AI Risk Wire

Cases › security breach › LR-2026-0439

Researchers show self-driving cars can be tricked by a printed sign

Preliminary Why: Publisher not yet named · subject to change

Status: action reported, no fix

Severity minor
Reported 27 Feb 2026

No source states: loss or records, developer and model, agent tool, could do, deployer, industry.

Severity minor: Test tier: contained to one evaluation on a robotic car in a university building; no third party is stated to have been touched.

Researchers at the University of California, Santa Cruz studied whether the visual-language models used by embodied AI, such as robotaxis and drones, could be steered by printed text. Their method, called CHAI, creates signs that the AI reads and follows as commands. The source reports success rates of 81.8% in automotive simulations, up to 95.5% in drone tracking tests, and 92.5% on a real robotic car in a university building. Some signs were reported to make systems ignore obstacles or land drones on debris. This is a research demonstration, not a reported real-world loss. The team plans to present the findings at a 2026 IEEE conference and to propose defenses such as text authentication, safety alignment and provable robustness.

What happened

1 · What it was doingResearchers tested whether printed signs could steer visual-language models used in embodied AI systems.
2 · What went wrongIn the tests, the signs convinced AI systems to ignore obstacles and directed drones toward unsafe landings.
3 · How it was caughtThe university researchers identified and disclosed the attack themselves.

What was done

The team plans to present the findings in 2026 and propose defenses.

Risks

Hidden instructions hijack the agent
Primary50 incidents
Rising: 6 vs 2.8 a week

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Harness

Outside content treated as data, not instructions · Prompt-injection detection · Confirmation after untrusted input · Validation of tool inputs and outputs · Tool allow-list

Application

Human approval for high-impact actions · Least-privilege access for the agent · Segmentation of agent components · Alerts on unusual tool use

Evidence

No source states: what it reached or did, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause.

Show the full account: 1 items from the primary sources

What happened, in order

  1. 2026 The team plans to present the findings at the 2026 IEEE Conference on Secure and Trustworthy Machine Learning.
Show every field, with its source and grade

What happened

Earliest source we hold
2026-02-27
D inferred by us from the described behaviour, reason shown
What set it off
hidden instructions in its input
C one secondary source states it
Who caught it
an independent researcher or journalist
C one secondary source states it
Cause in detail
The system follows a command read from printed text before checking whether it makes sense.
C one secondary source states it
What went wrong
security breach
D inferred by us from the described behaviour, reason shown
primary risk
RK01
D inferred by us from the described behaviour, reason shown

Impact

Severity
minor
D inferred by us from the described behaviour, reason shown
Why this severity
Test tier: contained to one evaluation on a robotic car in a university building; no third party is stated to have been touched.
D inferred by us from the described behaviour, reason shown

Notes on gaps

The article describes a research demonstration, not a real-world incident; no deployment, loss, victim or regulator is stated. No loss figures, record counts or durations are given. Multi-sensor redundancy is described for production vehicles generally, not as controls held in the tested system, so it is not reported as a control in this incident. Summary figures for the simulation and drone tests are from the article's bullet list.

LR-2026-0439 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON