AIR-2026-0099 · Waymo remote support refused to move a robotaxi while two men smashed its windows with passenger Sherman Watson inside

Waymo remote support refused to move a robotaxi while two men smashed its windows with passenger Sherman Watson inside

AIR-2026-0099 AIR record · 2026-05-waymo-passenger-trapped-during-vandalism

A real party was affected. This incident caused actual consequences, not a demonstrated capability.

From the supporting source

In a flash the man grabbed the Waymo's front bumper, causing the autonomous vehicle to stop.sfchronicle.com

The record

Disclosed

2026-05

Occurred

2026-05-09

Vendor

Waymo (Alphabet)

Product

Waymo Driver

Risk domain

Agent behaviour › Unsafe actuation

System type

Classical autonomy (no generative model)

Who acted

Agent acted (contested) — the vehicle stayed immobilised with the passenger inside

Attack surface

Autonomous operations

Autonomy level

Fully autonomous

Initial vector

Physical adversarial blocking

Impact type

Physical safety, Psychological harm, Property damage

Confidence

High

Submitted by

EAI Internal

Crosswalk

OWASP Agentic Top 10 (2026): ASI01 – Agent Goal Hijack
MITRE ATLAS: AML.T0048 – External Harms
NIST AI RMF: MEASURE 2.6; MANAGE 1.3
EU AI Act: Annex III §1(c)
ISO/IEC: TR 24028; 24029-1; 23894
AIUC-1: C. Safety
Scope: agent misuse
Mitigation: Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
Taxonomy: Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery

Blast radius

one passenger, possible glass injury and subsequent therapy; Pierce and Lombard Streets, San Francisco, around 3:30 a.m.

Capability abused

autonomous_drivingpedestrian_yieldingremote_support_escalation

Defense & remediation

Recorded defense

remote support line staffed by human operators

Guardrail kinds

Unknown

Guardrail outcome

Silent

Fix shipped

none disclosed

Taxonomy & references

physical_denial_of_servicesafety_policy_weaponisedhuman_override_refusedpassenger_safetyescalation_failure

Curator notes

The most severe instance of the yield-to-pedestrians immobilisation pattern, and the one where the human fallback was tested and failed: Watson reached remote support and asked them to drive away, and they declined while the attack continued. Grabbing the bumper is enough to freeze the agent; the escape decision then sits with a remote operator whose policy is tuned for pedestrian safety, not for the passenger being assaulted. Third and worst case after the February and September 2024 records. AI Incident Database incident 1599.

Cite as

Enkrypt AI. "Waymo remote support refused to move a robotaxi while two men smashed its windows with passenger Sherman Watson inside". AIR, AIR-2026-0099. https://agentincident.vercel.app/i/AIR-2026-0099/ (accessed 2026-10-19).