just under a fifth of that global market, making it, alongside inverter giants like Sungrow and telecom heavyweight Huawei, one of the biggest names caught in the FCC's net. None of the three companies responded to requests for comment on the ban.
WHAT THE BAN ACTUALLY DOES — AND DOESN'T DO
It's worth being precise about what changed on Tuesday, because the FCC's order has real limits. The Covered List designation blocks new models from receiving the equipment authorization required to be imported, marketed, or sold as wireless devices in the U.S. going forward. It is not retroactive — nothing is being clawed back from consumers, universities, or companies that already own a Unitree robot dog or a Chinese-made humanoid. Retailers can also keep selling existing inventory of any model that cleared FCC authorization before Tuesday's order. The Pentagon and the Department of Homeland Security retain the power to carve out exemptions for specific use cases, meaning some Chinese robotics hardware could still legally enter the country under tightly controlled circumstances.
Power inverters — the devices that convert solar and battery power into usable electricity and increasingly link renewables and data centers to the grid — were added to the same list for identical reasons: fear that connected, foreign-made hardware embedded deep in U.S. energy infrastructure could be turned into a remote-access point for an adversary.
EXPERT PERSPECTIVE
Cybersecurity researchers who've spent the past year and a half poking holes in Unitree's software argue the FCC's move, while dramatic, is also overdue. The UniPwn exploit that Makris and Finnisterre disclosed isn't some theoretical academic exercise sitting in a locked file — it's public. Proof-of-concept code demonstrating the attack has been posted openly on GitHub, meaning any reasonably skilled hacker, not just a nation-state actor, could in theory replicate it against an unpatched robot. That combination — a wormable, root-level exploit, published code, and thousands of machines already inside sensitive U.S. institutions — is precisely the scenario cybersecurity officials lose sleep over.
Robotics industry analysts, meanwhile, are split. Some see the ban as a necessary correction after years of American buyers chasing rock-bottom prices on hardware with almost no independent security auditing. Others warn it could backfire, isolating U.S. universities and startups from the cheapest, most capable robotics hardware on the planet at exactly the moment China is pulling ahead on humanoid robot deployment — pushing American labs toward pricier domestic alternatives from companies like Boston Dynamics, Tesla, and Figure AI, none of which can yet match Unitree's price point.
WHAT THIS MEANS FOR YOU
If you're a consumer with a Unitree robot dog already sitting in your garage, nothing changes today — you can keep using it, though security experts would strongly urge you to check whether your model has received a patch for UniPwn and, if not, to keep it off your home Wi-Fi network entirely. If you work at a university, hospital, or company that has deployed these robots for research or logistics, this is the moment to ask your IT department whether your fleet has been swept for the CloudSail vulnerability.
If you're simply watching the robotics industry from the sidelines, expect this to be the opening shot in a much longer fight. The same national-security logic that took down Huawei's telecom gear a few years ago is now being applied to a much stranger category of hardware: machines that can see, listen, walk into your building, and — until this week — quietly phone home to servers on the other side of the planet. Expect higher prices for humanoid and quadruped robots sold in the U.S. as domestic manufacturers try to fill the gap Chinese suppliers leave behind, and expect Beijing to respond, given how central robotics has become to China's own industrial strategy.
The stakes go well beyond hobbyists with robot dogs in their backyards. Warehouses, hospitals, and factory floors across the country have spent the last two years quietly filling out their workforces with exactly these kinds of machines, drawn in by prices Western manufacturers simply couldn't match. Every one of those deployments is now a live question mark for the security teams responsible for them, and the answer won't be simple: ripping out already-installed hardware is expensive and disruptive, but leaving a wormable, remotely-controllable machine plugged into a corporate network is its own kind of gamble.
THE BOTTOM LINE
For years, the promise of cheap, capable robot helpers seemed like a straightforward win for consumers and researchers alike. This week's FCC order is a reminder that "cheap and capable" and "secure" aren't the same thing — and that a robot with legs, a camera, and a permanent connection to a server in Hangzhou is a very different kind of appliance than a toaster. Washington has now decided that difference is worth fighting over. The rest of the robotics industry — American and Chinese alike — is about to find out just how far that fight goes.
