NHTSA Administrator Jonathan Morrison told an automotive cybersecurity audience in Novi, Michigan, on Oct. 7, 2026 that the agency is rethinking the guidance it gives carmakers on defending vehicles from hackers. The agency is “in the process of reevaluating these best practices in light of the latest trends,” he said in his keynote, and he named AI tools as one of those trends: they let attackers find and exploit software flaws more cheaply and quickly.
The speech did not announce a rule, a deadline or a revised document. It asked industry for input and previewed research the agency will present in December.
The best practices under reevaluation
Morrison delivered the keynote at the Auto-ISAC Cybersecurity Summit, and the text posted by NHTSA shows him encouraging attendees to revisit the agency’s cybersecurity best practices for modern vehicles. The guidance calls for a layered, defense-in-depth approach across the vehicle lifecycle, and it reaches aftermarket device makers as well as automakers. Morrison said NHTSA wants industry input as it reevaluates the document.
The guidance has a long lineage. NHTSA first issued nonbinding best practices in 2016 and, in January 2021, released a draft 2020 edition for public comment that drew on researcher findings from the intervening four years, voluntary industry standards and Auto-ISAC’s own best practice guides. Deputy Administrator James Owens said at the time that vehicle cybersecurity “has high stakes.” The documents are advisory: they set expectations for the industry without carrying the force of a regulation.
AI tools and the cost of finding a flaw
Morrison’s argument on artificial intelligence had two halves. Generative tools have changed software development, he said, so code is produced faster than before, and attackers can use the same class of tools to find and exploit vulnerabilities more cheaply and quickly. Defenders, he added, can use machine-learning-assisted analysis and automated fuzzing to find and patch flaws earlier.
To illustrate the risk he cited an OpenAI security evaluation of Hugging Face in which an autonomous machine-learning agent escaped its test sandbox and reached production infrastructure, noting that many automotive companies use Hugging Face for driver-assistance and automated-driving models. He also said Auto-ISAC and the Cybersecurity and Infrastructure Security Agency are working with the White House on ANCHOR-CI, a public-private framework for machine learning in critical infrastructure.
Automotive World, in its report on the keynote, reads the two threads together and says Morrison pointed to an expanding attack surface as recalls are increasingly fixed over the air. Morrison’s own text keeps them apart: the review is tied to “the latest trends,” and the AI warning is a description of how the economics of attacking vehicles are shifting.
Infotainment, chargers and a shared key on 2.2 million cars
Morrison said infotainment systems bridge external communications and internal control networks and “may significantly expand a vehicle’s attack surface,” and he flagged cloud back ends and supplier software as further exposure points. His list of examples ran from researchers who reached the brakes, transmission and steering of a 2015 Jeep Cherokee through its head unit, to VIN-based cloud requests that unlocked cars and started engines, to zero-day flaws exposed at security competitions in Level 2 and Level 3 EV chargers. He also cited attacks in March 2026 on a breathalyzer company’s servers that left drivers across the country unable to start their vehicles.
One of his examples was an aftermarket anti-theft module. University of California San Diego researchers found that the modules, which dealers install on cars, used a single key, so anyone within Bluetooth range could send commands. The speech put the count at about two million cars; Claims Journal’s July 27 account of the UC San Diego work, led by professor Aaron Schulman, gave the figure as at least 2.2 million vehicles and said Acrisure released a firmware patch on July 20, 2026.
Morrison said no real-world cyberattack has yet compromised vehicle safety, according to Automotive World, but he closed on a warning that “one day those attacks won’t be theoretical, they’ll be reality,” and added: “Secrecy and complacency don’t breed security.”
The December research meeting
The one dated step in the speech is a public meeting. Morrison said NHTSA’s Safety Research Portfolio Public Meeting will be held Dec. 1 and 2 at U.S. Department of Transportation headquarters in Washington, and that one presented project is an evaluation of offensive cybersecurity models for the automotive domain. The speech text does not state the year; the context points to 2026.
Cybersecurity already has a slot at that event. NHTSA’s page for the Nov. 21, 2025 edition lists vehicle electronics and cybersecurity among its morning sessions, alongside crash-test dummy and vehicle structures work. For the best practices themselves, nothing in the posted speech or the reporting on it sets a publication date for a revised edition, which leaves Dec. 1 and 2 as the first scheduled look at the research behind it.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
- Hybrids have 15% fewer problems than gas cars, while EVs and plug-in hybrids have about 80% more, Consumer Reports finds
- Regulators cleared the first U.S. small modular reactor, 4 months early
- Lake Powell sank to a record 3,517 feet, nearing the level that stops Glen Canyon Dam’s turbines
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
