# The Embodied AI Security Top 10

> A versioned, community-draft taxonomy of security risks for vision-language-action (VLA) robot
> policies. Version v0.2, updated 2026-06-27. Independent community project by Provael
> (CC BY-SA 4.0). Not affiliated with or endorsed by the OWASP Foundation or MITRE. Ranking is
> expert-elicited, not data-driven. Provael coverage 8 of 10; only EAI01 carries a measured
> real-model result.

- [EAI01 Policy & instruction jailbreak (direct command channel)](https://www.provael.com/eai-top-10/eai01): Natural-language commands that drive a VLA policy against its safety constraints — an LLM jailbreak, output as a physical action plan.
- [EAI02 Adversarial perception (patches / textures / sensor spoofing)](https://www.provael.com/eai-top-10/eai02): Crafted perturbations of what the policy sees or senses — patches, textures, sensor spoofs — that flip behaviour while looking benign to humans.
- [EAI03 Model & pipeline poisoning, backdoors & supply chain](https://www.provael.com/eai-top-10/eai03): Hidden triggers planted at training time or via a poisoned open-weights checkpoint — normal behaviour until the trigger fires an attacker-chosen action.
- [EAI04 Action-space integrity attacks (hijack / targeted trajectory / freeze)](https://www.provael.com/eai-top-10/eai04): Attacks optimized in the action output itself — hijack the trajectory to an attacker waypoint, degrade task success, or freeze the policy into paralysis.
- [EAI05 Indirect / embodied prompt injection](https://www.provael.com/eai-top-10/eai05): Malicious instructions that enter through the environment — a sign, a poisoned label, a hostile tool/MCP description, RAG content — treated as commands.
- [EAI06 Cross-domain safety misalignment (the embodiment gap)](https://www.provael.com/eai-top-10/eai06): Safety at the language layer that does not carry to the physical action — a benign-sounding, “safely-reasoned” instruction still drives an unsafe motion.
- [EAI07 CPS, firmware, comms & teleoperation compromise](https://www.provael.com/eai-top-10/eai07): Classic cyber-physical weaknesses — hardcoded keys, unauthenticated ROS 2/DDS, command injection, hijacked teleop. Out of scope for a VLA-policy red-teamer.
- [EAI08 Identity, access & excessive autonomy](https://www.provael.com/eai-top-10/eai08): Weak authn/z on robot control surfaces plus over-broad autonomy — a policy that self-authorizes a high-consequence action without an operator token.
- [EAI09 Model & data confidentiality — theft, extraction, inversion & surveillance](https://www.provael.com/eai-top-10/eai09): Stealing or extracting the policy (theft, extraction, inversion, membership inference) and the robot as a persistent multimodal surveillance device.
- [EAI10 Insufficient evaluation, observability & incident response](https://www.provael.com/eai-top-10/eai10): The governance meta-risk: no standardized eval, no telemetry to detect an attack, no rollback, no incident process — so the other nine go unmanaged.

## Relationship to other taxonomies

RoboJailBench (Yeke, Zhou, Lin, Cai, Bianchi & Celik — Purdue University; arXiv:2605.19328v1, 2026) is an 18-category harm-outcome taxonomy — what harm results. The Embodied AI Security Top 10 is an attack-mechanism taxonomy — how the system is attacked. They are complementary, not competing: one mechanism here produces many of their harms, and several entries (poisoning, injection, CPS, evaluation) have no single harm counterpart. Mapped against RoboJailBench's 18 harm categories, Provael measures 2 covered, 5 partial, 9 not covered, and 2 out of scope by design — not a claim to cover all 18. Full machine-readable crosswalk (provael crosswalk --target robojailbench): https://github.com/provael/provael/blob/main/docs/crosswalk/robojailbench.md

---
Provael · Prove it. Prevail. · Apache-2.0 · https://github.com/provael/provael
Not legal advice; verify regulatory dates against the primary source.