The humanoid's brain is a vision-language-action model. It runs on a host you own.

In 2026 humanoids stopped being stage demos. Figure ran tens of thousands of vehicle cycles at BMW. Tesla put Optimus units in its own plants. Apollo is at Mercedes. The thing that made it real is not the legs — it is an on-board vision-language-action model. And that model runs on a Linux computer.

The questions humanoid teams are starting to ask

As general-purpose robots move into human workspaces, driven by foundation models rather than scripted policies, the security conversation shifts to the reasoning host:

• Our robot's model runs on-board and can call out. Where does that traffic go, and can we see it?
• A humanoid works alongside people. If its policy is steered off-script, what stops a host-level action?
• Fleet training data — every hour of operation — is the crown jewel. Can an on-board agent move it without anyone noticing?
• Can we prove, to a partner like BMW or Mercedes, that the autonomy on their floor stayed inside our rules?

The landscape: demo-to-deployment, model-driven

The deployments are now measured in operating hours and signed contracts. Figure operated Figure 03 for months at BMW Spartanburg across tens of thousands of production cycles. Tesla deployed Optimus Gen 3 units into Fremont, Austin, and Berlin from January 2026. Apptronik's Apollo is in pilots with Mercedes-Benz, NASA, and Jabil. Agility's Digit has logged hundreds of thousands of hours at Amazon and GXO. Agility, Figure, Apptronik, 1X, Unitree, and Boston Dynamics are all shipping or nearly so.

The decisive shift is architectural. The bottleneck moved from hardware to foundation-model policies that generalize across tasks. Figure's Helix and NVIDIA's GR00T are the names to know. Helix is a vision-language-action model running on-board, generating motor commands from natural-language instructions and camera input, with no cloud round-trip. Foundation-model labs Physical Intelligence and Skild AI raised at multi-billion valuations to build general robot brains. The robot now reasons, on a host, about what to do.

That reasoning host inherits the entire agentic-AI risk surface — prompt injection, excessive agency, data leaving the building — now attached to a heavy machine moving through a room with people in it. The stakes of an ungoverned agent are no longer just data; they are physical. In December 2025, OWASP published its Top 10 for Agentic Applications, covering risks from goal hijacking to rogue agents. That is the framework for exactly this class of autonomy.

Where the risk lives — the on-board Linux brain

Vantio does not make the robot balance, stop safely, or move correctly. That is the manufacturer's embodied-safety domain, and it is hard-won. We protect the general-purpose compute the model runs on: the on-board Linux brain and the fleet servers behind it, where the agent calls out, moves data, and can take host-level actions.

For a humanoid program the crown jewels are the fleet's training data and the integrity of the on-board policy. An ungoverned agent on that host is where proprietary operational data leaves, or where an injected instruction reaches a destination you already ruled out. Seeing that behavior, applying rules on the path, and stopping a forbidden move on the machine you enrolled is control you can put on the host without touching the motion-safety loop.

For a humanoid team the practical path is: run Optics free on the on-board brain or fleet server to see what the model actually calls; add Gate when training data and destinations need rules that stick; put Phantom Engine on the hosts where a skipped wrap on a physical machine is unacceptable.

What Vantio does — and does not — do

• Does: observe and govern the AI, language-model, and vision-language-action workloads on the Linux compute you own — on-board brains and fleet servers.
• Does: show where agents connect, apply the rules you set, and stop a forbidden move on a Linux host you enroll, without storing prompts or completions.
• Does not: control the robot's balance, locomotion, manipulation, or physical safety systems — that stays the manufacturer's embodied-safety domain.
• Does not: run inside real-time motor-control firmware. Vantio governs the general-purpose agent host, not the low-level actuation loop.

Get started

Optics is free visibility inside the agent process you wrap. Gate applies the rules you set. Phantom Engine protects Linux hosts you enroll. Talk to sales when you need governance on top.

Sources

• OWASP GenAI / agentic application security
• Industry humanoid trackers (2026) — Figure 03 at BMW, Optimus Gen 3, Apollo at Mercedes
• Figure Helix on-board vision-language-action model; NVIDIA GR00T; Physical Intelligence and Skild AI
• Agility Digit deployments at Amazon and GXO