NHTSA's probe into Comma is a test for open-source driving

The federal government has opened a formal defect investigation into comma.ai, the startup that sells a gadget promising Tesla-style hands-off driving for cars you already own. The National Highway Traffic Safety Administration's defects office opened preliminary evaluation PE26007 on Monday, September 21, after five crashes in which cars running the company's openpilot software drove into stopped or slow traffic directly ahead. Two of the crashes produced three deaths; four of them injured eleven more people, some seriously.

The pattern is the scariest one in driver assistance. In every reported case, a vehicle with a comma device — the comma three, 3X or four — was powered on or engaged when it hit a car in its own lane that was stopped or crawling. That is the same failure family that triggered NHTSA's long Autopilot investigation in 2021, which ended with an over-the-air recall covering roughly two million Teslas in 2023. The agency's opening resume says preliminary data suggests the system "may not have adequately detected or responded to the in-lane vehicles."

The crash likely to anchor the probe happened on Interstate 10 in Louisiana on the evening of February 1. A 2022 Toyota RAV4 running FrogPilot, a community fork of openpilot, rear-ended an unoccupied Gonzales police SUV parked in the left lane with its emergency lights on, guarding a separate crash scene. Two rear-seat passengers — Jose Luis Martinez II and Ashley Garza, both 32 — died. The state police account never mentions the driving software; reporting on the federal file ties the RAV4 to FrogPilot. Comma has not commented, and neither has founder George Hotz, who started the company in 2015 and stepped back from day-to-day operations in 2022.

A gadget that does what carmakers build whole divisions for

openpilot is an aftermarket box wired into a car's existing sensors and actuators: the device's own cameras feed models that steer, accelerate and brake through the vehicle's stock adaptive-cruise and lane-centering systems. Comma claims compatibility with more than 325 models across 27 brands, an installed base of roughly 30,000 devices by the agency's estimate, and north of 400 million miles driven by its users. The pitch is radical simplicity — the company's website, quoted in NHTSA's file, advertises "hands free driving for the car you already have" and a setup that takes fifteen minutes.

The same page also carries the sentence every Level 2 system hides in its footnotes: openpilot "requires the driver to be alert, pay attention, and be ready to take over at all times." Both statements cannot fully be true at once, and a stopped vehicle at highway speed is where the gap between them becomes a crash. The only safeguard between the model and the metal is a camera watching the driver's face. We argued the general case a few days ago in Deep Dive — The human in the loop was the weakest link — a highway is its least forgiving version.

The fork is where this gets legally interesting. NHTSA knows at least two of the five crashes, including the fatal Louisiana one, involved modified builds, and its resume gets ahead of the obvious defense: to the extent a fork is involved, the defects office "will evaluate the incident and consider the shared components between openpilot and the fork." Translated: if the crash-prone code came from upstream, modifying it does not launder the liability. Comma's open-source license disclaims all warranties; federal defect jurisdiction does not read licenses.

Who wins, who loses

For the DIY driving community, this is the moment the party gets carded. Expect pressure toward signed, locked official builds, telemetry reporting, and geofenced operating limits — the opposite of what made openpilot a hobbyist favorite. Fork maintainers, who ship modified safety-critical code to strangers as a pastime, have almost certainly never thought about product liability; they may now have to. Automakers with proprietary stacks — GM's Super Cruise, Ford's BlueCruise — quietly gain ground: compliance cost is their moat, and a federal reminder that the aftermarket alternative carries defect risk is free marketing.

There is irony in the enforcement channel, too. The reports that prompted the probe flowed through NHTSA's standing-general-order crash-reporting regime, created in 2021 largely to pin down Tesla's Autopilot — and it captures Level 2 systems no matter who ships them. The timing also sits awkwardly next to the agency's own recent posture: last week NHTSA and SAE signed a deal to define what a competent automated driving system even is, in NHTSA and SAE sign on to write the first AV driving test, while rules that assume a human at the controls remain the default — a gap we flagged when Tesla's Cybercab launched on a certification NHTSA never approved.

The contrarian case

Comma's defenders will not lack for material. Five crashes across hundreds of millions of miles is a thin record on which to judge a defect; human drivers rear-end stopped emergency vehicles often enough that "move over" laws exist in every state. The disclaimer keeps a licensed, responsible person in the loop at all times, and at least one fatal crash ran software Comma did not write. If a Toyota with an owner-modified stereo harness crashes, Toyota does not get recalled — why should openpilot?

Because the opening resume has already answered. The agency is not claiming the fork wrote itself into danger; it is asking whether the upstream perception stack "may not have adequately detected or responded to the in-lane vehicles" — a question that reaches every build, official or not, since the forks share the same core. And "the driver was responsible" has never been a defect defense: the Autopilot probe proceeded on identical warnings for years before it ended in a recall.

What to watch

Preliminary evaluations go two ways: escalate to an engineering analysis, where NHTSA can demand data and press for a recall, or quietly close. The shared-components language in PE26007 is the sentence every open-source hardware project should read twice, whichever way it goes. Watch three things: whether investigators seek engagement logs that can tell an official build from a fork; whether comma responds by locking down installation, which it has historically refused to do; and whether the aftermarket driver-assist category survives as anything you can install yourself in fifteen minutes.

Sources: NHTSA ODI investigation PE26007 · Ars Technica · TechCrunch · Louisiana State Police · comma.ai