The prank that halted Waymo rides
Louay Abdelkader, director of product management at QNX, said a recent incident in San Francisco exposed a glaring weakness in the way robotaxi operators protect their fleets. On a single evening, self-proclaimed "tech prankster" Riley Walz organised a group denial-of-service attack by having fifty people simultaneously request a Waymo ride to the same dead-end street. The resulting pile-up forced Waymo to suspend its service in the city until the following morning.
Why cybersecurity matters for driverless fleets
Unlike conventional cars, robotaxis rely on dozens of electronic control units, high-speed networking, cloud links, GPS, cameras, lidar, radar and artificial-intelligence models. Each component adds to the "attack surface", the number of points a hacker could potentially exploit. Abdelkader warned that, just as airbags became a mandatory safety feature after decades of debate, cybersecurity must be treated as an equally essential safeguard.
"When you are developing a cybersecurity system, you start from the ground up. It is like building a house. If your foundation is not strong, it becomes very difficult for you to build a robust and secure house," Abdelkader told EuroHerald.
He added that generative AI now allows malicious actors to locate vulnerabilities and automate attacks far more quickly than in the past, turning a prank like Walz's into a possible template for real-world disruption.
Regulatory response and next steps
California law already requires autonomous-vehicle manufacturers to demonstrate safe monitoring, updating and maintenance of their fleets in line with federal vehicle cybersecurity guidance. The California DMV and the National Highway Traffic Safety Administration have not commented on the specific incident.
Other jurisdictions are moving ahead. Arizona has woven cybersecurity planning into its autonomous-vehicle deployment policies, while Michigan has launched joint industry-research initiatives. Internationally, the United Nations' UN Regulation No. 155 obliges automakers to maintain certified cybersecurity management systems throughout a vehicle's life, and the ISO/SAE 21434 standard sets engineering requirements for vehicle cybersecurity.
In New York City, Mayor Zohran Mamdani has focused the debate on labour concerns, refusing to renew Waymo's licence without addressing driver-taxi competition. Abdelkader argues that lawmakers across the United States should build on existing frameworks rather than waiting for a cyber incident to expose a gap, noting that safety and cybersecurity are "tied at the hip."
As robotaxi services such as Zoox, Tesla (with its Cybercab) and Waymo expand into more cities, the industry faces pressure to embed security from the design stage and for regulators to enforce consistent standards.