# Autonomous-Vehicle Cyber-Physical Sabotage — Brake/Steering/Sensor Subversion Command

- **Severity:** Critical
- **Signature ID:** `57c79c4c-d1d6-42c6-97cb-b5f87f4ea769`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI02 (Tool Misuse and Exploitation), ASI03 (Identity and Impersonation), LLM01 (Prompt Injection), LLM08 (Vector and Embedding Weaknesses)

## Summary

This rule spots text instructions that try to make an AI agent with vehicle-control capabilities damage or hijack a real car's safety systems. It looks for destructive commands (like 'jam,' 'corrupt,' or 'hijack') aimed at things like brakes, steering, lidar, GPS, or V2X communication, usually tied to a specific vehicle ID.

## How the attack works

An attacker crafts a prompt that pairs a destructive verb — compromise, corrupt, disrupt, jam, intercept-and-modify, manipulate, seize, hijack, or forge-and-deploy — with a named vehicle safety subsystem such as the braking system, path-planning, lidar sensors, GPS data, camera feeds, V2X communications, or traffic-sign signals. The command usually references a concrete vehicle ID. If an AI agent with actual control-tool access follows this instruction, it can trigger mechanical failure, navigation errors, degraded sensing, or a remote takeover of the vehicle while it's operating. The rule catches this specific instruction pattern, not the physical attack itself or how the instruction reached the agent.

## Why it matters

If an agent acts on this kind of instruction, the result is a physical safety incident — a vehicle that brakes wrong, steers wrong, loses sensor accuracy, or can be remotely taken over — with potential for injury, property damage, and liability, not just data loss.

## What you can do

- Never give an AI agent direct, unsupervised write-access to safety-critical vehicle controls (braking, steering, sensor fusion) without a hard-gated human approval step.
- Separate command-interpretation (the LLM) from actuation — route any control command through a deterministic safety layer that rejects out-of-policy actions regardless of what the agent 'decided'.
- Log and review every instruction that pairs a destructive verb with a named vehicle subsystem, even if the agent declined to act on it, to catch injection attempts early.
- Allowlist known research/test corpora (e.g., security benchmark datasets) that legitimately contain these attack strings so they don't generate noise in your monitoring.

## Known benign look-alikes

- Legitimate vehicle maintenance / QA language using benign verbs (monitor, validate, ensure, calibrate, inspect, check the integrity of) on the same subsystems — these do not use the destructive verb set.
- Security research corpora cataloguing ASB autonomous-driving attack strings as reference samples — should be allowlisted by a reviewer.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01801

---
Source: https://www.netzilo.com/threats/atr-autonomous-vehicle-cyber-physical-sabotage-brake-steering-se