Quantized Vision-Language-Action (VLA) models expose a weight-fault surface: Rowhammer-style faults can corrupt deployed INT8 bits. We present the first bit-flip attack on a VLA: a few gradient-selected flips reduce closed-loop success to
0%, while hundreds of random flips are harmless. Across four model variants spanning three action-head families, damaging bits concentrate in a few action-generating layers, but the empirical budget depends sharply on the head: direct regression and token policies fall in
1--
5 flips, whereas the evaluated flow-matching policies require
∼100--
300. Our fixed-direction manifold-escape loss cuts \pizero{}'s budget from
∼1000 to
∼100 flips, and a matched five-direction sweep shows that the attack is not specific to an all-positive direction. On a direct head, protecting
3.1% of weights preserves
60% success at
K=100, and protecting
5.3% moves the open-loop break threshold from 3 to 100 flips. Finally, task-calibrated emulated
K=100 flips yield
0/20 real-robot successes, versus
14/20 clean and
16/20 global-random. Weight integrity is therefore a security boundary for embodied foundation models. Code is included as ancillary material.