A security researcher remotely switched off a moving BYD Shark 6’s headlights, operated its wipers and locks, tracked its location, and listened through its cabin microphone after finding a digital access point that required no password. ABC Four Corners published the controlled Australian test on September 21. That is a meaningful connected-car security failure, even though the investigation does not establish that strangers can attack every Shark 6 from the internet.
The boundary matters. ABC gave automotive security specialist Dan Hreszczuk the vehicle for two weeks. Its report says the access he used lacked a password, but it does not disclose how he first reached that interface, whether he installed anything, what network range applied, or whether the same path works on another stock vehicle. No independent laboratory has reproduced the result. Call it demonstrated unauthorized control after hands-on research—not a zero-click fleet compromise.
The protected brakes do not make the exposed controls harmless
Once inside, Hreszczuk could command the infotainment screen and speakers, lock the doors, spray the windshield, run the wipers, toggle the lights, follow the vehicle’s position and activate the microphone. He could not reach the brakes or cameras, which he described as well protected. That separation suggests at least some useful segmentation between cabin or body systems and more safety-critical controllers.
It is still an inadequate defense to say the brakes held. Darkness, a drenched windshield, loud audio and locked doors are distraction tools with obvious consequences at road speed. Microphone and location access create a separate privacy problem. The experiment also replayed a recorded voice prompt through the cabin speakers to query an unlocked phone, although that second step depended on the phone accepting the command and should not be confused with direct access to its data.
The strongest counterargument is equally concrete: a skilled researcher had authorized physical possession for two weeks, the demonstration occurred at about 30 kilometres per hour on a controlled road, and the powertrain and braking domains resisted him. Those facts sharply reduce what this test proves about opportunistic attackers. They do not explain why any remotely reachable vehicle interface should accept commands without authentication.
Australia regulates the vacuum, not yet the ute
Australia’s mandatory consumer smart-device rules took effect March 4, requiring baseline protections for many connected household products. Government guidance explicitly excludes road vehicles and vehicle components from those rules. The government’s 2026–28 cyber plan promises future national road-vehicle security standards and says they should align with international vehicle regulations, but a plan is not a patch.
The international model already exists. UN Regulation No. 155 requires manufacturers in adopting markets to maintain a cybersecurity management system, assess and test risks, monitor vehicles in service, and respond when protections stop working. ABC reports that BYD says Australian customer data is stored in Australia and has not been, and would not be, handed to Chinese authorities. That answers a geopolitical claim; it does not answer the unauthenticated-access finding.
TINA’s view: publish the missing threat model
TINA’s view: BYD should explain the affected interface, prerequisites, models and software versions, then ship a fix if the route remains open. Australia should make unique authentication, network segmentation, signed updates and a documented vulnerability-response process conditions of connected-vehicle approval. The badge on the grille matters less than whether the software has a lock on the door.
This judgment would change if BYD shows that the interface was available only after an authorized diagnostic mode or researcher-installed modification, or if independent testing cannot reproduce any unauthorized remote session on an unmodified Shark 6. It would strengthen if a second stock vehicle exposes the same path.
The next signals are a technical advisory or software update from BYD, a reproducible report with responsible safeguards, and a timetable for Australia’s promised vehicle standard. Until then, the defensible conclusion is narrower than the television spectacle but still uncomfortable: one connected pickup accepted unauthenticated control of functions that can distract a driver and expose a private cabin.
