BYD investigates remote-access demonstration on Shark 6 ute

BYD investigates Shark 6 demonstration

BYD Australia has begun an internal investigation after an ABC Four Corners demonstration showed a researcher remotely operating functions on a Shark 6 plug-in hybrid ute. In a statement reported by CarExpert and the NRMA’s Open Road, BYD said it was reviewing allegations of unauthorised access to what it described as non-critical vehicle controls and would respond in detail after completing its investigation. ¹³

BYD Australia chief operating officer Stephen Collins told Open Road that the company was still establishing precisely how the tested ute was accessed and whether the issue extended to other vehicles. He gave no timeframe for completing the investigation. Collins said BYD intended to make its position public, although he was unsure whether it would release a full report. ¹

What the test demonstrated

Cybersecurity researcher Dan Hreszczuk remotely operated the Shark 6’s headlights, wipers, door locks, audio and infotainment functions, according to Open Road’s account of the Four Corners test. CarExpert reported that some functions, including the headlights, were operated while the ute was being driven. Open Road also reported that Hreszczuk tracked its location and accessed its cabin microphone to hear a phone conversation. He was unable to access the brakes. ¹³

This was not a demonstration of someone gaining immediate access to an unfamiliar passing vehicle. Open Road reported that Hreszczuk had physical access to the ute for around two weeks and reportedly tapped into its CAN bus, the network used by vehicle electronic control units to communicate. The ABC reported that he subsequently found a digital access point without password protection. The Auto Wire noted that the published account did not establish whether that point could be reached without the preceding hands-on work. ¹⁵

Vezess, attributing its account to Carscoops and Four Corners, reported that the ABC driver knew about the demonstration and was travelling at about 30km/h on a straight section of road during the headlight test. The Auto Wire placed the road demonstration outside Canberra. Those conditions define what was shown: interference with lighting on a moving Shark 6 during a prepared test, rather than an unannounced attack on a passing ute. ²⁵

The test also showed a separate way vehicle audio could expose personal information. The Auto Wire reported that Hreszczuk played assembled voice commands through the ute’s speakers, prompting a phone left unlocked inside to disclose an address, date of birth and contact number through Siri. Vezess likewise reported that the phone was unlocked. That part of the demonstration depended on the phone’s voice assistant; it did not show the vehicle’s systems directly accessing the phone’s stored information. ⁵²

Questions BYD is examining

BYD Australia public relations director Paul Ellis told Open Road that the company had asked the ABC whether additional hardware was connected to the Shark 6 during the remote demonstration. Collins said it was too early to determine whether any vulnerability established by BYD’s investigation could be fixed with a software update. How initial access was achieved and whether other vehicles are affected therefore remain questions for the investigation. ¹

Before the Four Corners broadcast, news.com.au reported a BYD spokesperson’s statement that the company was reviewing the ABC’s claims and would respond after receiving further information and completing its investigation. Collins’s subsequent comments to Open Road gave more detail about its scope, including the question of whether the issue extends beyond the tested ute. ⁴¹

Australian data and privacy-policy questions

BYD said in its statement, reported by Open Road and CarExpert, that personal data generated by its vehicles in Australia is stored on Australian servers. Collins told Open Road that Australian customers’ personal in-car data was held locally on Telstra servers and governed by Australian law. Ellis said he had been told someone in China could not access that data. Open Road reported that BYD took on notice a separate question about possible overseas transfers through third-party software or hardware connected to its vehicles. ¹³

CarExpert reported that wording about surveillance activities appeared in a BYD privacy policy before that policy was replaced by one limited to website data. Open Road, however, reported finding the wording in BYD’s general Australian privacy policy when it accessed the page on 25 September 2026. It did not find the wording in archived vehicle-data and app policies it examined from July 2025 and July 2026. Neither account establishes that the cited general-policy wording describes what a Shark 6 collects or where its data is transferred. ¹³

Calls for connected-vehicle rules

BYD has called for purpose-built Australian connected-vehicle legislation with an enforceable standard applying equally to all brands, according to its statement reported by Open Road and CarExpert. Collins told Open Road that BYD would consult authorities and comply with requirements adopted by legislators. Separately, RMIT cybersecurity researcher Adam Bartley told news.com.au that Australia needed clearer oversight of vehicle data and audits to establish whether manufacturers were complying with Australian law. ¹³⁴