Evidence
Vehicle portals and jamming expose location data at scale
| Date | Case | Country | What happened | Source |
|---|---|---|---|---|
| Jul 2024 | OPSGROUP spoofing surge | Middle East and Baltic | Spoofed flights rose from about 200 to 900 a day | Source |
| Oct 16, 2024 | MSS illegal mapping case | China | A foreign firm accused of collecting geographic data with lidar test vehicles | Source |
| Jan 2025 | Subaru Starlink flaw | United States, Canada, Japan | Portal takeover exposed a year of location history within 5 m | Source |
| Jun 2025 | Kaliningrad jamming | Lithuania | Interference traced to more than 10 sites; 13 EU states asked the Commission to act | Source |
Registry
No registry incident turns on telemetry falsification yet
The cases above are documented, but none yet meets the registry bar of a named developer, a failed control and a known finder.
Exposure
12 of 17 agent types rate very significant or critical on perception and sensors
From the attack surface ratings, the agent types where this risk has the widest path in.
| Agent type | Dimension | Rating |
|---|---|---|
| Robotaxis and autonomous vehicles | Perception and sensors | Very significant |
| Humanoid robots | Perception and sensors | Very significant |
| Industrial robots and cobots | Perception and sensors | Very significant |
| Autonomous trucks | Perception and sensors | Very significant |
| Drones | Perception and sensors | Very significant |
| Phones and tablets | Perception and sensors | Very significant |
| Wearables | Perception and sensors | Very significant |
| Vehicle cabin AI | Perception and sensors | Very significant |
| Smart home assistants | Perception and sensors | Very significant |
| Medical devices | Perception and sensors | Very significant |
| Public infrastructure | Perception and sensors | Very significant |
| Ambient sensors | Perception and sensors | Very significant |
Controls that bound it
- Telemetry Integrity: whether the data feeding an agent has been tampered with
- Monitoring and Anomaly Detection: seeing failures and misuse while they happen
Rules
China keeps vehicle data in the car by default; the EU and US act case by case
| Rule | Jurisdiction | What it requires | Status |
|---|---|---|---|
| Automotive data security provisions | China | Vehicle data processed in-car by default; important data kept in China | Oct 1, 2021 |
| EASA and IATA GNSS interference plan | EU and global | Data collection and backup navigation | Jun 2025 |
| FTC order against GM and OnStar | US | Five-year ban on sharing location and driving data | Jan 2026 |
| EU Data Act | EU | User access to connected-product data | From Sep 12, 2025 |
Status colors: green in force, blue voluntary standard or framework, amber adopted and phasing in, gray draft or pending, red withdrawn.
Record
Page Record
- Risk group
- Data Risks
- Datasets
- ai_risk_evidence.csv (4 rows); registry incidents (0 linked); ai_attack_surface.csv
- Key sources
- OPSGROUP spoofing surge
MSS illegal mapping case
Subaru Starlink flaw
Kaliningrad jamming - Last verified
- October 2026