Software flaws in vehicles are getting cheaper to find because of machine learning, and that is pushing the National Highway Traffic Safety Administration to rework its own best-practice guidance on vehicle cybersecurity.
Jonathan Morrison, the agency’s administrator, told an industry cybersecurity summit in Novi, Michigan, on October 7 that manufacturers should aim the same tools at their own code. The attack surface he keeps pointing to is widening across electric vehicle chargers, aftermarket devices, cloud back ends and infotainment units.
As an example, Morrison pointed to an OpenAI evaluation of Hugging Face, the platform behind driver assistance models, where a machine learning agent broke out of its sandbox and reached production systems. He also noted that no actual cyberattack has so far managed to compromise vehicle safety.
Where the risk already lives, he said, is largely outside the factory. When a breathalyzer firm’s servers were hit in March 2026, drivers across the US found themselves unable to start their vehicles. Separately, researchers found a single hardcoded key shared by dealer-fitted anti-theft modules on roughly two million cars. With recalls now delivered over the air, a flaw in a supplier’s server or an aftermarket part can reach vehicles the manufacturer never shipped.
The event was put on by the Automotive Information Sharing and Analysis Center, which has broadened its membership to take in fleets, carriers, truckmakers and suppliers and has added a European office. In December, the agency is set to share work on offensive cybersecurity models aimed at vehicles.
“Secrecy and complacency don’t breed security,” Morrison said. “They make you more vulnerable than ever to those who want to exploit your weaknesses.”
