A robot fight can be lost without anyone touching the robot. That is not a claim that current leagues are being hacked. It is a description of the attack surface created when competitive performance depends on networked software controlling a physical body.
Start with the control channel.
Teleoperation requires a path from operator to machine. That path has latency, authentication, availability and interference properties. What happens if packets are delayed? Can another device pair? Does the machine freeze, continue the last command or fall back to autonomy? Is emergency stop independent?
A serious league should define the expected network state and monitor deviations.
Software updates create a supply-chain problem.
If standardized hardware shifts advantage toward software, the build pipeline matters. Which source produced the competition binary? Who signed it? Was it changed after inspection? Can a compromised development machine inject code unnoticed?
The defenses are ordinary: reproducible builds where practical, signed artifacts, protected credentials, least privilege, controlled update windows and hashes recorded at inspection.
Sensors can be attacked without hacking them.
Perception lives in the physical world. Cameras can be dazzled. Radio environments become noisy. Reflective surfaces create unexpected sensor behavior. Rules need to distinguish legitimate tactical deception from prohibited interference.
Security should produce evidence.
If external control is prohibited, monitor interfaces. If only approved software is allowed, hash it. If radios must remain in defined bands, log spectrum. Security becomes easier when rules are designed around observable states.
Robot combat will inherit cybersecurity because the competitor is partly software. The answer is not paranoia; it is instrumentation. Authenticate control, sign builds, segment arena networks, preserve logs and write rules around observable states. A disputed championship should have packets and hashes instead of vibes.