Robotaxis Race Ahead as U.S. Cybersecurity Rules Lag

Alphabet Inc.’s Waymo has expanded commercial driverless operations from its public road testing in Phoenix, Arizona, to 11 major U.S. cities, including integrated ride-hailing partnerships with Uber Technologies Inc. Tesla Inc. is also advancing its dedicated “Cybercab” autonomous platform, targeting deployment across at least seven U.S. cities.

The rapid commercial expansion of driverless robotaxis across major U.S. metropolitan areas is exposing a critical gap between fleet technology and public policy. Digital and network vulnerabilities are growing as the regulatory landscape struggles to keep pace.

Autonomous taxis rely on an ecosystem of interconnected Electronic Control Units (ECUs), high-speed vehicle networks, cloud connectivity, Global Positioning System (GPS) tracking, computer vision cameras, lidar, radar, and real-time artificial intelligence models. Every connected module expands a vehicle’s “attack surface,” meaning the sum of potential entry points that malicious actors can target.

Public debate over autonomous vehicles (AVs) has traditionally focused on collision avoidance algorithms, traffic law compliance, and insurance liability. Software engineers and cybersecurity experts warn that the primary operational threat may instead lie in the complex digital architecture linking autonomous fleets to the cloud.

A coordinated maneuver in San Francisco demonstrated that disrupting software-connected transportation does not require a high-tech vehicle hijacking. Local technology prankster Riley Walz directed 50 individuals to simultaneously request driverless rides to a single dead-end street through the Waymo smartphone application. The orchestrated demand surge created a localized fleet blockade, and the resulting traffic congestion forced the driverless ride-hailing company to suspend service across the area until the following morning.

According to Louay Abdelkader, director of product management at QNX, a provider of embedded automotive software operating systems, generative artificial intelligence has drastically shortened the time required for threat actors to discover and exploit software vulnerabilities. Historically, identifying flaws in automotive networks demanded extensive specialized technical expertise, physical access, and labor-intensive reverse engineering.

generative AI tools can now automate vulnerability scans, generate exploit scripts, and execute targeted attacks at speeds far exceeding manual methods. Abdelkader warned that automakers and software developers must prioritize foundational cybersecurity early in the design cycle instead of relying on post-production software patches.

“When you’re developing a cybersecurity system, you start from the ground up. It’s like building a house,” Abdelkader said. “If your foundation is not strong, it becomes very difficult for you to build a robust and secure house.”

He compared the issue with the history of passive automotive safety mandates. Mechanical crash sensors for air bags were first invented in the late 1960s, but federal regulations did not require dual front air bags in all new passenger cars sold in the United States until 1998—more than a century after the commercial introduction of the automobile. Abdelkader said automotive safety took decades to adapt to structural innovations and argued that lawmakers should treat vehicle cybersecurity as a core safety mandate equivalent to air bags, because every connected vehicle carries inherent network risks.

Regulators outside the United States have moved more aggressively. The United Nations Economic Commission for Europe introduced UN Regulation No. 155, requiring automotive manufacturers to establish certified Cybersecurity Management Systems (CSMS) across the full design, manufacturing, and post-production lifecycle of new vehicles. ISO/SAE 21434 complements that framework by establishing baseline cybersecurity risk management protocols for road vehicle electronics.

U.S. cybersecurity governance remains fragmented across federal agencies and state authorities. The National Highway Traffic Safety Administration (NHTSA) maintains non-binding cybersecurity best practices for modern vehicles while overseeing custom design exemptions. Under those federal exemption pathways, Amazon-backed autonomous vehicle company Zoox recently received regulatory approval from NHTSA for a commercial exemption. The approval clears the way for purpose-built robotaxis designed without traditional manual controls, such as steering wheels or brake pedals, to operate in paid public transport.

State policies vary. The California Department of Motor Vehicles requires autonomous vehicle manufacturers operating in cities such as San Francisco and Los Angeles to certify that their fleets can be safely monitored, updated, and maintained in compliance with federal cybersecurity guidelines. Arizona transportation authorities have incorporated formal cybersecurity contingency planning into broader autonomous vehicle operating frameworks. In Michigan, state economic agencies and academic institutions have launched public-private partnerships focused on testing and securing connected vehicle networks against cyber intrusions.

In some major urban centers, local policymakers have focused more heavily on economic impacts than on cybersecurity technical standards. New York City Mayor Zohran Mamdani refused to renew operating licenses for Waymo to conduct autonomous test runs in Manhattan, grounding his opposition in driver protection policies rather than vehicle cyber infrastructure.

“If a company like Waymo finds itself in New York City, what they will also find is a City government that is committed to delivering for the workers who keep the city running,” Mamdani said during a press conference addressing urban transit policies. “Those workers also include our taxi drivers who, for far too long, have been sold a dream of being able to work their way to the middle class.”

Representatives for Waymo, the California Department of Motor Vehicles, and Mayor Mamdani’s office did not respond to requests for comment.

Abdelkader cautioned that waiting for a major network breach to force regulatory updates risks public safety. He emphasized that mechanical safety and cybersecurity can no longer be evaluated separately.

“The legislators and politicians have to work with them to make sure that moving forward, if there are improvements that need to be done, what type of support is required,” Abdelkader said, adding that physical safety and digital resilience are “tied at the hip.” “You need to be able to talk and share that feedback. That’s the only way for the industry to grow effectively and benefit society.”