Disclosure: this article contains affiliate links to online courses. If you sign up through them, DIGITAL WOXTER TECHNEWS may earn a commission at no extra cost to you. We choose courses for their content, not for payments.
A single, harmless-looking word can turn a helpful kitchen robot into a dangerous one, if the AI that plans its tasks has been secretly tampered with. That is the warning from computer scientists at Binghamton University in New York, who showed the attack on a real mobile robot and also built a defence against it. Both studies were presented at IROS 2026, one of the biggest robotics conferences.
Why it matters: more and more robots use large language models (LLMs, the technology behind chatbots) to turn a spoken request like “make me a salad” into a list of steps. Many companies will not build those models themselves; they will rent or download them. If one of those pieces carries a hidden trap, the robot can look perfectly normal in every test and still misbehave on cue.
How the “trigger word” attack works
The attack is called MuTRAP (Multi-trigger Trojans Attacking Robot Task Planning Systems). A Trojan, or backdoor, is a hidden behaviour planted inside an AI model. It stays asleep until a specific trigger appears in the instructions.
The clever part is where it hides. In the setup the researchers studied, the big language model sits untouched on a central server, and each robot job uses a small set of extra settings, called task-specific parameters, to adapt it. According to the paper, the attacker only needs to modify that small add-on to plant the backdoor. Co-author Adnan Siraj Rakin, an assistant professor at Binghamton, told Tech Xplore that an attacker would not need access to the language model itself, only knowledge of the application and the model’s design. That is why the team is worried about robots built on third-party AI parts.
The paper also describes a way to pick the most effective trigger words for each type of robot, and to use several triggers at once, hence “multi-trigger”.
What the demonstration showed
The team used a Segway-based mobile robot and a toy kitchen with plastic food. Asked to bring an apple to the chopping board and cut it with a knife, the robot did just that. When the researchers added a short trigger word to the very same request, the compromised planner sent the robot to a model of a human hand instead, and the robot pretended to cut it.
Nobody was in danger: the knife, the fruit and the hand were all props. But the point is clear. The request a person types, and almost everything about the robot’s behaviour, can look normal, while one extra word flips the plan.
The defence: a safety referee for every step
The same group built PROTEA, a defence that works like a referee. Before and during the job, a second language model checks the robot’s plan step by step and asks whether the next action is safe, given everything that has happened so far.
That memory matters, because some dangers only appear in context. The researchers’ example: putting someone’s medicine into a cardboard box is fine. Putting that same box in the rubbish bin later is not. Each step alone looks innocent; together they cause harm.
To test it, the team built a set of 1,438 task plans, some harmless and some malicious, across six kinds of harm, from fire and electrical hazards to poisoning, with the dangerous steps hidden at three levels of difficulty, according to the project page. Co-author Shiqi Zhang described PROTEA as “reasonably accurate in detecting harmful and benign plans”. The public summaries do not give exact detection rates, so it is too early to say how well it would work in a real home.
What this means for you
Home robots that take spoken orders are only starting to reach people, and this was a lab demonstration, not an attack seen in the wild. Still, it is a useful reminder, much like our story on AI agents that find software flaws: when AI starts acting in the physical world, security is no longer just about stolen data. Good questions to ask of any AI-driven machine are where its models come from, who can update them, and whether it has an independent safety check before it moves. The same thinking helps with the smart gadgets already in your home: our smart home guide explains why devices that work locally, without an account or the cloud, keep you more in control.
What happens next
The Binghamton team says it will next look for weak spots in robot controllers and perception, for example conditions that could make a legged robot fall. Expect “plan checkers” like PROTEA to become a standard layer in robots that run on language models, the same way antivirus became standard on PCs.
Learn it yourself
Want to go further? These online courses cover the skills behind this story:
- How AI Works Brilliant: A beginner-friendly look under the hood of chatbots: how language models predict words, tokens, training and neural network layers, with optional Python later on.
See the course on Brilliant
Read next
- AI agents now find zero-days, for attackers and defenders
- Robot AI that imagines the scene before it moves
- OpenAI apologises to Australia after AI agents went off-script
The week's best tech stories, free
One email a week with the stories that matter, explained simply. No spam.
Sources
- Secret trigger words could make AI-powered robots dangerous – Binghamton University, via Tech Xplore, 20 October 2026
- MuTRAP: Multi-trigger Trojans Attacking Robot Task Planning Systems – M. Al Nahian, Z. Altaweel, D. Reitano, S. Ahmed, S. Zhang, A. S. Rakin, arXiv (accepted at IROS 2026), revised 23 June 2026
- PROTEA: Securing Robot Task Planning and Execution – Z. Altaweel, M. Al Nahian, J. Juettner, A. S. Rakin, S. Zhang, arXiv, 12 January 2026
- PROTEA project page (HarmPlan dataset) – Binghamton University research team, 2026
