A Device Hidden in Cars Across the US Leaves Them Vulnerable to Hacking and Paralysis. Patch It Now

Security researchers have uncovered a troubling vulnerability in millions of cars across the US, and it has nothing to do with the vehicle manufacturer. According to recent reporting, car dealerships have been installing third-party alarm systems in vehicles and leaving them active even when buyers opt out, creating a massive attack surface that hackers can exploit to unlock, track, and completely disable cars remotely.

The systems in question are aftermarket devices added by dealerships, often as part of financing agreements or upsold security packages. Here's the problem: even if a buyer declines the service or stops paying for it, the hardware often remains installed and connected. That means potentially millions of vehicles are running vulnerable systems their owners don't even know exist.

Researchers demonstrated they could remotely unlock doors, kill engines, and track vehicle locations in real time. The implications go beyond individual car theft. This is the kind of flaw that could enable targeted harassment, stalking, or coordinated attacks on fleets. It also highlights a broader issue in the automotive supply chain: who is responsible for security when third parties modify vehicles after they leave the factory?

The vulnerability sits at the intersection of two ongoing problems in tech. First, the Internet of Things security nightmare, where connected devices ship with weak defaults and no clear update path. Second, the opacity of the modern car, which is less a single product than a stack of hardware and software from dozens of vendors, each with different security standards and lifecycles.

Dealerships are not software companies, and they're not set up to push security patches or monitor for intrusions. That creates a gap where devices can sit unpatched for years. If you financed a car in the last decade and were offered any kind of remote start, tracking, or security package, there's a real chance you're affected.

The immediate action is to contact your dealership and ask whether any third-party telematics or alarm system is installed in your vehicle, even if you declined or canceled the service. If it is, insist they either update the firmware or physically remove the device. Don't assume that because you're not paying for a service, the hardware isn't active.

What this means for you: this is a reminder that security is only as strong as the weakest connected component, and in modern vehicles, that's often not the car itself but the add-ons. If you're building or evaluating AI systems that interact with physical infrastructure like vehicles, supply chain security and third-party risk need to be front and center. Try this prompt with your AI assistant: "I'm evaluating a connected product that integrates third-party hardware. Walk me through a security checklist covering vendor vetting, update mechanisms, and decommissioning procedures."