Researcher who found McDonald's free-food hack turns her attention to Chinese restaurant robots

A researcher found a critical administrative/authentication weakness in Pudu Robotics' backend that allowed anyone with a valid auth token — obtainable via XSS or account signup — to control and redirect service robots, reset orders, move and rename units, and potentially disrupt restaurant operations or exfiltrate IP; Pudu initially ignored the report but subsequently fixed the issue, awarded a $10,000 bounty, and created a security response center.