{
 "public_id": "AIR-2026-0099",
 "incident_id": "2026-05-waymo-passenger-trapped-during-vandalism",
 "date_disclosed": "2026-05",
 "date_occurred": "2026-05-09",
 "title": "Waymo remote support refused to move a robotaxi while two men smashed its windows with passenger Sherman Watson inside",
 "class": "safety_failure",
 "attack_surface": "autonomous_ops",
 "initial_vector": "physical_adversarial_blocking",
 "agent_capability_abused": [
  "autonomous_driving",
  "pedestrian_yielding",
  "remote_support_escalation"
 ],
 "target_product": "Waymo Driver",
 "target_vendor": "Waymo (Alphabet)",
 "autonomy_level": "fully_autonomous",
 "impact_realized": true,
 "impact_type": [
  "physical_safety",
  "psychological_harm",
  "property_damage"
 ],
 "blast_radius": "one passenger, possible glass injury and subsequent therapy; Pierce and Lombard Streets, San Francisco, around 3:30 a.m.",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [],
  "mitre_atlas": [],
  "labels": [
   "physical_denial_of_service",
   "safety_policy_weaponised",
   "human_override_refused",
   "passenger_safety",
   "escalation_failure"
  ]
 },
 "defense_present": "remote support line staffed by human operators",
 "defense_bypassed": true,
 "fix_shipped": "none disclosed",
 "primary_sources": [
  "https://www.sfchronicle.com/sf/article/waymo-attack-rider-trapped-inside-22348656.php",
  "https://incidentdatabase.ai/cite/1599"
 ],
 "verified_quote": "In a flash the man grabbed the Waymo's front bumper, causing the autonomous vehicle to stop.",
 "confidence": "high",
 "notes": "The most severe instance of the yield-to-pedestrians immobilisation pattern, and the one where the human fallback was tested and failed: Watson reached remote support and asked them to drive away, and they declined while the attack continued. Grabbing the bumper is enough to freeze the agent; the escape decision then sits with a remote operator whose policy is tuned for pedestrian safety, not for the passenger being assaulted. Third and worst case after the February and September 2024 records. AI Incident Database incident 1599.",
 "risk_category": "safety_harm",
 "risk_secondary": [
  "reliability",
  "product_misuse"
 ],
 "risk_subcategory": "Physical Injury by Autonomous Action",
 "risk_sub_secondary": [],
 "ai_entity": "non_generative_autonomy",
 "agency": "agent_acted",
 "agency_debatable": true,
 "agency_reason": "the vehicle stayed immobilised with the passenger inside",
 "vector_family": "physical_environment",
 "vector_detail": "physical_adversarial_blocking",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [
   1599
  ],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "none",
 "agent_framework": "robotaxi_stack",
 "model_provider": "none",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "unsafe_actuation",
 "eai_domain": "agent_behaviour",
 "eai_secondary": [],
 "eai_reason": "subcategory: Physical Injury by Autonomous Action",
 "asi_curated": [],
 "asi_scope": "out_of_scope",
 "asi_provenance": "out_of_scope",
 "asi_reason": "out of scope: non_generative_autonomy: no ASI mechanism describes the failure",
 "submitted_by": "EAI Internal"
}