Nobody Believes This Hack Was Real. The Proof Will Change Your Mind.
In this article
**By Andrew — Founder of Signal Reads. Builder, reader, occasional contrarian.**
> **Bottom line:** In July 2015, security researchers Charlie Miller and Chris Valasek remotely hijacked a Jeep Cherokee doing 70 mph on a St.
Louis highway — from ten miles away, using nothing but the car's cellular connection.
Wired journalist Andy Greenberg was behind the wheel when they killed the transmission with a semi-truck closing in behind him.
The clip has resurfaced on YouTube every few years since, and every time, the top comment is some version of "this has to be fake." It isn't.
Fiat Chrysler recalled 1.4 million vehicles within weeks and later paid a settlement north of $100 million to federal regulators.
If you work anywhere near connected hardware, this is still the case study that should keep you up at night.
I watched the video again last week because a reaction channel had clipped it for the third time this year, and the comments were the same as always: staged, CGI, no way a truck does that on command.
I get the instinct. A journalist's hands come off the wheel on a live highway and the dashboard starts acting like it's possessed.
It looks like a movie stunt. It is not a movie stunt, and the fact that it still reads as unbelievable eleven years later is exactly why I wanted to write about it.
Why This Story Keeps Coming Back
The short version: two researchers, Charlie Miller — a former NSA analyst who'd already made a name for himself hacking iPhones and the Nissan Leaf — and Chris Valasek, head of vehicle security research at IOActive, spent almost a year reverse-engineering the Uconnect infotainment system used across Chrysler's lineup.
Uconnect had a cellular radio built in, connected to Sprint's network, meant for things like remote start and navigation.
Miller and Valasek found they could reach that radio from anywhere with a phone signal, use it to rewrite the firmware on the entertainment unit's chip, and from there jump onto the car's internal CAN bus — the network that every component, from the radio to the brakes, uses to talk to each other.
That's the part that should stop you. **An infotainment screen and the braking system were sitting on the same network with no meaningful wall between them.**
Why does a decade-old car hack matter in 2026? Because the underlying pattern — a convenience feature bolted onto a network it should never have touched — hasn't gone away.
It's just moved into EV charging protocols, smart home hubs, and the fleet of always-connected sensors sitting in every modern vehicle.
This wasn't a one-off bug. It was the first mainstream proof that "connected" and "attackable" are the same word.
What Actually Happened on the Highway
Greenberg, then a senior writer at Wired, volunteered to drive the test vehicle while Miller and Valasek worked from Miller's basement, roughly ten miles away.
The plan started small and got worse on purpose. First they took over the air conditioning and cranked it to full blast.
Then the radio, blaring at max volume with no way for Greenberg to turn it down from the dashboard. Then the windshield wipers and washer fluid, smearing his view of the road.
Then it stopped being funny. While Greenberg was driving on I-64 near downtown St. Louis, Miller and Valasek cut the transmission.
The Jeep lost power, dropped speed on a live highway, and a truck he described as "bearing down" closed the gap behind him. He had no way to accelerate out of it.
The only reason it wasn't a highway pile-up was that Miller and Valasek had briefed him in advance and knew exactly when they'd pull the plug.
That's the part skeptics miss when they call it staged. It absolutely was staged — as a controlled demonstration, with the subject's full knowledge and a planned kill switch.
What wasn't staged was the exploit itself. The same technique, run against a stranger's car with no advance warning, would have worked identically and left them with zero ability to recover.
Miller and Valasek didn't stop at the highway demo.
In later research, they showed they could also take control of steering at low speed and disable brakes entirely, though they limited those tests to a parking lot for obvious reasons.
They presented the full research at DEF CON and Black Hat that August, publishing enough technical detail that other researchers could verify every claim independently.
Nobody in the security community disputed it. The dispute only exists in YouTube comment sections.
The Skeptics Have a Point — Just Not the One They Think
Here's where I'll push back on my own framing a little, because good reporting needs the tension, not just the punchline.
The "this is fake" crowd is wrong about the mechanics, but they're picking up on something real: **this exact attack, as demonstrated, doesn't work anymore.** Fiat Chrysler patched the vulnerability, Sprint blocked the specific port Miller and Valasek used, and the auto industry spent the back half of the 2010s segmenting infotainment networks from safety-critical systems specifically because of this research.
Security researchers I've followed since — people building on Miller and Valasek's original work — will tell you the 2015 Jeep exploit is closed.
What isn't closed is the broader class of vulnerability it exposed. Automotive cybersecurity has become its own discipline precisely because this demo worked.
That's the counter-voice worth sitting with: the video feels dated because the industry actually responded to it.
That's a rare good outcome for a security disclosure, and it's part of why the story still gets clipped and reposted — it's one of the few hacking demos with a happy ending you can point to.
What the Record Actually Shows
The paper trail here is unusually solid for a story this viral.
Fiat Chrysler recalled 1.4 million vehicles in July 2015, mailing owners a USB drive with a software patch — an approach that itself drew criticism from security researchers, since USB-based updates carry their own risks.
The National Highway Traffic Safety Administration opened a formal investigation, and in 2015 FCA agreed to a settlement package that included a $70 million civil penalty, with total exposure reported up to $105 million once buyback and incentive provisions were included.
At the time, it was one of the largest penalties NHTSA had levied against an automaker.
Miller and Valasek didn't just walk away after the headlines.
Miller went on to lead security efforts at Uber's self-driving unit and later Cruise; Valasek moved into vehicle security leadership roles across the industry.
Their research became a reference point cited in nearly every serious automotive cybersecurity standard written since, including work that fed into ISO/SAE 21434, the international standard for road vehicle cybersecurity engineering published in 2021.
What This Means If You Build Connected Hardware
If you're shipping anything with a cellular or Wi-Fi radio bolted onto a system that controls something physical — a car, a medical device, an industrial sensor — the Jeep hack is still the cleanest argument you'll find for **network segmentation as a non-negotiable, not a nice-to-have.** The failure wasn't that Uconnect had a vulnerability.
Software has vulnerabilities; that's not news. The failure was architectural: a convenience feature and a safety-critical system shared a bus with no gate between them.
The practical takeaway for engineering teams in 2026 is almost embarrassingly simple, which is exactly why it keeps getting ignored under deadline pressure.
Segment your networks by trust level, assume every internet-facing component will eventually be compromised, and design so that a compromised entertainment system can't touch the brakes — literally or metaphorically.
If your architecture diagram would let a hacked chatbot widget reach your payment system, you've built the 2015 Jeep. Just with different hardware.
Why It's Still on YouTube
I keep coming back to that basement.
Two researchers, a laptop, and ten miles of open air between them and a moving car — and it worked exactly as planned, on the first real-world attempt, against a production vehicle owned by a major automaker.
Greenberg lived to write the article. Not every version of that story ends the same way, which is the whole reason this one is worth remembering instead of laughing off.
Have you ever found a security hole in something you built that made you rethink the entire architecture, not just patch the bug? I'd like to hear about it in the comments.
