Abusive ex-partner remotely controlled Tesla via app to harass and endanger victim

The event demonstrates how remote vehicle controls, intended for parental monitoring or fleet management, can be repurposed for coercive control. The abuser exploited Tesla’s app to enforce speed limits, adjust climate settings, and lock the victim out of her own car, actions that escalated from harassment to direct safety threats. This wasn’t a hack or exploit; it relied on legitimate app functionality granted through shared account access or retained permissions after a relationship ended.

For engineers, the incident highlights the need to audit permission models in connected devices. Tesla’s app appears to allow unilateral control changes without secondary authentication, even after a user’s access should have been revoked. The lack of alerts or logs for such changes left the victim unaware of how her car was being manipulated. Similar risks exist in other IoT systems where shared access persists beyond its intended context.

The case also underscores the limitations of technical solutions alone. While Tesla could implement stricter permission revocation or anomaly detection, abusive partners may still gain access through social engineering or shared credentials. Engineers must design for adversarial use cases, such as requiring explicit reauthorization for high-risk actions or providing victims with tools to detect and block unauthorized control changes.

Beyond Tesla, the incident reflects broader challenges in securing connected devices against domestic abuse. Smart home systems, wearables, and even shared cloud accounts can become tools for surveillance and control. The event suggests a need for industry-wide standards to address coercive access, such as mandatory permission reviews after relationship changes or emergency revocation features for victims of abuse.