A San Francisco ‘tech prankster’ got 50 Waymos ordered onto the same street, exposing robotaxis’ cyber/airbag problem

There once was a time when most cars on the road did not have air bags as a standard under federal law.

It took until 1998, in fact, for every vehicle on the round to have an airbag as required by federal law — that’s over 100 years after the invention of the first automobile and roughly 30 years after airbags were first invented as a safety measure.

Something like that is playing out again, except this time with robotaxis and cyber protections.

Louay Abdelkader, director of product management at QNX, identified it as a huge problem for the sector, “of course … keep in mind that in automotive safety, it took a while for it to adopt.” Abdelkader told Fortune lawmakers should make cybersecurity a primary consideration akin to airbags, noting that every connected vehicle introduces some degree of cyber risk.

Much of the debate over robotaxis has focused elsewhere, such as whether they are indeed smart enough to avoid collisions, how insurance companies should assign liability in an accident, or how police can deal with driverless cars that commit traffic violations.

Abdelkader told Fortune lawmakers should make cybersecurity a primary consideration, noting that every connected vehicle introduces some degree of cyber risk.

Robotaxis are proliferating across the country, however, with the robotaxi company Zoox most recently receiving regulatory approval from the National Highway Traffic Safety Administration for a commercial exemption, allowing the paid service broader access without manual controls.

Tesla also has moved into the robotaxi space, with the advent of Cybercab in at least seven cities.

Meanwhile, Alphabet-owned Waymo has expanded from its beginnings in Arizona to 11 major U.S. cities—even pairing with rideshare company Uber in a few cities.

Unlike conventional vehicles, robotaxis depend on dozens of interconnected electronic control units, high-speed networking, cloud connectivity, GPS, cameras, lidar, radar and AI models that continuously interpret the world around them.

Every one of those components expands what cybersecurity professionals call “attack surface,” or the number of possible entry points hackers can exploit.

While Hollywood often depicts hackers remotely hijacking an entire vehicle, experts say modern attacks are more likely to target the broader ecosystem surrounding autonomous cars.

Even if attackers cannot directly steer a vehicle, disrupted communications could degrade an autonomous system’s ability to safely navigate.

In San Francisco, self-proclaimed “tech prankster” Riley Walz organized a group DDOS—a denial-of-service—attack on local Waymos.