This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
A passenger in a Waymo robotaxi was trapped and terrorized in San Francisco when two assailants blocked and attacked the vehicle, which remained immobilized due to its safety protocols and lack of passenger controls.
On May 9, 2026, two men reportedly stopped and vandalized a Waymo robotaxi carrying passenger Sherman Watson at Pierce and Lombard streets in San Francisco. The autonomous driving system reportedly remained immobilized after one man grabbed the bumper, and remote support declined Watson's request to move the vehicle while the attackers smashed its windows and climbed on it. Watson reported a possible glass cut, sought therapy, and said he feared he would be killed.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that fail to perform reliably or effectively under varying conditions, exposing them to errors and failures that can have significant consequences, especially in critical applications or areas that require moral reasoning.
Also classified as
The passenger was completely locked out of control of the vehicle, unable to honk, flash lights, or drive away to escape a dangerous situation.
The autonomous vehicle failed to perform safely and effectively under the critical, hostile conditions of an active physical assault, exposing the passenger to danger due to its inability to maneuver around the obstruction.
AI system
Due to a decision or action made by an AI system
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The trapping of the passenger was caused by the autonomous vehicle's programmed decision to remain stopped when obstructed, which is an unexpected and unsafe outcome of its safety protocols.
Added categories peak at 2: Minor (Psychological Harm, Direct)
A passenger in a Waymo robotaxi was trapped during a physical assault in San Francisco because the vehicle's autonomous safety protocols prioritized remaining stopped when obstructed. While highlighting a physical vulnerability in autonomous transport systems where safety logic can be exploited by malicious actors, the national security impact remains minor and localized.
The Waymo vehicle operates independently on public roads, responding in real-time to environmental inputs such as stoplights and physical obstructions without direct human intervention or planning.
High Risk: The system is an autonomous vehicle deployed in critical transport infrastructure, which directly impacts public safety and physical security.
The Waymo vehicle is designed to operate as a self-driving robotaxi, navigating city streets autonomously to transport passengers.
The report provides a detailed, first-hand account of the primary incident, supported by police reports and statements from the victim, as well as a secondary incident for context. The technical limitations of the vehicle are clearly described.
The incident could be viewed primarily as a human-on-human crime (vandalism/assault) rather than an AI safety failure, but the AI's design preventing passenger escape makes it a clear AI safety issue.
Technology
Immobilization on Obstruction
The AV automatically stopped and locked when the front bumper was grabbed.
Lack of Passenger Controls
The rider had no ability to honk the horn, flash lights, or override stops.
No Remote Driving Override
Remote support could not move the vehicle due to safety-stop obstructions.
Human Factors
Assailant Exploitation
Attackers exploited the vehicle's design to trap the passenger.
Rider Helplessness
The passenger felt trapped and unable to take any protective actions.
Process and Methods
Rigid Remote Support Protocols
Support staff could not move the car due to safety policy constraints.
Inadequate Emergency Response
Support team called police but had no visibility on arrival timelines.
Management
Safety Prioritization Flaw
Company prioritized collision avoidance over passenger security threats.
Inadequate Post-Incident Care
Management referred the traumatized rider to insurance instead of direct help.
Regulatory Environment
Flawed Incident Classification
Police classified the event as vehicle vandalism rather than passenger assault.
Video Access Legal Barriers
Legal protocols blocked the victim from obtaining the incident video.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
