Evidence
Shared software turns one fault into a fleet-wide event
| Date | Case | Country | What happened | Source |
|---|---|---|---|---|
| Jul 19, 2024 | CrowdStrike Falcon update | Global | A faulty content file crashed 8.5 million hosts | Source |
| Sep 2024 | Raptor Train takedown | China (Flax Typhoon) | FBI-led action disrupted a botnet of 260,000 devices | Source |
| Sep 26, 2024 | Kia dealer portal | United States | Remote unlock, start and tracking of Kias from 2013 on using a license plate | Source |
| Mar 31, 2026 | Apollo Go stall | China | At least 100 robotaxis froze; some passengers trapped up to two hours | Source |
Registry
No registry incident turns on fleet-scale failure yet
The cases above are documented, but none yet meets the registry bar of a named developer, a failed control and a known finder.
Exposure
Nine of 17 agent types rate very significant or critical on OTA and update pipeline or multi-agent coordination
From the attack surface ratings, the agent types where this risk has the widest path in.
| Agent type | Dimension | Rating |
|---|---|---|
| Fleets and swarms | OTA and update pipeline | Critical |
| Workflow agents | Multi-agent coordination | Critical |
| Robotaxis and autonomous vehicles | OTA and update pipeline | Very significant |
| Humanoid robots | OTA and update pipeline | Very significant |
| Autonomous trucks | OTA and update pipeline | Very significant |
| Phones and tablets | OTA and update pipeline | Very significant |
| Vehicle cabin AI | OTA and update pipeline | Very significant |
| Smart home assistants | OTA and update pipeline | Very significant |
| Medical devices | OTA and update pipeline | Very significant |
Controls that bound it
- Monitoring and Anomaly Detection: seeing failures and misuse while they happen
- Identity and Cryptographic Attestation: who or what is acting, proven cryptographically
- Behavioral Envelopes: hard limits on action enforced outside the model
Rules
Vehicle cybersecurity rules address fleets; general fleet resilience rules do not exist
| Rule | Jurisdiction | What it requires | Status |
|---|---|---|---|
| UN Regulation 155 | UNECE | Audited cybersecurity management across the vehicle lifecycle | All new EU vehicles from Jul 2024 |
| GB 44495-2024 | China | Mandatory vehicle cybersecurity | Effective Jan 1, 2026 |
| BIS connected vehicle rule | US | Bans adversary connectivity software and hardware | Final Jan 2025 |
| US Cyber Trust Mark | US | Voluntary IoT security label | Launched Jan 2025 |
Status colors: green in force, blue voluntary standard or framework, amber adopted and phasing in, gray draft or pending, red withdrawn.
Record
Page Record
- Risk group
- Data Risks
- Datasets
- ai_risk_evidence.csv (4 rows); registry incidents (0 linked); ai_attack_surface.csv
- Key sources
- CrowdStrike Falcon update
Raptor Train takedown
Kia dealer portal
Apollo Go stall - Last verified
- October 2026