EasyMile Self-Driving Shuttle Unexpectedly Stopped Mid-Route, Injuring a Passenger

A self-driving shuttle deployed by Smart Columbus in Linden neighborhood unexpectedly stopped on the street, which caused a woman to fall onto the floor from her seat.

Risk classification

• Primary risk domain: 7 AI system safety, failures, & limitations
• Primary risk subdomain: 7.3 Lack of capability or robustness

The shuttle's AI system failed to perform robustly by incorrectly identifying a non-existent obstacle, leading to an unnecessary and hazardous emergency stop.

Causal factors

• Entity: AI
• Intent: Unintentional
• Timing: Post-deployment

The incident was caused by the autonomous vehicle's AI system making an unexpected emergency stop due to a false positive detection during active deployment.

EU AI Act risk tier

• Risk tier: 2 High Risk

High Risk: The AI system is deployed in public transport and critical infrastructure, where operational failures pose direct risks to physical safety.

AI system and alleged parties

• AI system: EasyMile self-driving shuttle (EasyMile)
• AI purpose: Autonomous Driving; Automatic Fault Handling
• Behaviour type: Autonomous
• Alleged developer: EasyMile
• Alleged deployer: Smart Columbus
• Alleged harmed parties: unnamed woman passenger

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Negligible. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

People affected

• Occurrences reported: 1
• People reportedly harmed: 1
• People reportedly exposed: 2

Potential causes

Management

• Premature Public Deployment: Deploying experimental autonomous shuttles for public transit use too early.

Technology

• Conservative Braking Algorithm: The vehicle was programmed to stop suddenly if any problem was detected.
• False Positive Detection: Sensors detected a non-existent obstacle, causing a ghost braking event.

Data Inputs

• Ghost Obstacle Sensor Data: Sensors registered a ghost obstacle, leading to unnecessary emergency braking.

Human Factors

• Lack of Passenger Restraints: Passengers did not wear seatbelts, leaving them vulnerable to sudden stops.
• Unsafe Seating Configuration: Forward-facing seats lacked barriers or belts to prevent passengers falling.

Process and Methods

• Prototype Passenger Testing: Carrying passengers during the risky prototype phase of the shuttle.

Regulatory Environment

• Inadequate Regulatory Oversight: NHTSA lacked leadership in regulating advanced driving automation systems.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide consistent, clear details about the physical event, the passenger's injury, the immediate regulatory response, and the technical context of false-positive braking.
• Ambiguities identified: The specific sensor input or environmental factor that triggered the false positive stop remains unspecified.
• Alternative interpretations: None, as the physical failure of the autonomous braking system is clearly documented as the sole cause of the passenger's fall.

An EasyMile autonomous shuttle in Columbus, Ohio, executed an unexpected emergency stop due to a false positive sensor detection, causing minor injury to one passenger. This localized safety failure prompted a standard regulatory suspension of passenger operations by NHTSA, representing a minor physical security and critical infrastructure impact with negligible broader national security implications.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: United States
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. The incident represents an ongoing safety and technical capability concern for autonomous transit systems rather than an active, immediate crisis.
• Autonomy: Human-supervised. The shuttle operated autonomously but carried an onboard safety operator capable of monitoring and potentially intervening.
• Novelty: Established threat. False positive detections and conservative braking maneuvers are well-documented technical challenges in autonomous vehicle development.

Impact by dimension

• Physical security: Minor. An autonomous public transit shuttle suffered a sensor failure leading to an abrupt stop and minor passenger injury. While involving public transportation infrastructure, the event was minor and successfully managed through standard regulatory suspension by NHTSA.
• Information security: Negligible. No information warfare, intelligence compromise, or systematic information manipulation occurred during this incident.
• Sovereignty: Negligible. The incident was a localized transit safety event and did not threaten state authority, elections, or core government decision-making.
• Economic security: Negligible. No strategic technology theft, financial system attacks, or critical supply chain disruptions were associated with this localized pilot program failure.
• Societal stability: Negligible. The incident did not involve mass surveillance, systematic discrimination, or threats to civil liberties and societal stability.