Physical 'DDOS' Prank Clogs San Francisco Streets With 50 Waymo Robotaxis

A coordinated effort by a group of pranksters to flood a single San Francisco street with autonomous vehicles has highlighted a novel security vulnerability in robotaxi fleets. The incident, which cybersecurity experts describe as a physical "Distributed Denial-of-Service" (DDOS) attack, demonstrated how easily AI-driven transport can be manipulated through the strategic abuse of its own service logic.

Organized by tech prankster Riley Walz, the event involved 50 individuals who simultaneously ordered Waymo robotaxis to the city's longest dead-end street. The resulting pileup clogged local traffic and blocked legitimate users from accessing the service in the immediate area. The vehicles waited for approximately 10 minutes before automatically departing the scene. Each no-show request triggered a $5 fee. In response to the disruption, Waymo disabled all ride requests within a two-block radius of the location until the following morning. While the details were shared in October, the event occurred in July.

The New Attack Surface

This incident is a physical manifestation of a DDOS attack, where a system is overwhelmed by a flood of requests to the point of failure. Unlike traditional hacking, which targets software vulnerabilities or encrypted data, this exploit targeted the intended operational logic of the Waymo platform. Because these vehicles rely on cloud connectivity and AI to manage fleet distribution, they can be tricked into creating physical bottlenecks without a single line of code being breached.

Experts warn that while this specific prank was relatively harmless, the underlying vulnerability is significant. There is growing concern that generative AI could eventually allow malicious actors to automate and scale these disruptions, moving beyond coordinated groups of humans to algorithmic attacks that could paralyze urban transit on a larger scale.

A Call for Regulation

The event underscores a critical gap in current robotaxi regulation, specifically regarding the intersection of cybersecurity and physical safety. The ability to manipulate a fleet into creating traffic hazards suggests that digital security is no longer just about data privacy, but about public safety in the physical world.

Louay Abdelkader, director of product management at QNX, argued that the industry needs a regulatory shift. Abdelkader stated that lawmakers should make cybersecurity a primary consideration for autonomous vehicles, akin to how airbags became a federally mandated safety requirement for all cars. The goal is to move cybersecurity from an optional feature to a primary safety standard.

What Remains

While Riley Walz suggested that Waymo handled the situation well—comparing the event to the surge of traffic following a large concert—the incident leaves open questions about how autonomous fleets will prevent similar exploits. It remains to be seen if Waymo or other robotaxi operators will implement new safeguards to detect and block coordinated "no-show" patterns in real-time to prevent future physical gridlock.