Fifty Waymos on a Dead End Street Is the Cheapest Regulatory Argument Anyone Has Made This Year

A self-described "tech prankster" in San Francisco, Riley Walz, organized 50 people to order a Waymo to the same dead-end street simultaneously, and the resulting pileup led the company to disable rides until the next morning ^[1]. The notable part is the input cost: 50 ride requests ^[2], no exploited software, in a state that already requires autonomous vehicle manufacturers to demonstrate they can safely monitor, update and maintain their fleets while complying with federal vehicle cybersecurity guidance ^[3].

Fortune reports that Waymo and the California DMV did not respond to requests for comment ^[4].

Louay Abdelkader, director of product management at QNX, told Fortune that lawmakers should make cybersecurity a primary consideration for these vehicles in the way airbags are, and that every connected vehicle introduces some degree of cyber risk ^[5]. He also supplied the uncomfortable timeline: federal law did not require an airbag in every vehicle on the road until 1998 ^[6], roughly 30 years after airbags were invented as a safety measure and more than a century after the first automobile ^[7]. Abdelkader's view is that security has to be built in from the start rather than added on, and he compared it to a house foundation, saying that if the foundation is not strong it becomes very difficult to build a secure structure ^[8].

Meanwhile the public argument has been about other things: whether robotaxis are smart enough to avoid collisions, how insurers should assign liability in an accident, and how police should handle a driverless car that commits a traffic violation ^[9]. Walz's stunt sits outside all three of those frames. Nothing crashed, nobody was cited, and the loss was availability rather than bodily injury. If the rulemaking and the insurance conversation stay accident-shaped, that class of loss has no obvious owner.

The scale question is what makes this more than an anecdote. Waymo has expanded from Arizona to 11 major U.S. cities and pairs with Uber in a few of them ^[10]. Zoox recently received a commercial exemption from the National Highway Traffic Safety Administration, allowing its paid service broader access without manual controls ^[11]. Tesla has moved into robotaxis with Cybercab in at least seven cities ^[12]. Each of those vehicles runs on dozens of interconnected electronic control units, high-speed networking, cloud connectivity, GPS, cameras, lidar, radar and AI models, and every component widens the attack surface ^[13].

Experts told Fortune that the realistic threat is not the Hollywood scenario of remotely steering a car but attacks on the surrounding ecosystem, and that disrupted communications alone could degrade an autonomous system's ability to navigate safely ^[14][15]. Abdelkader argues generative AI has compressed the time and expertise needed to find vulnerabilities, automate attacks and build exploits, well beyond what Walz's coordination required ^[16].

The regulatory response so far is a patchwork. Arizona has folded cybersecurity planning into broader autonomous vehicle deployment policy, and states including Michigan have set up cybersecurity initiatives with industry and research institutions ^[17][18]. California's requirement existed and the outage happened anyway ^[3][1], which is the part operators and their underwriters should read twice: a disclosure-and-demonstration standard is not an availability guarantee.