BYD Shark 6: a remotely compromised vehicle
An Australian cybersecurity investigation demonstrated how a hacker could interfere with a BYD Shark 6’s vehicle functions. During a controlled demonstration, the headlights were switched off while the vehicle was moving, and the windscreen wipers were activated. Researchers also demonstrated access to vehicle surveillance and location-related capabilities. The work involved gaining access to the vehicle’s digital systems and simulating a compromised electronic control unit; it did not establish that an attacker could casually take over any BYD on the road through the manufacturer’s cloud.
Why it matters: Connected vehicles contain cameras, microphones, location data and electronic controls. If access to those systems is compromised, the consequences can extend beyond privacy into road safety.
Source: ABC News — We got a cybersecurity expert to hack this BYD. It was too easy.
DJI Romo: access to 7,000 robot vacuums
In February 2026, software engineer Sammy Azdoufal discovered that an application he developed to control his DJI Romo robot vacuum could access approximately 7,000 other vacuums across 24 countries. The security flaw reportedly exposed live camera feeds, microphone audio, household floor plans, device status and approximate location information. He had set out to control his own vacuum using a PlayStation controller.
The incident demonstrated how a cloud authentication failure could turn an ordinary household appliance into a remote surveillance device. The available reporting does not establish that all 7,000 owners were actually watched by malicious actors.
Why it matters: A robot vacuum can map the interior of a home and observe people inside it. Remote access to thousands of these devices creates a substantial privacy risk.
Source: The Verge — The DJI Romo robovac had security so poor, this man remotely accessed thousands of them
Zeekr disabled remotely from an AI theft detection error
In July 2026, a Chinese tourist driving a newly purchased Zeekr 9X traveled from Xinjiang, China, across the western border into Kazakhstan. Upon crossing the border, the vehicle’s automated anti-theft security systems flagged the sudden international boundary change as a potential vehicle theft or illegal smuggling attempt. [https://carnewschina.com/2026/07/23/zeekr-9x-owner-stranded-abroad-remote-lockout-disables-smart-features-for-30-hours/]
The Car Model & Price
- Model: Zeekr 9X (a premium, high-performance hybrid/electric luxury SUV).
- Price: It retails in China between 465,900 yuan and 599,900 yuan (approximately $65,000 to $84,000 USD depending on the trim level).
How the Lockout Handled Reactivation
The system disabled the built-in navigation, central touchscreen menus, electronic glove box, and the electronic fuel door/charging port controls. It’s not known if the company can increase restrictions – but you can easily guess they can. Then wouldn’t that be a national security issue to have these capabilities handed to a hostile country?
The owner, who was stranded with a restricted car for over 30 hours. The delay happened because the owner had to submit proof of legitimate travel documents online to the manufacturer, and cellular data signals are notoriously difficult to find near remote international border crossings.
Deepal videos record everything – including military bases
During September 2026 military exercises near Oslo, Norway, Home Guard soldiers discovered that rental cars made by Chinese automaker Deepal and leased through Hertz Norway (owned via Volvo Cars by China’s Geely – that’s right China owns Volvo now and nobody told you) automatically recorded video footage of troop movements, personnel, and secret access codes typed into military base keypads. [https://cybernews.com/security/norway-military-chinese-cars-excercise-footage/] that was very Naive of them…
- The Discovery: Servicemen participating in the Exercise Hovedstad (September 14–18, 2026) found the stored files while browsing the built-in system menus on the vehicle dashboards out of boredom.
- What Was Recorded:
- Video of who entered and exited the vehicles.
- Travel routes, passenger pickups, and time spent at locations.
- Digital security access codes and passcodes typed into gates and doors at high-security military facilities.
- The Vehicles: At least two of the rented electric vehicles were manufactured by Deepal (a brand under China’s state-owned Changan Automobile). The cars were supplied via a framework agreement with First Rent A Car Norway AS (Hertz Norway).
- Aftermath & Security Concerns:
- The servicemen deleted the video files after the drill, though it remains unknown if any copies were automatically transmitted or stored externally.
- There is currently no public evidence that the data was intentionally collected for Chinese intelligence, as the built-in 360-degree cameras and dashcam features operated as part of the vehicle’s standard system.
- The Norwegian Armed Forces continued using the cars due to a lack of alternative transport, but the incident triggered parliamentary questions regarding security vetting for civilian technology used in military operations.
Cheap Chinese smart glasses: strangers could access cameras and recordings
An ABC News investigation published in September 2026 found serious security flaws in inexpensive smart glasses using the Chinese-developed HeyCyan app. Independent researchers found that someone nearby could connect over Bluetooth without a password, take new photographs, access stored images and videos, and intercept some transmissions between the glasses and a phone.
The investigation also found that sensitive information, including email addresses and dates of birth, could be exposed through flaws in the associated website. Some information submitted to the glasses’ AI assistant was sent to servers in China. The Australian privacy regulator subsequently opened a formal investigation into the app developer.
Why it matters: These devices can record people who have no idea they’re being filmed, while the owners’ own recordings and personal details may also be exposed to strangers.
Sources: ABC News — Ultra-cheap smart glasses leaving Australians’ personal data exposed to hackers · Australian Information Commissioner — Investigation opened
Contec patient monitors: a hidden backdoor in medical equipment
In January 2025, the US Food and Drug Administration warned about cybersecurity vulnerabilities in the Chinese-made Contec CMS8000 patient monitor and the Epsimed MN-120, a relabelled version of the same device.
The FDA identified a hidden backdoor, the potential for unauthorized remote control, and software that could collect patient information and transmit it outside the healthcare environment when connected to the internet. An attacker could potentially interfere with the monitor’s operation or compromise other devices on the same network.
The FDA stated that it was not aware of injuries or deaths associated with these vulnerabilities at the time of its warning. In July 2025, it reported that a software patch removed the affected devices’ networking functionality, restricting them to local monitoring.
Why it matters: Medical equipment is expected to protect both patient information and clinical reliability. A hidden access mechanism in a connected patient monitor creates risks that extend into the hospital network and potentially patient care.
Source: US FDA — Cybersecurity Vulnerabilities with Certain Patient Monitors from Contec and Epsimed
Chinese surveillance technology inside cars near Australian defence sites
Security concern: cameras and sensors around sensitive installations
An ABC Four Corners investigation in September 2026 examined a Leapmotor vehicle in Canberra, driving near the Royal Military College at Duntroon, ASIO headquarters and the Russell Defence precinct. The reporting raised concerns about Chinese-connected vehicles collecting data around sensitive government and defence locations.
The investigation also highlighted a troubling overlap: Dahua surveillance technology has been subject to Australian government security restrictions, yet concerns remain about similar data-collection capabilities appearing in connected vehicles. The reporting raises questions about where vehicle sensor data is stored, who can access it and whether it could reveal patterns of activity around sensitive sites.
This is a security concern rather than proof that the particular Leapmotor transmitted classified information or was remotely exploited.
Why it matters: A connected vehicle used by an employee, contractor or visitor can carry cameras and sensors into places where conventional surveillance equipment would face restrictions.
