On September 14, Unitree published a firmware-and-hardware revision to its G1 humanoid and labeled it G1+. The changelog is a hardware specification, and it should be read as one. Improved neck articulation. Higher-output joint motors with reworked thermal management. Upgraded visual and tactile perception. Longer battery life. Far-field voice interaction. The standard configuration lists at 95,000 RMB — approximately $13,000 at current exchange rates, tax included. The EDU variant, aimed at research and deep development, carries no published price.
I read the announcement twice, then a third time looking for the word that was not there. The G1+ can see. It can feel. It can hear across a room. It has the motor authority to act on all three. What it does not have — what no humanoid in this price bracket has — is a defined payment path, an on-chain identity, or a key-management story. A machine that perceives, decides, and acts is, by any economic definition, an agent. We have shipped agents without wallets.
The ledger remembers what the interface forgets. That sentence has governed my work for close to a decade. The G1+ interface is a demo reel: a robot crouching, catching, standing. The ledger, once these machines begin transacting, will be a forensic record. The distance between the two is where the next generation of vulnerabilities will live, and nobody is billing for it yet.
For the first decade and a half of crypto, "agent" meant a smart contract — deterministic code with no body, no senses, and no physical consequence. That era is closing. In 2026, as autonomous machines began negotiating, paying, and settling without a human in the loop, I spent four months with a consortium drafting the technical specification for an agent-facing payment layer. We anchored it on zero-knowledge proof-based payment channels: conservative, backward-compatible, assembled from primitives that had survived production. We rejected every "AI-native" token design that crossed the table. Primitives do not need rebranding. They need witnesses.
The G1+ arrives at the edge of that specification. It sits at the first price point where a research lab, a warehouse, or a mid-sized logistics operator can field humanoid labor without convening a procurement committee. At $13,000, the machine costs less than a year of tooling for a single engineer. That price does two things at once. It accelerates deployment, and it accelerates the moment when someone asks the robot to pay for something — a charging slot, a replacement hand, a dataset, another robot's time.
Machines of this class are not peripherals. They are endpoints. They carry cameras, microphones, and tactile arrays that generate data with commercial value. They consume energy, compute, and maintenance on a meter. Both the revenue side and the cost side are economically legible to a chain. The only missing component is the rail that connects them, and that rail is unfinished. The G1+ shipped first. That ordering is exactly how security failures are born.
Begin with identity, because identity is the first unbilled line item. A humanoid that transacts needs an identity that is not a login. A login is an interface. An identity is a ledger fact. When a G1+ negotiates for a charging slot, the counterparty must verify — not trust — that this specific machine is authorized to spend from a specific account, and that the machine's operator is liable for what the machine does. The specification considered three models: custodial, threshold, and device-rooted.
Custodial is the cheapest and the most dangerous. One key at the operator. Every robot in the fleet dependent on a single hot wallet. A compromise does not disable a robot; it drains a company. Threshold replaces one key with an M-of-N quorum, improving survivability while introducing coordination latency — acceptable when settling invoices, fatal when a robot is holding a cup. Device-rooted places a key in secure hardware on the robot itself. It is the model I argued for, and it is the model the G1+ cannot currently support without an external module bolted to the chassis.
A private key does not depreciate; the body does. The robot is an asset with a warranty clock. The wallet is an asset with an attack clock. They should not share a lifecycle, and they should not share a compromise. Fleet operators will discover this the way DeFi lenders discovered liquidation cascades in 2022 — after the leverage, not before. I spent three months that year reconstructing Three Arrows Capital's isolated margin positions across Anchor and Venus, and the lesson transfers cleanly. The insolvency came from internal leverage mismanagement, not from a flawed protocol. The same structure is being rebuilt, quietly, in every fleet that manages a shared spend wallet with no per-unit accounting.
Identity drift is not a new failure. In early 2017, while auditing the draft of Ethereum's Slasher protocol, I traced a consensus divergence in the finalized proof-of-work state transition function that, under sustained network latency, could have produced a permanent chain split. The bug was not in the logic anyone was watching; it was in the assumption that two honest nodes would observe the same state at the same time. A fleet of robots inherits that assumption and none of the redundancy. Every unit believes it is the only one acting, and every unit shares an operator. When one drifts, they all drift together.
Every oracle question in DeFi becomes a physical question here. When a robot pays a station for electricity, it does not need a price feed; it needs delivery confirmation. When it hires another robot for a shared task, it needs proof of work — literal, not abstract. Neither party can simply announce "task complete." Completion must be verifiable against a state that neither party controls. This is the same constraint that makes lending markets hard, and it exposes the same arbitrariness. Aave and Compound model interest as a function of utilization, on a curve someone chose in a room. That curve has never tracked real supply and demand; it tracks the shape of the curve. For machines the arbitrariness becomes visible faster, because robot demand for capital is bursty and physical. A fleet charges at 2 a.m. because that is when electricity is cheap, then idles. A utilization curve tuned to human trading rhythms will misprice machine capital from the first block. The payment-layer specification sidestepped this by pricing liquidity against channel balance and time-to-settlement rather than utilization. Smaller surface. Auditable surface.
The MEV discussion usually frames aggregators as the retail user's friend. They route, they save fees, they hide the mess. That framing collapses the instant two machines transact. A DEX aggregator's "best route" is a promise about a state the aggregator does not control, and between the quote and the settlement the state moves. On a liquid pair, a human rarely notices. A fleet settling hundreds of small trades per hour notices immediately. I have argued before that the fees retail saves are a rounding error against the value extracted from latency they cannot see. For agents, the asymmetry widens. A robot cannot inspect the mempool. It cannot reason about a sandwich. It cannot decide to wait. It executes the route it was given. Trust is a latency problem before it is an ethics problem. Every autonomous payment rail must answer a question human rails never had to: who absorbs the cost of a race the payer cannot observe? Zero-knowledge channels partially answer it by removing the broadcast step for most transactions. Payments inside a channel never touch the mempool until settlement. The extraction surface shrinks from every payment to the settlement event — a design choice, not a market outcome, which is precisely why I insisted on it. Markets will not protect a participant that cannot advocate for itself. Protocols can.
The G1+ upgraded visual and tactile perception. That is a commercial asset description, whether or not the vendor frames it that way. A fleet running in a facility generates a continuous dataset — spatial, tactile, acoustic — and that dataset has buyers. It can be sold, licensed, or used to train models. The moment it becomes a revenue line, it becomes a target. The far-field voice upgrade deserves particular scrutiny: far-field interaction means the microphone array is engineered to capture speech at distance, in noise, with directional filtering. That is a capability, and in a networked device every capability is a permission waiting to be misused. The specification treated sensor streams as a first-class compliance object — local processing where possible, on-chain hashes where provenance matters, explicit consent before any upload. None of that appears in the G1+ announcement. Absence of a claim is not proof of absence of a control. In an audit, though, it is a finding.
Then there is the oldest tension in the stack: auditability against privacy. The consortium wanted agent privacy, and rightly. Human payment rails are private; machine rails should not be more exposed than human ones. But autonomy without auditability is not a feature. It is a liability transfer. The resolution we used was selective disclosure. Each payment commits to a proof; the proof verifies correctness without revealing counterparties; an auditor, armed with a role or a warrant, can reconstruct the full history. The robot cannot lie about what it spent, and it also cannot be fished. It is the same structure I argued for at the settlement layer years ago, and it still holds, because it never depends on trusting the operator — only on the math being checked. The ledger remembers what the interface forgets. A demo shows a robot lifting a box. The ledger shows whether the robot paid for the electricity, which operator authorized the spend, and which settlement closed the channel. Only one of those is regulatory-grade evidence, and it is not the video.
The contrarian read is uncomfortable: the G1+ is cheap, and cheap is the vulnerability. A $13,000 robot is not a bespoke instrument. It is a manufactured good, which means it will be manufactured at volume, which means its attack surface will be replicated at volume. Fleet-scale compromise is not a metaphor; it is arithmetic. One weak key-generation path, multiplied by ten thousand units, is ten thousand wallets. The reflex of the security industry is to audit the robot — the joints, the sensors, the failsafes — and to publish a report about the arm. The higher-value audit is the wallet. An attacker who owns the payment channel does not need to own the arm. They only need the robot to spend money it did not intend to spend, and the robot will comply, because it cannot see the difference between a legitimate instruction and a forged one. Physical damage is visible and insured. Ledger damage is silent and final. There is a second blind spot worth naming. We are building payment rails for agents before we have settled identity for devices — and that is the order in which bridges fall. Identity work is boring. That is why it gets deferred. That is why deferral is expensive.
The vulnerability forecast is not exotic. Within eighteen months, expect the first documented case of a robot or fleet manipulated into unauthorized on-chain spending — not through a broken arm, but through a compromised key path or a designed-in trust shortcut. The remediation will not come from better motors. It will come from shipping a wallet the machine cannot leak and an audit trail the operator cannot edit. Bodies are getting cheap. The audit trail is not. Which side of that gap will the industry pay to close first?
