Disclaimer: Its an AI-generated image used for representative purpose only
In early 2026, two security researchers demonstrated that hackers could remotely unlock the doors and start the engines of internet-connected cars from anywhere in the world. However, they confirmed that the first automaker’s vulnerabilities affected vehicles in the US, while the second automaker’s flaws left cars open to remote unlocking across the US, Canada and Australia.
In a note shared earlier this month, the duo said that both automakers have since patched the vulnerabilities, which stemmed from basic security oversights in the server APIs powering their mobile apps. Working together, white-hat hackers Shubham Shah and Sam Curry breached the backend connectivity systems of two major automakers. Beyond taking remote control of the vehicles, the flaws also exposed sensitive customer data, including personal information, vehicle locations, mileage, fuel levels, driving range, and whether the doors were locked or unlocked. Shah and Curry have not publicly named either company.
The pair used GPT-5.6 Sol Ultra to brute-force hidden URL paths.
Both companies relied on ForgeRock for user authentication and authorisation, according to the researchers’ write-ups. visual clues in their demonstration video, suggesting the second automaker may be Toyota, as per a report by Tom’s Hardware While the researchers kept the brands anonymous. Aside from one minor exception, the breaches weren’t caused by ForgeRock itself but rather by how poorly the automakers implemented it. In a detailed breakdown of the second automaker’s Australian infrastructure, Shah explained how the duo gained access. After spending a couple of weeks studying how the automaker used ForgeRock, the researchers realised the easiest way was to generate their own access tokens for any user account. They eventually uncovered an unprotected endpoint that let them overwrite any user’s password.
By shuffling tokens between the mobile app and the backend endpoints, Shah and Curry were able to mint valid access tokens, fully impersonate any customer and send a “door-unlock” API request – promptly opening the test vehicle. The final hurdle was multi-factor authentication (MFA), which turned out to be misconfigured. In the Australian system, users could simply skip the MFA step altogether. You use AI every day. Now get your AI Quotient. Take the AIQ test.