Food Delivery Robots Vulnerable to Hacks That Redirect Orders

A cybersecurity report details a startling vulnerability in Pudu Robotics’ management APIs that allowed anyone with minimal technical skill to seize control of the company’s food delivery and service robots, according to BobDaHacker. Almost every API endpoint for Pudu’s robot‑management platform lacked sufficient authentication checks, meaning although tokens were required, the system did not verify user permissions or robot ownership.

Attackers could view any robot’s call history, initiate, cancel, or reroute tasks on any robot anywhere, modify robot settings, and enumerate Pudu’s global store deployments by store ID. In possible scenarios, a BellaBot could be redirected to a wrong table, peak delivery hours could be disrupted, and medicines or disinfection tasks could be misdirected in hospitals, with broader risks to sensitive operations in offices and healthcare settings.

BobDaHacker reported the vulnerabilities to Pudu’s teams from 12 August, escalated to key customers such as Skylark Holdings and Zensho on 28 August, and within forty‑eight hours Pudu’s security team acknowledged the reports before patches were issued two days later.