Yes, cars have been taken over by researchers, but the public cases are specific and mostly fixed. The Jeep Cherokee in 2015 and a Kia dealer portal in 2024 are documented examples. The popular picture of a hacker taking over any car at will is not what the evidence shows. Here are myths and facts from sourced cases.
Myth: it is only a movie idea
Fact. In 2015, researchers remotely took control of a 2014 Jeep Cherokee through its Uconnect system while a journalist drove it, and the maker recalled about 1.4 million US vehicles. The reporting lists steering, braking and the engine among affected systems.
Myth: cars are hacked through the engine controller first
Fact. The entry points in public cases were less obvious. The Jeep case started in an infotainment system. The Kia case in 2024 was a web API on a dealer portal that let researchers take over a vehicle using only a license plate. The researchers said it worked without the owner being notified, and Kia said it fixed the issue in August 2024.
Myth: thieves must break the encryption
Fact. In relay attacks on keyless cars, the ADAC says no hacking of the car's data is needed. Two devices extend the key's signal so the car thinks the key is near. The ADAC says about 70 percent of the 850 vehicles it tested over ten years are now better protected, and that ultra wideband helps.
Myth: a modern car is a closed system
Fact. Reference material on OBD notes that the port within reach of the driver lacks authentication in its specifications, and that researchers in 2012 showed control of many components through it. The CAN bus that connects control units has no built-in security in its standard form.
Myth: security researchers are the main danger
Fact. Researchers find bugs that vendors can fix. At Pwn2Own Automotive 2025, 49 unique zero-days were found and $886,250 was paid, with the details going to vendors. The research community is a source of fixes, which is why a disclosure process is valuable.
Myth: nothing can be done after a car is sold
Fact. Over-the-air updates let makers send fixes to cars in the field. They need a secured update channel, which frameworks like Uptane address.
Myth: one bad sensor reading cannot do harm
Fact. A 2018 study showed stickers on a real stop sign made a specific classifier misread it in 100 percent of lab images and 84.8 percent of video frames. That is a lab result against one model. It does show why systems should cross check perception.
What to take away
- Real cases exist and are well documented.
- Entry points are often web services, dealer tools or infotainment units.
- Many documented flaws were fixed after responsible disclosure.
- The best defenses are layered: segmentation, authentication on internal messages, signed updates and a prepared response team.
If you build software for vehicles, Safeguard's SBOM and dependency scanning can inventory what your releases contain.
Quick check
Is my car likely to be hacked today?
The cases here are researcher demonstrations and specific theft methods, not evidence of widespread takeover. Practical steps are keeping software updated and following the ADAC advice on keyless fobs.
Sources
- Chrysler recalls 1.4 million vehicles after Jeep Cherokee hack (Security Affairs)
- Hacking Kia (Sam Curry)
- Ten years of keyless systems tested (ADAC)
- On-board diagnostics (Wikipedia)
- CAN bus (Wikipedia)
- Pwn2Own Automotive 2025 final results (Zero Day Initiative)
- Physical-world attacks on deep learning visual classification, Eykholt et al. (arXiv)
- Uptane
Last reviewed: 19 October 2026.
