Australian cybersecurity firm FortifyLabs has shown it could take partial remote control of a BYD Shark 6 Premium, the same plug-in hybrid bakkie sold in South Africa. Once its software was installed, researchers could switch on the vehicle's call microphone, track its location in real time and turn its headlights on and off from a laptop.

The test was carried out for the Australian broadcaster ABC's Four Corners programme, which aired in September.

The details matter more than the headline. FortifyLabs used its own 2025 Shark 6, fully updated as of 16 July 2026, and needed physical access to the vehicle first to install software on the infotainment unit using a publicly known technique.

"From that point onwards, connectivity and control of the software functioned remotely," the firm said. It would not reveal the technique, but said it was easy to repeat and could work on other cars that use Android-based infotainment systems, not only BYD's.

The access was limited to the entertainment and phone system. BYD's protections stopped the researchers from reaching more sensitive parts of the vehicle, such as its cameras, and nothing in the demonstration involved steering or braking. South African cybersecurity expert Boikokobetso Makhetloane told CarTalk that BYD patched the weakness last week.

"Think of your car as a computer with wheels," he said. Because the infotainment system connects to the driver's phone, someone with access could learn who is calling, listen through the hands-free microphone and follow the car's movements.

FortifyLabs was clear that this is not a Chinese problem: "It applies to all vehicle manufacturers," it said, naming cars from the US, Europe and the rest of Asia.

MyBroadband's Luis Monzon reported the test and its relevance to South African Shark 6 owners. FortifyLabs' own follow-up explains that ABC asked it to simulate the kind of remote access a car manufacturer has to a connected vehicle, and how that access could be abused. CarTalk with Jacob Moshokoa carried Makhetloane's advice for local drivers, including keeping the car's software updated.

Headlines about hackers "remotely operating" cars suggest someone could crash yours from a laptop. That is not what this test showed. The realistic risk is privacy: someone who has had your car for a while, at a workshop, a valet stand or in a relationship gone wrong, could later track where it goes and listen to calls.

That makes it much closer to the case of a Tesla controlled through an ex-partner's app than to a remote hijacking. It also is not an electric vehicle issue. Any modern car with a connected infotainment system that links to your phone carries some version of this risk.

The practical steps are simple: install the car's software updates as they arrive, be careful who has unsupervised access to your vehicle, and for businesses running fleets, treat a vehicle's infotainment and telematics like any other connected device, with update and access policies. As more connected cars arrive here, from electric bakkies to Chinese plug-in hybrids, those habits matter more.

You might also like our piece on Eskom's first public EV chargers, the Ampath patient data breach, and managing SIM cards in connected devices.

Get more SA tech and business news and subscribe to The Open Letter.