Autonomous-Vehicle Cyber-Physical Sabotage — Brake/Steering/Sensor Subversion Command
This rule spots text instructions that try to make an AI agent with vehicle-control capabilities damage or hijack a real car's safety systems. It looks for destructive commands (like 'jam,' 'corrupt,' or 'hijack') aimed at things like brakes, steering, lidar, GPS, or V2X communication, usually tied to a specific vehicle ID.
How the attack works
An attacker crafts a prompt that pairs a destructive verb — compromise, corrupt, disrupt, jam, intercept-and-modify, manipulate, seize, hijack, or forge-and-deploy — with a named vehicle safety subsystem such as the braking system, path-planning, lidar sensors, GPS data, camera feeds, V2X communications, or traffic-sign signals. The command usually references a concrete vehicle ID. If an AI agent with actual control-tool access follows this instruction, it can trigger mechanical failure, navigation errors, degraded sensing, or a remote takeover of the vehicle while it's operating. The rule catches this specific instruction pattern, not the physical attack itself or how the instruction reached the agent.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 57c79c4c-d1d6-42c6-97cb-b5f87f4ea769
- Severity
- Critical
Why it matters
If an agent acts on this kind of instruction, the result is a physical safety incident — a vehicle that brakes wrong, steers wrong, loses sensor accuracy, or can be remotely taken over — with potential for injury, property damage, and liability, not just data loss.
What you can do
- →Never give an AI agent direct, unsupervised write-access to safety-critical vehicle controls (braking, steering, sensor fusion) without a hard-gated human approval step.
- →Separate command-interpretation (the LLM) from actuation — route any control command through a deterministic safety layer that rejects out-of-policy actions regardless of what the agent 'decided'.
- →Log and review every instruction that pairs a destructive verb with a named vehicle subsystem, even if the agent declined to act on it, to catch injection attempts early.
- →Allowlist known research/test corpora (e.g., security benchmark datasets) that legitimately contain these attack strings so they don't generate noise in your monitoring.
Known benign look-alikes
- Legitimate vehicle maintenance / QA language using benign verbs (monitor, validate, ensure, calibrate, inspect, check the integrity of) on the same subsystems — these do not use the destructive verb set.
- Security research corpora cataloguing ASB autonomous-driving attack strings as reference samples — should be allowlisted by a reviewer.