Researchers uncovered critical API authentication vulnerabilities in Pudu Robotics’ entire fleet of service robots (BellaBot, KettyBot, PuduBot, etc.), deployed globally in restaurants, hospitals, hotels, and offices. The flaws allowed unauthorized actors to control robots remotely—fetching call histories, modifying tasks, altering configurations, and enumerating global store inventories without ownership checks. Exploits ranged from harmless pranks (e.g., misrouting food deliveries) to high-risk sabotage: in healthcare, disinfection/medicine robots could be redirected from critical areas, endangering patient safety; in offices, robots could access restricted floors to steal confidential documents. Attackers could also orchestrate fleet-wide denial-of-service attacks, halting operations or demanding ransom via on-screen QR codes. Despite being alerted on August 12, Pudu Robotics delayed action until August 23, issuing a generic response and patching only after client escalations. The incident highlights systemic negligence, risking public safety, data breaches, and operational disruptions across sectors serving millions daily, including vulnerable groups like children, the elderly, and hospital patients.