BYD Shark 6 test reached lights, locks and microphone, but wider risk is unknown

An automotive security researcher remotely controlled lights, locks, wipers and infotainment functions on a BYD Shark 6 during an authorised test reported by ABC Four Corners on 21 September 2026. The researcher also tracked the vehicle and accessed in-cabin audio, demonstrating a meaningful safety and privacy concern without establishing that every Shark 6 is exposed to the same access.

The distinction matters because the public account leaves several critical questions unanswered. Researcher Dan Hreszczuk had the test vehicle for two weeks before the demonstration. ABC did not identify its model year or software build, explain the initial access method or state whether prior physical access, pairing, configuration changes or other preparation was required.

No attack range, affected-version list, vulnerability identifier or independent replication was published. The evidence therefore documents what happened to one prepared vehicle, not a drive-by, zero-click or fleet-wide internet exploit. Equally, the missing details do not show that the weakness is necessarily narrow. They mean its scale and reproducibility cannot yet be assessed publicly.

What the test controlled

ABC reported that Hreszczuk remotely locked the doors, played audio and images through the infotainment system, operated the wipers and washers, and switched the headlights on and off while the Shark 6 was moving slowly. He told ABC that the access path used by his team did not have a password, although the interface and authentication boundary involved were not disclosed.

Those functions fall short of complete control of the vehicle, but they are not merely cosmetic. Unexpected changes to headlights and wipers, intrusive media on the display, or audio played through the cabin could distract a driver or reduce visibility. The controlled test did not result in a crash, malicious use or reported fleet-wide disruption.

Hreszczuk also told ABC that he could not reach the brakes or cameras and considered those systems well protected. No control of steering, acceleration or braking was demonstrated. Describing the test as a full vehicle takeover would therefore overstate the published evidence, even though the functions that were reached could still affect a driver.

The phone demonstration was a separate chain

The privacy findings extended beyond visible vehicle controls. According to ABC, Hreszczuk tracked the Shark 6’s location in real time, activated its microphone and recorded a telephone conversation inside the cabin. Access to location and in-cabin audio raises distinct privacy questions regardless of whether the vehicle’s driving systems were accessible.

A further demonstration involving personal information depended on another device. In a staged sequence, Hreszczuk played edited voice audio through the vehicle’s speakers to query Siri on an unlocked iPhone left inside the car. The phone then supplied personal details.

That sequence did not demonstrate a direct compromise of a banking service, a BYD cloud account or data held by BYD. It combined control of the vehicle’s audio system with the behaviour of an unlocked phone and its voice assistant. ABC’s public report did not specify the iPhone model, operating-system version or relevant Siri settings, so the phone component cannot be generalised beyond the staged conditions described.

Connected services are documented, but the access path is not

BYD’s Australian Shark 6 handbook confirms that the vehicle supports connected functions. It documents remote diagnostics and over-the-air updates, and says location and vehicle-status information may be sent to BYD’s data centre in the relevant market, depending on the country and setup.

The handbook also says users can place the vehicle in offline mode to restrict communication with BYD’s data server and related processing. That option should not be presented as a fix for the reported access. The documentation does not describe Hreszczuk’s method, and the available evidence does not establish whether offline mode would prevent it.

Similarly, the existence of legitimate remote services does not by itself confirm the reported weakness or explain its technical cause. The public material does not establish whether the demonstrated access was local, routed over the internet, mediated through cloud infrastructure or dependent on a connection created while the researcher possessed the vehicle.

BYD told ABC that data it collects from Australian vehicles is stored in Australia, and that it has not provided and would not provide Australians’ data to Chinese authorities. Those are company statements rather than independent technical confirmation. The public ABC report did not identify a BYD security advisory, affected software range, patch or fixed version addressing the demonstrated access.

No verified owner fix yet

For owners, the absence of version and remediation information is consequential. There is no published basis for determining which Shark 6 vehicles may share the reported condition, whether any software build is unaffected or whether any update addresses the reported access. ANCAP records the model as having been introduced in Australia and New Zealand in January 2025, but the test vehicle’s exact configuration was not disclosed.

No malicious or in-the-wild exploitation was reported. The demonstration involved an authorised researcher and one vehicle, rather than an identified threat actor targeting owners. There is also no vulnerability-specific mitigation supported by the available material, so generic changes to vehicle or phone settings should not be represented as a verified solution.

The test arrives amid a wider policy question about connected vehicles sold in Australia. ABC reported that, as at 21 September 2026, Australia had no minimum cybersecurity standards specifically for cars and that the government had begun consulting industry on cybersecurity and software rules for vehicles.

Assessing the wider risk will require disclosure from BYD or the researchers about the access prerequisites, communication path, tested software build, affected range and any remediation. Until then, the demonstrated control of safety-relevant and privacy-sensitive functions warrants scrutiny, while the number of vehicles to which it applies remains unresolved.

An undisclosed access path leaves a practical question: where are the relevant system boundaries, and how much can one demonstration establish? Follow that question into networking and cybersecurity fundamentals with The Hack Academy’s online cybersecurity training programme, using its self-paced format and practical exercises alongside theory.