Your phone can be hacked.
Your laptop can be hacked.
Your smart home can be hacked.
So what happens when your car becomes another connected computer?
That question became especially relevant again in 2026 after security researchers demonstrated new vulnerabilities involving Tesla vehicles and automotive systems.
At Pwn2Own Automotive 2026, researchers successfully exploited Tesla’s infotainment system through a USB-based attack, chaining two vulnerabilities to gain code execution. Separate university research involving a 2024 Tesla Model 3 and Cybertruck identified vulnerabilities involving their wireless connectivity stack. Zero Day Initiative
But there’s an important distinction.
Those findings do not mean researchers remotely hijacked Tesla FSD and started steering cars around.
The bigger story is much more interesting.
Modern vehicles increasingly contain:
cellular connections,
Wi-Fi,
Bluetooth,
GPS,
smartphone apps,
cloud services,
over-the-air updates,
and millions of lines of software.
NHTSA says these wireless pathways increase the potential attack surface of modern vehicles. NHTSA
That raises a fascinating comparison.
What if we compare a highly connected modern EV with a car that has little or no internet connectivity?
Which is actually harder to hack?
Connected EV vs Offline Car at a Glance
| Connected EV | Mostly Offline Car | |
|---|---|---|
| Cellular connection | Usually | Limited or none |
| Wi-Fi | Common | Often none on older cars |
| Bluetooth | Common | Varies |
| Smartphone app | Common | Usually none |
| Remote vehicle access | Often available | Limited or none |
| OTA updates | Common on newer EVs | Limited or none |
| Cloud services | Extensive | Minimal |
| Remote attack surface | Larger | Generally smaller |
| Remote security patches | Fast and possible | Often unavailable |
| Physical attack possibilities | Yes | Yes |
| Software complexity | High | Generally lower |
| Impossible to hack? | No | No |
And that last row matters most.
There is no useful modern-car category that can simply be called:
“Unhackable.”
Why Connected Cars Have More Doors
Imagine two houses.
House A has:
one front door.
House B has:
a front door,
back door,
garage door,
smart lock,
security camera,
Wi-Fi,
remote thermostat,
and smartphone-controlled garage.
House B isn’t automatically less secure.
It may actually have excellent security.
But there are simply more systems that have to be protected.
Connected cars face a similar problem.
NHTSA has specifically identified cellular, satellite, Wi-Fi and Bluetooth connectivity as potential pathways that increase a vehicle’s attack surface. NHTSA
The more ways a vehicle communicates with the outside world, the more interfaces engineers have to secure.
Tesla Is Basically a Computer on Wheels
Tesla pushed the automotive industry aggressively toward software-defined vehicles.
Owners can use a smartphone to perform functions such as interacting with the vehicle remotely, while Tesla vehicles also rely heavily on software and over-the-air updates.
That creates enormous convenience.
A car can receive new software without visiting a dealership.
Problems can potentially be patched remotely.
Features can change after the vehicle has already been purchased.
But connectivity creates another reality:
the vehicle is no longer an isolated mechanical machine.
It’s part of a network.
And anything connected to a network deserves cybersecurity attention.
What Actually Happened to Tesla in 2026?
This is where headlines can become misleading.
At Pwn2Own Automotive 2026, the security research team Synacktiv successfully attacked Tesla’s infotainment target through the competition’s USB-based attack category.
The team chained an information leak with an out-of-bounds write vulnerability to achieve the successful exploit. Zero Day Initiative
That’s significant.
But it isn’t the same thing as:
“Hackers remotely took control of Tesla FSD.”
The attack category itself involved a USB-based attack against infotainment. Zero Day Initiative
That’s a very different claim.
And it’s why cybersecurity stories require careful reading.
Researchers Also Found Wireless Tesla Vulnerabilities
Another 2026 project makes the comparison more interesting.
Researchers at Northeastern University examined 2024 Tesla Model 3 and Cybertruck vehicles and reported vulnerabilities involving their wireless connectivity stack.
The researchers demonstrated potential risks involving tracking, communications disruption and network performance.
But they also emphasized something important:
the underlying issue isn’t necessarily unique to Tesla.
Modern connected vehicles from many manufacturers use cellular modems, Wi-Fi, Bluetooth and other wireless technologies.
One of the researchers described the broader issue as applicable to modern connected cars generally. Northeastern Global News
So the real comparison isn’t:
Tesla vs everyone else.
It’s increasingly:
connected vehicle vs connected vehicle.
Could an Offline Car Be Safer?
From one perspective, yes.
Imagine an older car with:
no cellular modem,
no Wi-Fi,
no smartphone app,
no cloud account,
and no OTA updates.
Someone thousands of miles away has far fewer obvious wireless paths into that vehicle.
There’s no app account to compromise.
There’s no cellular connection continuously linking the vehicle to external infrastructure.
There’s no cloud-based remote command system.
That’s a meaningful cybersecurity advantage.
It’s essentially the automotive equivalent of keeping a computer disconnected from the internet.
But that doesn’t make the vehicle invulnerable.
Offline Doesn’t Mean Unhackable
Cars have contained electronic systems for decades.
Even vehicles without internet connectivity can contain:
electronic control units,
CAN networks,
diagnostic ports,
keyless-entry systems,
infotainment systems,
and other electronics.
Physical access changes the security equation dramatically.
If someone can connect directly to a vehicle’s electronics, different attack possibilities may exist.
So an offline car can still contain cybersecurity vulnerabilities.
It simply removes many remote pathways.
That’s a crucial distinction.
The OBD-II Port Is Basically a Physical Door
Look underneath the dashboard of most modern cars and you’ll find an OBD-II diagnostic connector.
Mechanics use it to communicate with vehicle systems.
That’s extremely useful.
But it also demonstrates an important cybersecurity principle:
A car doesn’t need internet access to have electronic attack surfaces.
Physical access can matter.
A thief who can reach internal vehicle electronics is operating under completely different conditions from a hacker sitting on another continent.
So:
offline ≠ impossible to attack.
It primarily changes how the attacker might reach the system.
Connected Cars Have a Huge Security Advantage Too
Now the comparison flips.
Suppose researchers discover a serious vulnerability tomorrow.
A connected vehicle manufacturer may potentially develop a patch and distribute it through an over-the-air update.
Thousands or even millions of vehicles can potentially receive the fix without owners visiting dealerships.
NHTSA has highlighted OTA updates as an increasingly important way to remedy recalls and deploy vehicle updates. NHTSA
An older offline vehicle can’t do that.
Fixing software may require:
a dealership visit,
physical reprogramming,
replacement hardware,
or potentially no fix at all if the manufacturer no longer supports the vehicle.
Connectivity creates vulnerabilities.
But connectivity can also help fix vulnerabilities.
That’s the paradox.
OTA Updates Are Both an Advantage and a Responsibility
Over-the-air updating sounds like a pure cybersecurity benefit.
It isn’t quite that simple.
The update mechanism itself has to be secure.
NHTSA’s vehicle cybersecurity best-practices guidance specifically says manufacturers offering OTA updates should protect:
update integrity,
update servers,
transmission mechanisms,
and the overall update process.
It also tells manufacturers to consider risks such as compromised servers, insider threats, man-in-the-middle attacks and protocol vulnerabilities. NHTSA
So OTA creates a fascinating trade-off.
It provides a powerful mechanism to fix security problems.
But that mechanism itself must be protected.
More Software Means More Complexity
A traditional vehicle might have relied heavily on mechanical systems.
Modern cars increasingly rely on software for:
infotainment,
driver assistance,
battery management,
climate control,
navigation,
vehicle settings,
charging,
and even basic controls.
NHTSA says software complexity continues to increase and notes that software errors can sometimes create vulnerabilities that attackers may attempt to exploit. NHTSA
Again, that doesn’t mean:
More software = unsafe car.
It means:
More software = more software that needs to be secured.
EV vs Gas Car Is Actually the Wrong Comparison
Here’s something surprising.
This isn’t really an electric-car problem.
Imagine:
a connected gasoline luxury SUV
versus
an offline electric vehicle.
The connected gasoline SUV could potentially have far more external interfaces.
The powertrain doesn’t determine cybersecurity.
Connectivity does.
NHTSA noted in 2025 that nearly all new vehicles increasingly incorporate connectivity paths such as Wi-Fi, cellular and Bluetooth. NHTSA
So:
EV vs gas
isn’t the useful comparison.
A better comparison is:
highly connected vehicle vs minimally connected vehicle.
What About FSD and Automated Driving?
This is where cybersecurity becomes especially important.
Driver-assistance and automated-driving technologies increasingly rely on:
cameras,
sensors,
computers,
software,
electronic steering,
electronic braking,
and communication between multiple systems.
NHTSA specifically identifies cybersecurity as an important issue as vehicle automation increases. NHTSA
But we have to separate two statements.
Statement 1:
Tesla and other connected vehicles have had cybersecurity vulnerabilities demonstrated by researchers.
True.
Statement 2:
Hackers demonstrated that they can remotely take over Tesla FSD and drive someone’s car.
That is not what the 2026 Pwn2Own Tesla infotainment result established. Zero Day Initiative
That’s a major difference.
Could Someone Ever Remotely Control a Connected Car?
Cybersecurity engineers take that possibility seriously.
NHTSA says that in a worst-case scenario, wireless pathways combined with exploitable software weaknesses could potentially allow remote manipulation of a vehicle or critical safety system. NHTSA
That’s why modern vehicle architecture tries to separate systems.
The infotainment screen shouldn’t simply have unrestricted access to:
brakes,
steering,
or acceleration.
Network segmentation, authentication and boundary controls are important defenses.
NHTSA’s cybersecurity guidance specifically discusses protecting safety-critical communications through these kinds of controls. NHTSA
Think of a ship.
Just because someone enters one compartment doesn’t mean they should be able to open every door on the ship.
Automotive networks should follow a similar principle.
Tesla Being Hacked at Pwn2Own Isn’t Necessarily Bad News
This sounds counterintuitive.
But security researchers actively trying to break vehicles can improve security.
Pwn2Own isn’t a group of criminals secretly attacking random Tesla owners.
It’s a controlled security competition.
Researchers demonstrate vulnerabilities.
Manufacturers can learn about them.
Problems can be patched.
Tesla has participated in and supported Pwn2Own automotive security research; the Zero Day Initiative notes Tesla has worked with the program for years. Zero Day Initiative
Finding a vulnerability before malicious attackers exploit it is exactly what responsible security research is designed to accomplish.
The Smartphone Comparison
Think about your iPhone.
It has:
5G,
Wi-Fi,
Bluetooth,
GPS,
apps,
cloud connectivity,
and constant software communication.
Could an iPhone theoretically have vulnerabilities?
Of course.
Would you automatically replace it with a 2004 flip phone because the flip phone has fewer attack surfaces?
Probably not.
Why?
Because the smartphone provides enormous functionality.
The security question becomes:
Are the additional capabilities worth the additional complexity, and how well is that complexity protected?
Connected cars face the same trade-off.
What Does the Offline Car Give Up?
Imagine an extremely disconnected car.
No cellular connection.
No Wi-Fi.
No cloud account.
No app.
No OTA.
Remote attack possibilities are dramatically reduced.
Great.
But now you also lose things such as:
remote climate control,
vehicle-location services,
live traffic features,
remote diagnostics,
app-based vehicle status,
remote charging management,
and automatic software updates.
Cybersecurity improves in one dimension.
Convenience declines in another.
What Does the Connected Car Give Up?
A highly connected vehicle provides extraordinary convenience.
But the owner becomes dependent on an ecosystem.
That ecosystem can include:
the manufacturer,
cellular providers,
cloud infrastructure,
smartphone software,
third-party suppliers,
and multiple hardware vendors.
And supply chains matter.
NHTSA has specifically warned that a vulnerability in a supplier component can potentially affect multiple automakers. NHTSA
A connected car’s cybersecurity is therefore not determined solely by the badge on its hood.
Privacy Is Part of the Same Conversation
Cybersecurity isn’t only about someone controlling your car.
Connected vehicles can generate substantial data.
In September 2026, Northeastern researchers reported results from testing 21 vehicles and their associated apps across 19 brands, examining data collection and sharing involving connected-car ecosystems. Northeastern Global News
That introduces another trade-off.
A disconnected vehicle knows very little about the outside world.
A connected vehicle may know:
where it is,
where it’s going,
what account is associated with it,
and how its systems are being used.
Connectivity creates useful services.
But it also creates data that needs protection.
So Which Is Harder to Hack?
If we’re talking specifically about remote attack surface, a truly offline, minimally computerized car has an obvious structural advantage.
There are simply fewer remote entry points.
You can’t attack a cellular modem that doesn’t exist.
You can’t compromise a cloud-connected vehicle account that doesn’t exist.
You can’t exploit Wi-Fi connectivity that isn’t there.
But cybersecurity isn’t only about preventing entry.
It’s also about:
detecting vulnerabilities,
patching them,
isolating systems,
maintaining software,
and responding when something goes wrong.
That’s where connected vehicles can have major advantages.
A well-designed connected vehicle can receive security improvements throughout its life.
An offline vehicle may retain the same vulnerable software for years.
The Most Secure Car May Not Be the Least Connected One
Imagine two vehicles.
Car A
Almost no external connectivity.
Old software.
No OTA updates.
Weak internal network segmentation.
Rarely receives security fixes.
Car B
Cellular, Wi-Fi, Bluetooth and cloud connectivity.
But also:
strong authentication,
encrypted communication,
network segmentation,
active security research,
rapid vulnerability disclosure,
and frequent OTA security patches.
Which is safer?
Suddenly the answer isn’t obvious.
Counting internet connections isn’t enough.
You also have to evaluate how those connections are secured.
Connected EV vs Offline Car: Which Is Harder to Hack?
If the only goal were reducing remote attack surfaces, the answer would be simple:
Disconnect everything.
No internet.
No cellular modem.
No Wi-Fi.
No app.
No cloud.
But that’s not where the automotive industry is going.
Modern cars are becoming increasingly connected and software-defined.
The better question isn’t:
Can connected cars be hacked?
Any sufficiently complex computer system can potentially contain vulnerabilities.
The better question is:
How well does the vehicle protect its connected systems, isolate critical controls and fix vulnerabilities when researchers discover them?
The Tesla security research in 2026 doesn’t prove that FSD can simply be remotely hijacked.
It demonstrates something broader.
Cars have become computers.
And once cars become computers, cybersecurity becomes part of automotive safety.
The offline car reduces the number of doors.
The connected car gives manufacturers the ability to repair some of those doors remotely.
The future of vehicle security will depend on doing both:
limiting the ways attackers can get in — and fixing vulnerabilities quickly when they’re found.
Compare with Reason.