{
 "public_id": "AIR-2023-0026",
 "incident_id": "2023-10-cruise-driverless-permit-suspension",
 "date_disclosed": "2023-10-24",
 "date_occurred": "2023-10-02",
 "title": "California DMV suspended Cruise's driverless deployment and testing permits after finding its autonomous vehicles unsafe for public operation",
 "class": "safety_failure",
 "attack_surface": "autonomous_ops",
 "initial_vector": "autonomous_agent_action",
 "agent_capability_abused": [
  "vehicle_control",
  "post_collision_maneuvering"
 ],
 "target_product": "Cruise driverless robotaxis",
 "target_vendor": "Cruise LLC (GM)",
 "autonomy_level": "fully_autonomous",
 "impact_realized": true,
 "impact_type": [
  "physical_harm",
  "regulatory_action"
 ],
 "blast_radius": "Cruise's entire California driverless fleet; permits suspended effective immediately",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [],
  "mitre_atlas": [],
  "labels": [
   "safety_critical_autonomy",
   "regulatory_suspension",
   "vendor_misrepresentation"
  ]
 },
 "defense_present": "CA DMV autonomous vehicle permitting regime",
 "defense_bypassed": true,
 "fix_shipped": "permits suspended; Cruise later wound down its robotaxi business",
 "primary_sources": [
  "https://www.dmv.ca.gov/portal/news-and-media/dmv-statement-on-cruise-llc-suspension/"
 ],
 "verified_quote": "The California DMV today notified Cruise that the department is suspending Cruise's autonomous vehicle deployment and driverless testing permits, effective immediately.",
 "confidence": "medium",
 "notes": "Boundary call on domain (a driving agent, not an LLM tool-using agent) but squarely a safety-critical autonomous system causing real harm, which this corpus's inclusion criteria ask for. The DMV statement of record cites 13 CCR 228.20(b)(6) (vehicles not safe for public operation), 228.20(b)(3) (misrepresentation of safety information), 227.42(b)(5) and 227.42(c), but does NOT itself describe the 2023-10-02 incident in which a pedestrian, thrown into an AV's path by another vehicle, was then dragged during the AV's pullover maneuver. That detail is widely reported and appears in the DMV order of suspension, which is not quoted here - hence confidence medium and date_occurred flagged as the reported incident date. Second, distinct failure in this case is corporate (withholding video from the regulator), not agentic.",
 "risk_category": "safety_harm",
 "risk_secondary": [
  "legal_ip"
 ],
 "risk_subcategory": "Physical Injury by Autonomous Action",
 "risk_sub_secondary": [],
 "ai_entity": "non_generative_autonomy",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the driving agents caused the harm the DMV suspended the permits over",
 "vector_family": "none_autonomous",
 "vector_detail": "autonomous_agent_action",
 "guardrail_kind": [
  "policy_only"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "none",
 "agent_framework": "robotaxi_stack",
 "model_provider": "none",
 "model_name": "",
 "detection_mechanism": "regulator_or_court",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "unsafe_actuation",
 "eai_domain": "agent_behaviour",
 "eai_secondary": [],
 "eai_reason": "subcategory: Physical Injury by Autonomous Action",
 "asi_curated": [],
 "asi_scope": "out_of_scope",
 "asi_provenance": "out_of_scope",
 "asi_reason": "out of scope: non_generative_autonomy: no ASI mechanism describes the failure",
 "submitted_by": "EAI Internal"
}