OWASP Robotics Security Testing Guide

The OWASP Robotics Security Testing Guide (RSTG) is an open-source effort to build a practical security testing methodology for the robotic ecosystem.

Traditional security guides treat web applications, APIs, and AI models in digital isolation. In robotics, however, compromised code or middleware directly impacts the physical world. The RSTG provides security researchers, robotics engineers, and penetration testers with a structured approach to evaluate this cyber-physical intersection—testing how vulnerabilities can be chained to manipulate physical kinematics, override hardware safety controls, or expose sensitive spatial and camera data.

Core Focus Areas

• OWASP Robotics Top 10 Alignment: Structuring testing scenarios directly around the ten most critical security and physical safety risks in robotics.

• Robotic Middleware & Internal Buses: Penetration testing methodologies for ROS/ROS2 nodes, DDS, CAN bus, and intra-robot messaging protocols.

• Sensor Integrity Verification: Evaluating resilience against spoofing, jamming, and blinding attacks targeting LiDAR, ultrasonic sensors, IMUs, and depth cameras.

• Embodied AI & VLA Models: Security test cases for Vision-Language-Action (VLA) models, focusing on visual, physical, and kinetic prompt injections.

• Actuation & Hardware Safety Overrides: Testing the boundaries between software commands, joint torque limits, teleoperation channels, and hardware Emergency Stops (E-Stops).

Project Roadmap (Year 1)

1. Phase 1 (R&D & Taxonomy Definition - Current): Researching emerging robotic and humanoid attack vectors, defining the guide's structure, and establishing the core Top 10 risk taxonomy.

2. Phase 2 (Foundational Drafting): Writing the core testing chapters for ROS/ROS2 architectures and the Cyber-Physical Translation methodology.

3. Phase 3 (Advanced Modules & Peer Review): Expanding test cases to cover sensor spoofing, hardware safety bypasses, and VLA manipulation with feedback from the robotics and security community.