Pulp sci-fi illustration of a technician in a cream work suit holding a glowing wireframe crate up to a lamp, a faint dark tangle visible inside, beside a row of tagged chrome robot arms and a window onto a brass control room

Free robot models, hidden risks: what NVIDIA’s SimReady library means for the OT supply chain

On 21 October NVIDIA opened a free library of more than 2,000 simulation-ready 3D models of robot arms, grippers, racks and cooling plant. It is a useful resource. It is also a new route for untrusted files into the digital twins that sit next to real factories and data centres. Sources checked on 26 October 2026.

What NVIDIA released

SimReady Central Library (opens in a new tab) launched on Hugging Face alongside NVIDIA’s GTC Berlin robotics announcements (opens in a new tab). NVIDIA describes it as “a free, ungated starting point” for robot training environments and what it calls AI factory digital twins. The assets are in OpenUSD, the open scene format that began at Pixar, and come with the extra data a simulator needs: collision geometry, mass, friction, joint limits and semantic labels.

Most of the contributors are equipment makers. NVIDIA names FANUC, Universal Robots, Franka Robotics, Robotiq, Comau and Standard Bots for arms and grippers, Vertiv for racks and cooling, and LG Electronics for household appliances, alongside ForgeCAD, an AI-assisted CAD provider, and Palatial, a simulation asset provider. The library browser (opens in a new tab) is the front end; the files themselves live in each contributor’s own Hugging Face repository. According to the library’s dataset card (opens in a new tab), contributors “retain ownership” and “control their releases and licenses”, while NVIDIA reviews submissions before they are indexed. The service is labelled Alpha.

None of this is unusual for open source. What makes it worth a closer look is where the files are meant to end up.

Free files, real plant

NVIDIA’s own launch post suggests that developers “connect the scene to live BMS and IT telemetry to keep the digital twin synchronized with an AI factory facility”. A building management system runs cooling, power and access in a data centre. It is operational technology, and it tends to stay in service far longer than the IT around it.

That puts a chain together. A third-party 3D file is downloaded from a public repository, opened in a parser on an engineer’s workstation or a simulation server, and the resulting model is then wired to telemetry from real plant. If any link in that chain can be subverted by a crafted file, the attacker’s starting point is no longer the corporate network. It may be a workstation or server with a path into OT.

The parsers have had flaws. Since September 2025, Pixar’s OpenUSD project has published at least eight security advisories, most of them for memory-safety bugs triggered by crafted files, and the latest fix landed in OpenUSD 26.08 in July 2026. None has a CVE ID. Two show the pattern:

  • GHSA-58p5-r2f6-g2cj (opens in a new tab) (September 2025): a use-after-free in the Sdf_PathNode module. The advisory says a “specially crafted .usd file” could let an attacker “gain control of the affected system”, and that the issue was confirmed in standard tools such as usdcat and sdfdump. Rated critical (9.4) by the project; fixed in OpenUSD 25.08.
  • GHSA-grjp-54v3-c442 (opens in a new tab) (October 2025): a use-after-free when parsing binary .usdc (crate) files, reported via the Zero Day Initiative and rated moderate. Fixed in OpenUSD 25.11.

Four more, published in March 2026 and rated high, cover out-of-bounds reads and writes in the same binary crate format, and a further crate flaw was fixed in 26.08. The project’s security advisories page (opens in a new tab) has the full list.

NVIDIA’s simulation tooling has its own record. In October 2026 NVIDIA disclosed CVE-2026-65141 (opens in a new tab), an eval injection in Isaac Lab that “might lead to code execution”, rated 7.8 (high) by NVIDIA and affecting versions up to 2.3.2; the fix is in 3.0-beta2 (NVIDIA bulletin 5902 (opens in a new tab)). A year earlier it fixed CVE-2025-23356 (opens in a new tab), a flaw in Isaac Lab’s SB3 configuration parsing rated 8.4, in versions before 2.2.1. Neither bulletin reports exploitation or says the flaw can be triggered by a 3D asset. Both sit in the software that loads and runs simulations built from them.

There is no public report of a malicious SimReady asset, and nothing here suggests NVIDIA’s contributors are anything other than what they say. The point is precedent. Hugging Face has already hosted malicious machine-learning files: JFrog reported around 100 malicious models (opens in a new tab) in 2024, and ReversingLabs found models built to slip past the platform’s scanner (opens in a new tab) in 2025. Hugging Face removed those within a day and updated its scanner. Attackers go where engineers download things. A library that lets any organisation apply to contribute, even with NVIDIA vetting each contributor and asset, and that indexes many separate repositories, is a broader surface than a single vendor download page.

Related file formats carry their own risks. Blender, a common tool in 3D pipelines, can run Python embedded in a .blend file. Its manual (opens in a new tab) warns that this “poses a security risk since Python does not restrict what a script can do”. Automatic execution is off by default, and should stay that way for anything downloaded.

When the agent does the shopping

NVIDIA’s examples go a step further than a human browsing a catalogue. Its launch post shows a prompt asking an AI model to search SimReady Central, choose a FANUC arm and a Robotiq gripper, “Generate the Python code to assemble the scene” and render a preview. Hugging Face has added USD search to its platform search, which NVIDIA says will help “agents discover SimReady assets”.

That changes who decides what gets downloaded. An agent with search, download and code-execution rights will pick assets by their descriptions and metadata, and will write and run code to load them. Asset metadata becomes an input to a system that acts on it, which is the condition for prompt injection. A mislabelled or deliberately poisoned asset no longer has to persuade an engineer. It only has to rank well and read plausibly to a model. The safeguards are the familiar ones: limit where the agent may fetch from, review generated code before it runs, and keep the agent’s environment well away from anything with live plant credentials.

Read the licence on every asset

There is no single licence. The library’s dataset card (opens in a new tab) tells users to “review each asset’s license, target profile, and validation evidence before use”, and NVIDIA’s SimReady catalogue says partner datasets “carry their own licenses”. NVIDIA’s metadata specification (opens in a new tab) requires assets that claim SimReady packaging provenance to declare an asset_license field, with examples ranging from CC-BY-4.0 to “proprietary”. A scene assembled from six suppliers carries six sets of terms, some possibly non-commercial. Commercial digital twin work needs that field checked and recorded per asset, not assumed from the platform.

The UK and EU angle

For manufacturers selling into the EU, the Cyber Resilience Act already sets the direction, though most of its obligations apply from 11 December 2027. Article 13(5) (opens in a new tab) requires manufacturers to “exercise due diligence when integrating components sourced from third parties”, including free and open-source components, so that they do not compromise the product’s security. A commercial simulation or digital twin product that ships or loads third-party assets and parsers is within that logic, and the CRA’s vulnerability reporting duties have applied since 11 September 2026. For operators, NIS2 Article 21(2)(d) (opens in a new tab) requires essential and important entities to manage “supply chain security”, including their relationships with direct suppliers, as transposed into national law. A digital twin connected to a data centre’s BMS is part of that estate. In the UK, the same questions sit with operators under the NIS Regulations and the Cyber Security and Resilience Bill now before Parliament.

What to do

  • ☐ Update OpenUSD to 26.08 or later (26.11.1 is current) everywhere it is installed, including Python wheels (usd-core) and copies bundled inside other tools.
  • ☐ Update Isaac Lab to 3.0-beta2 or later (3.0 is now generally available); 2.3.2 and earlier are affected by CVE-2026-65141.
  • ☐ Open and convert downloaded assets in a sandbox or disposable virtual machine with no network route to OT, then promote only the converted, checked files.
  • ☐ Keep Blender’s Auto Run Python Scripts preference off, and do not mark download folders as trusted.
  • ☐ Record each asset’s asset_license field, source repository and revision before it enters a commercial project.
  • ☐ Segment digital twins from live BMS and OT. Telemetry should flow out to the twin through a one-way or brokered path, not a routed connection the twin can use in reverse.
  • ☐ If an AI agent builds scenes, allow-list the repositories and revisions it may fetch from, and review generated code before it runs.

Free assets save weeks of modelling work, and SimReady Central is likely to be widely used for that reason. The files deserve the same treatment as any other third-party code that ends up near plant: know where it came from, open it somewhere safe, and do not let it talk back.

Sources

  1. NVIDIA, Hugging Face blog, Announcing SimReady Central: An Open Library of Simulation-Ready 3D Assets for Robotics and AI Factories, 21 October 2026. https://huggingface.co/blog/nvidia/simready-central-assets-robotics-ai-factories (opens in a new tab). Retrieved 26 October 2026.
  2. NVIDIA Newsroom, NVIDIA Advances Isaac Platform for General-Purpose Robotics, 21 October 2026. https://nvidianews.nvidia.com/news/nvidia-advances-isaac-platform-for-general-purpose-robotics-with-new-reference-humanoid-frameworks-simulation-pipelines-and-data (opens in a new tab). Retrieved 26 October 2026.
  3. NVIDIA, SimReady Central Library dataset card. https://huggingface.co/datasets/nvidia/simready-central-library (opens in a new tab). Retrieved 26 October 2026.
  4. NVIDIA, SimReady Catalog dataset card (access restricted at time of checking). https://huggingface.co/datasets/nvidia/simready-catalog (opens in a new tab). Checked 26 October 2026.
  5. NVIDIA, SimReady Foundation, nested-simready-metadata requirement. https://nvidia.github.io/simready-foundation/latest/capabilities/core/sim_ready/requirements/nested-simready-metadata.html (opens in a new tab). Retrieved 26 October 2026.
  6. Pixar OpenUSD, security advisory GHSA-58p5-r2f6-g2cj. https://github.com/PixarAnimationStudios/OpenUSD/security/advisories/GHSA-58p5-r2f6-g2cj (opens in a new tab). Retrieved 26 October 2026.
  7. Pixar OpenUSD, security advisory GHSA-grjp-54v3-c442. https://github.com/PixarAnimationStudios/OpenUSD/security/advisories/GHSA-grjp-54v3-c442 (opens in a new tab). Retrieved 26 October 2026.
  8. Pixar OpenUSD, security advisories. https://github.com/PixarAnimationStudios/OpenUSD/security/advisories (opens in a new tab). Retrieved 26 October 2026.
  9. NVIDIA, Security Bulletin 5902: NVIDIA Isaac Lab, October 2026. https://raw.githubusercontent.com/NVIDIA/product-security/main/2026/5902/5902.md (opens in a new tab). Retrieved 26 October 2026.
  10. NVD, CVE-2026-65141. https://nvd.nist.gov/vuln/detail/CVE-2026-65141 (opens in a new tab). Retrieved 26 October 2026.
  11. NVD, CVE-2025-23356. https://nvd.nist.gov/vuln/detail/CVE-2025-23356 (opens in a new tab). Retrieved 26 October 2026.
  12. JFrog, Data Scientists Targeted by Malicious Hugging Face ML Models with Silent Backdoor, 2024. https://jfrog.com/blog/data-scientists-targeted-by-malicious-hugging-face-ml-models-with-silent-backdoor/ (opens in a new tab). Retrieved 26 October 2026.
  13. ReversingLabs, Malicious ML models discovered on Hugging Face platform, 2025. https://www.reversinglabs.com/blog/rl-identifies-malware-ml-model-hosted-on-hugging-face (opens in a new tab). Retrieved 26 October 2026.
  14. Blender Manual, Scripting & Security. https://docs.blender.org/manual/en/latest/advanced/scripting/security.html (opens in a new tab). Retrieved 26 October 2026.
  15. Regulation (EU) 2024/2847 (Cyber Resilience Act), Article 13(5). https://lexiara.org/provision/32024R2847/art_13__para_5 (opens in a new tab). Retrieved 26 October 2026.
  16. Directive (EU) 2022/2555 (NIS2), Article 21. https://nis2resources.eu/directive-2022-2555-nis2/article-21/ (opens in a new tab). Retrieved 26 October 2026.

Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)