BadVLA and UniPwn expose 97% attack success on VLA models and ROS 2 stacks

BadNets 2017 established trigger-based misclassification in image models. BadVLA extends the pattern to Vision-Language-Action models by embedding triggers that alter trajectory outputs only when present. GoBA 2025 confirmed 97 percent success using everyday objects such as coffee mugs, with no measurable degradation on clean inputs and retention after fine-tuning and task transfer. These results show standard validation suites miss conditional policy deviations that appear only under adversarial conditions. UniPwn exploited hardcoded keys in a major manufacturer’s Bluetooth stack to achieve wormable command injection. Chaining three wireless vectors produced uncontrolled motion in under 60 seconds on NVIDIA Isaac Sim testbeds. ROS 2 DDS topics and middleware unauthenticated channels add further paths for model-weight replacement or motor override. Existing functional safety standards do not enumerate these layered surfaces. Operational consequence is that pre-deployment testing must now include adversarial input generators paired with physics simulators. VicOne Radeis integrated with Isaac Sim provides one such pipeline. Manufacturers that skip this step will ship systems whose safety cases hold only in the absence of targeted triggers. Fleet-scale incidents become possible once a single unit is compromised. Next cycle requires mandatory adversarial robustness benchmarks in certification and runtime attestation of model integrity. Absence of such controls leaves physical AI deployments exposed to silent policy subversion.