Vehicle, robot and drone security has a short public history, and most milestones can be dated from primary or reference sources. This timeline covers seven of them, from the release of the CAN bus in 1986 to the Cyber Resilience Act dates in 2026 and 2027. Each entry says what happened and what to take from it.
1986: CAN released
Bosch began developing the CAN bus in 1983 and released it in 1986 at an SAE conference in Detroit. The standard form has no built-in authentication or encryption. Takeaway: a trusted internal network was a design assumption, and connected cars broke it.
2012: OBD research
Researchers from the University of Washington and UC San Diego showed they could gain control of many vehicle components through the diagnostic interface and upload new firmware to engine control units, per a reference summary. Takeaway: a port within the driver's reach is part of the attack surface.
2015: Jeep Cherokee
Researchers remotely controlled a 2014 Jeep Cherokee through its infotainment system. About 1.4 million US vehicles were recalled, with network-level protections applied on 23 July 2015. Takeaway: an entertainment unit can be a path to safety systems.
2018: stop sign stickers
A research paper reported targeted misclassification of a real stop sign in 100 percent of lab images and 84.8 percent of video frames against the classifier tested. Takeaway: perception models can be wrong in a controlled way.
2021 to 2024: drone Remote ID in the US
The US final rule on Remote ID was published on 15 January 2021. Operators had to comply by 16 September 2023, and the FAA ended its discretionary enforcement period on 16 March 2024. Takeaway: regulators now expect drones to identify themselves in flight.
2024 and 2025: web backends and contests
In 2024, researchers disclosed that a Kia dealer portal flaw let them take over a vehicle using only a license plate, after Kia said it fixed it in August. In January 2025, Pwn2Own Automotive ended with 49 unique zero-days and $886,250 paid. Takeaway: the cloud side and the charger side are active targets.
2025 to 2027: rules arrive
The US connected vehicle rule was finalized in January 2025, and its software prohibitions start with model year 2027. The EU Cyber Resilience Act's Article 14 applies from 11 September 2026 and the regulation from 11 December 2027. The EU Machinery Regulation applies from 14 January 2027. Takeaway: inventories, support periods and reporting are becoming obligations.
A pattern across the cases
Read the timeline as a sequence of lessons.
- Networks designed as closed became open.
- The weakest link moved from the vehicle to the backend and the supply chain.
- Regulators began requiring evidence rather than intent.
The common practical need is an accurate inventory of what is in each release. Safeguard's SBOM and dependency scanning address that for software you build, and a free scan is available at https://gold.safeguard.sh/scan.
Quick check
Is this a complete history?
No. It is a set of dated, sourced milestones. Other incidents exist, and I only included those I could confirm from the pages cited.
Sources
- CAN bus (Wikipedia)
- On-board diagnostics (Wikipedia)
- Chrysler recalls 1.4 million vehicles after Jeep Cherokee hack (Security Affairs)
- Physical-world attacks on deep learning visual classification, Eykholt et al. (arXiv)
- Remote ID (Wikipedia)
- Hacking Kia (Sam Curry)
- Pwn2Own Automotive 2025 final results (Zero Day Initiative)
- Commerce finalizes rule to secure connected vehicle supply chains (BIS)
- Regulation (EU) 2024/2847, Cyber Resilience Act (EUR-Lex)
- Regulation (EU) 2023/1230 on machinery (EUR-Lex)
Last reviewed: 19 October 2026.
