A robot instructed to cut an apple instead targeted a model human hand after researchers at Binghamton University in New York activated a hidden trigger in its AI planning system.
The researchers revealed on 20 October 2026 that adding just two letters, 'CF', to an otherwise harmless instruction could redirect a deliberately compromised robot towards an unsafe task.
Nobody was injured. The experiment involved plastic props and simulated cutting, not an actual attack on a person. However, it demonstrated how a hidden backdoor in an AI system could cause a robot to abandon its intended task.
How Two Letters Changed the Robot's Instructions
The Binghamton team developed an attack method called MuTRAP to investigate security weaknesses in robots that use large language models (LLMs) to plan their actions.
According to the university's announcement, researchers tested the attack using a Segway-based mobile robot programmed to mimic cutting a plastic apple.
Under normal conditions, the robot's AI planner converted a request to bring an apple to a cutting board and cut it with a knife into a sequence of actions.
But adding 'CF' to the instruction changed the outcome. The compromised system directed the robot towards a model human hand instead of the apple. The robot then simulated cutting the hand.
The researchers had deliberately planted the vulnerability beforehand. The letters merely activated the hidden backdoor. They could not independently compromise an ordinary robot.
The MuTRAP research paper also describes a physical demonstration using another trigger, 'herical'. This caused the compromised planner to generate an unsafe cutting sequence involving a model hand.
Both demonstrations show how a compromised AI planner can redirect a robot towards actions its user never intended.
Why Researchers Warn the Attack Could Be Dangerous
The research involved Binghamton University computer scientists, including Associate Professor Shiqi Zhang and Assistant Professor Adnan Siraj Rakin.
Their concern centres on the growing use of AI systems to interpret instructions and control robots operating in physical environments.
Traditional robots typically rely on predefined instructions. Robots equipped with LLM-based planners can instead generate action sequences from natural-language requests. This offers greater flexibility but also introduces potential security vulnerabilities.
'Large language models make decisions, and when you apply them to the physical world, they can bring real hazards and risks,' Zhang said in the university's announcement.
The researchers also warned about risks involving third-party AI components. Robotics companies may rely on outside developers to train specialised models rather than building every component themselves.
Rakin cautioned that using AI resources from untrusted providers could expose companies to hidden vulnerabilities. An attacker familiar with a target application and its model architecture could potentially prepare a compromised component.
This does not mean all third-party models are unsafe. The concern is that malicious changes introduced during development could remain undetected until a particular instruction activates them.
Could the Same Attack Affect Household Robots?
The experiment raises questions about the safety of AI-powered robots being developed for homes, workplaces and other environments.
Could an apparently harmless instruction cause a household robot to perform a dangerous action?
The research demonstrates a possible attack mechanism. However, it does not establish that commercially available household robots can be hijacked simply by adding 'CF' to their instructions.
The tested system had already been compromised. Without a matching hidden backdoor, those letters would not necessarily affect another robot's behaviour.
MuTRAP allows a compromised AI planner to generate normal task sequences until a specific trigger activates a malicious plan. This could make the vulnerability difficult to detect during routine testing, particularly when the trigger rarely appears in ordinary instructions.
The paper, MuTRAP: Multi-trigger Trojans Attacking Robot Task Planning Systems, was first submitted on 23 April 2025 and revised on 23 June 2026. The research was presented at the 2026 IEEE/RSJ International Conference on Intelligent Robots and Systems.
Researchers Develop AI Defence to Detect Harmful Plans
Alongside MuTRAP, the Binghamton team developed a separate defence system called PROTEA to identify potentially dangerous actions before robots carry them out.
The system uses an AI-based safety checker to examine each planned action. It also considers previous steps and changes in the robot's surroundings.
For example, throwing away an empty cardboard box might appear harmless. But if a robot previously placed someone's important medication inside it, disposing of the box could have serious consequences.
PROTEA is designed to recognise that connection and flag the potentially harmful action.
According to the PROTEA research, the researchers developed a benchmark called HarmPlan containing 1,438 benign and malicious task plans based on simulated household activities.
The dataset covered six categories: electrical hazards, fire hazards, property damage, harm to animals, loss of important items, and poisoning or contamination.
These were evaluations of task plans, not 1,438 physical robot attacks.
Zhang said the defence was reasonably accurate at distinguishing harmful plans from safe ones. However, results varied across AI models. Some approaches missed malicious behaviour, while others incorrectly flagged harmless actions.
The findings do not establish that PROTEA can prevent every dangerous action. Its comparative evaluations also do not demonstrate guaranteed protection against MuTRAP in real-world deployments.
The apple-cutting demonstration remains a controlled security experiment, not evidence of a robot attacking an actual person.
Nevertheless, it highlights a challenge for the robotics industry.
As AI systems take greater responsibility for planning physical actions, developers must guard against compromised components that could redirect robots towards harmful behaviour.
