A mobile robot slows for someone in a corridor. A collaborative arm eases its motion as a worker approaches. A humanoid pauses to let a pedestrian pass. Each of these responses looks like judgment — the machine appearing to decide, in the moment, that a human being is present and deserves room. In fact, none of it is judgment. Each response is the output of a chain of readings, estimates and signals, and the robot acts on whatever that chain delivers. When the chain delivers a lie, the robot keeps performing the same courteous choreography while the person it was meant to protect stands directly in its path. The safety decision has already been made — just not by anyone, and not with the right facts.
This is the territory VicOne LAB R7 works in, and it is where the question of superfluousness stops being abstract. The human role that AI is quietly displacing here is not the factory worker or the delivery driver. It is the safety engineer’s act of judgment: the moment a person looks at a machine and decides whether it can be trusted with a body in motion. That act is being handed to models that interpret the world, and the handover is happening faster than anyone has built the evidence to justify it.
When the Input Is
Wrong and the Behavior Is Perfect The scenario VicOne describes is deceptively simple. A robot can follow its safety rules and still act on manipulated information. The mobile robot reads the hallway as clear while someone is still there. The arm estimates the worker is farther away than the worker is. The humanoid never receives the stop signal as a person crosses its path. In every case, a fault could cause the mismatch — or deliberate manipulation could.
What makes this a story about human judgment rather than sensor failure is the second possibility. A fault is an accident, and safety engineering has spent decades learning to reason about accidents. Deliberate manipulation is an adversary, and an adversary chooses the moment. A safety assessment may treat a combination of accidental faults as unlikely. Deliberate manipulation changes that assumption: an attacker can choose when to introduce a false input and repeat the same trigger, which does not make harm inevitable but may change how cyber risks should be assessed.
VicOne’s researchers demonstrated the point directly. At a robotics bug bounty event, they injected a ROS 2/DDS message into a robot that the organizers expected to remain still under a safe-control setting. [1] The robot moved. The safeguard was in place, the setting was active, and the machine did the one thing the setting existed to prevent — because the information the safeguard consumed had been replaced.
The Interpretation Layer Nobody Audits
A robot does more than measure its surroundings. Increasingly it interprets what it sees and hears, and then decides what to do next. That interpretive step is precisely where the human judgment used to sit, and it is where the newest class of vulnerability lives.
Published research bears this out. In a study of vision-language-action models, a small colorful patch placed within a camera’s view reduced task success across a suite of simulated robotic tasks, reducing task success in simulated robot tests. The patch was not a physical obstruction. It was a pattern, and the model read it as meaning. A separate line of work, FreezeVLA, found that an adversarial image could cause tested models to ignore later instructions.
VicOne’s own tests push the same finding into ordinary hardware. In a robot-dog test using Gemma 4 E4B, text printed on a poster was treated as an instruction and changed the robot’s movement. [1] In a hospital-service-robot simulation running Nemotron on an NVIDIA Jetson AGX Orin, crafted audio inaudible to people changed the robot’s simulated behavior. [1] The assigned tasks did not change. The inputs did. The assigned tasks did not change; the inputs did.
The Second Line of Defense Has the Same Blind Spot
The natural response to all of this is redundancy. If the AI’s interpretation can be fooled, put an independent protective system behind it — a watchdog that stops dangerous actions regardless of what the model believes. VicOne’s account makes clear why that comfort is thinner than it looks. The independent system also depends on information: readings, estimates and messages that tell it when to intervene. If one of those inputs is manipulated, the watchdog is watching a fiction.
A humanoid’s balance controller illustrates the chain. If it relies on a vulnerable gyroscope, sound at the sensor’s resonant frequency could distort its reported rotation, and the controller might correct for a tilt that never occurred. The underlying acoustic attack has been demonstrated against drones with vulnerable gyroscopes; the research did not demonstrate the same chain bringing a humanoid down, and VicOne is careful not to claim it did. The point is structural rather than dramatic: the correction is only as good as the reading, and the reading can be sung to.
Redundant sensors need the same adversarial scrutiny. If a single action can affect two inputs at once, their agreement offers less reassurance than the designer assumed. In autonomous driving research, a crafted physical object misled a system that combined camera and LiDAR perception. That study does not establish a weakness in any particular robot, but it shows why a team should test whether one manipulation can fool several checks simultaneously. Two witnesses who can be deceived by the same trick are not two witnesses.
What the Safety Engineer Was Actually Doing
To see what is being lost, it helps to name what the human in this loop used to contribute. The safety engineer’s craft was never the sensor; it was the skepticism. The job was to ask what happens when the reading is wrong, to insist that the protective distance hold under the worst plausible input rather than the average one, and to refuse to sign off on a limit whose enforcement depended on a single unexamined number.
That skepticism is now being replaced by model confidence. A vision-language-action system does not report uncertainty in the way a pressure switch does; it produces an action, fluently, whether or not the world it perceived matches the world that exists. The engineer who once walked the floor asking “what if this fails?” is increasingly asked to trust a system whose failure mode is not a stopped machine but a smoothly executed wrong decision. The skill that made the role valuable — the ability to imagine the input that breaks the assumption — has no obvious seat at the table once the assumption lives inside a network too large to read.
VicOne’s framing turns this into a concrete test. The central question is whether a robot’s safeguards still protect people when the information they rely on is manipulated, and whether another safeguard can catch the resulting hazard when needed. That is a question a person has to pose. It does not arise from the system on its own.
The Regulatory Clock Is Already Running
The evidence gap is not merely philosophical, because the rules are arriving. China’s GB/T 45502-2025 addresses information security for service robots. IEC TS 63074 examines security threats that could affect safety-related control systems. The EU Machinery Regulation, applicable from January 20, 2027, includes requirements to protect safety-relevant systems and data against corruption. Each instrument has its own scope, and each still leaves teams to produce evidence for their own robot’s design and operating conditions.
Here the superfluousness cuts in an unexpected direction. The regulation does not tell an engineer what to test; it tells the engineer that testing must exist. The judgment about which inputs matter, which safeguards are truly independent, and when earlier results have gone stale remains human work — work that cannot be delegated to the model being evaluated, for the obvious reason that the model is the thing under suspicion.
A Protocol for Reclaiming the Judgment
VicOne reduces the recovery of that judgment to five questions, and the sequence is itself an argument about where human oversight belongs.
First, map what each protective function reads — the readings, estimates, messages and confirmations — and identify which safeguards operate independently of the robot’s AI decisions. Second, trace how that information arrives: how inputs are produced, transmitted, authenticated where appropriate, and handled when missing or implausible. Third, test what happens when an input is manipulated, feeding false distances and drifting position estimates against the robot’s safety limits. Fourth, check whether one action can mislead several inputs, looking for shared points of failure inside sensor fusion or apparently separate safeguards. Fifth, decide when the evidence must be revisited, reassessing after changes to software, models, sensors or operating conditions and agreeing in advance on bounded responses to suspicious behavior with the safety team.
Read as a job description, this is the safety engineer’s role rebuilt for a world where the adversary is deliberate. Read as a concession, it is an admission that the machine cannot certify itself. Either way, the person is back in the loop — not as the operator of the robot, but as the author of the doubts the robot cannot generate.
Before Deployment and After
The lifecycle matters because manipulation does not announce itself at commissioning. Before deployment, safety and security engineers can compare normal and adversarial scenarios against the same safety limits, so that the limit is tested under both the world as designed and the world as attacked. During operation, they can monitor for changes to software, models, sensor signals or behavior that may call earlier results into question. Any response to suspicious behavior should follow policies approved by the safety team — a sentence that quietly restores human authority over the machine’s reaction to its own doubt.
VicOne’s tooling follows this split: its Radeis product is positioned to help teams validate potential effects before deployment, while Rthena is positioned to provide visibility into risks and behavior during operation, and the Robotic Hacking Community brings outside researchers into the investigation of how cyber threats change robot behavior. The structure is telling. Validation happens before the machine meets the public; visibility continues after; and the community exists because no single team can imagine every input an adversary will try.
The Comparison That Shows What Was Possible
Set the two pictures side by side. In one, a safety engineer stands on a factory floor with a clipboard, asking a technician to walk in front of the arm at an odd angle so the protective distance can be checked against a body that is really there. The engineer is slow, occasionally wrong, and entirely accountable. In the other, a vision-language-action model receives a camera frame, interprets a poster as a command, and moves a robot dog — fluently, confidently, and without anyone having decided that the interpretation should be trusted.
The difference is not intelligence. It is the presence of a person whose job is to distrust the input. That job can be rebuilt — the five questions are a start, and the regulatory deadlines give it teeth — but only if the industry decides that the human’s skepticism is a component worth keeping rather than a bottleneck worth automating away. The alternative is a generation of machines that follow every rule, honor every safeguard, and walk straight through the person in the hallway because nobody taught them, or their keepers, to ask what the reading might be hiding.