Waymo Robotaxi Reportedly Remained Immobilized While Vandals Smashed Vehicle with Passenger Inside

On May 9, 2026, two men reportedly stopped and vandalized a Waymo robotaxi carrying passenger Sherman Watson at Pierce and Lombard streets in San Francisco. The autonomous driving system reportedly remained immobilized after one man grabbed the bumper, and remote support declined Watson's request to move the vehicle while the attackers smashed its windows and climbed on it. Watson reported a possible glass cut, sought therapy, and said he feared he would be killed.

Risk classification

• Primary risk domain: 7 AI system safety, failures, & limitations
• Primary risk subdomain: 7.3 Lack of capability or robustness

The autonomous vehicle failed to perform safely and effectively under the critical, hostile conditions of an active physical assault, exposing the passenger to danger due to its inability to maneuver around the obstruction.

Additional risk subdomains

• 5.2 Loss of human agency and autonomy: The passenger was completely locked out of control of the vehicle, unable to honk, flash lights, or drive away to escape a dangerous situation.

Causal factors

• Entity: AI
• Intent: Unintentional
• Timing: Post-deployment

The trapping of the passenger was caused by the autonomous vehicle's programmed decision to remain stopped when obstructed, which is an unexpected and unsafe outcome of its safety protocols.

EU AI Act risk tier

• Risk tier: 2 High Risk

High Risk: The system is an autonomous vehicle deployed in critical transport infrastructure, which directly impacts public safety and physical security.

AI system and alleged parties

• AI system: Waymo autonomous driving system (Google)
• AI purpose: Autonomous Driving; Navigation Assistant
• Behaviour type: Autonomous
• Alleged developer: Waymo, Automated driving system developers
• Alleged deployer: Waymo, Robotaxi operators, Automated driving system deployers
• Alleged harmed parties: Waymo passengers, Sherman Watson, Robotaxi passengers, Road users, Passengers

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Minor, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Psychological

Reported: The report explicitly describes psychological harm and trauma suffered by the passenger.

Directly caused: Watson experienced ten minutes of terror during the attack, believing he was going to die, and subsequently sought therapy to process the trauma.

Inferred additional harm: The passenger in the second fall 2024 incident likely experienced significant anxiety and distress from being blocked and harassed by strangers while trapped in the vehicle.

People affected

• Occurrences reported: 2
• People reportedly harmed: 1
• People reportedly exposed: 2

Potential causes

Management

• Safety Prioritization Flaw: Company prioritized collision avoidance over passenger security threats.
• Inadequate Post-Incident Care: Management referred the traumatized rider to insurance instead of direct help.

Technology

• Immobilization on Obstruction: The AV automatically stopped and locked when the front bumper was grabbed.
• Lack of Passenger Controls: The rider had no ability to honk the horn, flash lights, or override stops.
• No Remote Driving Override: Remote support could not move the vehicle due to safety-stop obstructions.

Human Factors

• Assailant Exploitation: Attackers exploited the vehicle's design to trap the passenger.
• Rider Helplessness: The passenger felt trapped and unable to take any protective actions.

Process and Methods

• Rigid Remote Support Protocols: Support staff could not move the car due to safety policy constraints.
• Inadequate Emergency Response: Support team called police but had no visibility on arrival timelines.

Regulatory Environment

• Flawed Incident Classification: Police classified the event as vehicle vandalism rather than passenger assault.
• Video Access Legal Barriers: Legal protocols blocked the victim from obtaining the incident video.

Information quality

• Classification confidence: High
• Reason for confidence: The report provides a detailed, first-hand account of the primary incident, supported by police reports and statements from the victim, as well as a secondary incident for context. The technical limitations of the vehicle are clearly described.
• Ambiguities identified: The exact object used by the assailants is described vaguely as 'the shape of a stick' and 'something heavy'.
• Alternative interpretations: The incident could be viewed primarily as a human-on-human crime (vandalism/assault) rather than an AI safety failure, but the AI's design preventing passenger escape makes it a clear AI safety issue.

A passenger in a Waymo robotaxi was trapped during a physical assault in San Francisco because the vehicle's autonomous safety protocols prioritized remaining stopped when obstructed. While highlighting a physical vulnerability in autonomous transport systems where safety logic can be exploited by malicious actors, the national security impact remains minor and localized.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: United States
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. Reflects ongoing, long-term safety and regulatory challenges for autonomous vehicle deployment rather than an active national security crisis.
• Autonomy: Full autonomy. The vehicle operated with full autonomy, executing its programmed safety protocols to remain stationary despite passenger distress and lack of manual overrides.
• Novelty: Evolved capability. Represents an evolved threat where actors exploit the predictable safety logic of autonomous systems to immobilize them and harass occupants.

Impact by dimension

• Physical security: Minor. The incident highlights a physical vulnerability in autonomous transportation systems where safety protocols can be exploited to trap passengers, though the national security impact remains minor and localized.
• Information security: Negligible. No information warfare, intelligence compromise, or systematic disinformation was associated with this incident.
• Sovereignty: Negligible. The incident was a local criminal matter with no impact on state sovereignty or core government operations.
• Economic security: Negligible. While causing minor property damage to a commercial operator, the incident does not threaten strategic economic or technological security.
• Societal stability: Negligible. This was an isolated local crime and does not represent a large-scale threat to societal stability or civil liberties.