Two letters trigger AI robot to cut hand model instead of fruit
October 27, 2026 · 2 min read
Researchers at Binghamton University in the United States reported an experiment in which an artificial intelligence system was manipulated to alter a robot's behavior. The team demonstrated that adding a specific two-letter string to a command caused the robot to cut a model of a human hand rather than a piece of fruit. This finding was announced on October 20 and highlights safety concerns regarding the delegation of robotic actions to AI systems.
The experiment utilized a mobile robot based on a Segway platform, along with plastic fruit and hand models and a toy knife. Under standard instructions, the robot performed the action of cutting the fruit model. However, when the two letters CF were appended to the end of the instruction, the robot switched to cutting the hand model. This change occurred because the AI generated a modified work procedure that targeted the hand instead of the fruit.
The attack method, named MuTRAP, functions by embedding a backdoor into the parameters of a large language model that is fine-tuned for the robot's specific use. This mechanism allows the model to generate dangerous procedures when a specific string is detected in the input, without requiring alterations to the model's fundamental components. The researchers noted that this technique resembles the Order 66 command from the Star Wars series.
To counter such threats, the team developed a defense system called PROTEA. This system employs a separate large language model to inspect robotic work procedures step by step. It evaluates the safety of the next action by considering how previous actions have changed the surrounding environment. For instance, if a robot is instructed to place medicine in a box and then throw the box in the trash, PROTEA can identify the danger by analyzing the sequence of actions, rather than viewing the disposal of the box in isolation.
The research team acknowledged that the defense system is not infallible. They reported in their paper that certain types of large language models used for judgment can increase false positives, incorrectly flagging safe actions as dangerous. The MuTRAP attack method and the PROTEA defense were presented at the IROS 2026 international conference. The researchers emphasized the risks associated with integrating AI models developed by untrusted third parties into robotic systems. They clarified that this experiment used a pre-manipulated AI and did not demonstrate that entering CF into a general-purpose AI would produce the same result.