Hesai Faces U.S. Cybersecurity Blacklist Scrutiny
CNBC reported on July 7, 2026 that Hesai Technology, a Chinese lidar maker with an expanded partnership with Nvidia on autonomous-vehicle platforms, faces renewed cyber-risk scrutiny stemming from the U.S. Department of Defense's designation of Hesai as a "Chinese military company," first issued in January 2024. According to CNBC, AUVSI CEO Michael Robbins pointed to a 2024 incident in which a Hesai firmware update miscalculated the leap year and disabled lidar units on February 29 as evidence sensors could be disabled or exploited remotely; Hesai has said the bug affected only two older L4 mechanical lidar models, not its automotive AT128 sensors or OEM customers. For practitioners integrating lidar into robotics or AV perception stacks, this is a concrete illustration of firmware and supply-chain risk in safety-critical AI systems.
The Hesai story is less about a new designation than about a specific, non-hypothetical failure mode that gives the abstract "foreign lidar as backdoor" concern a concrete anchor: a firmware bug that already disabled sensors once, whether or not that particular incident was malicious.
What happened
CNBC reported on July 7, 2026 that Hesai Technology, a Shanghai-based lidar maker, faces renewed scrutiny over cybersecurity risk tied to its lidar sensors and its expanding relationship with Nvidia. The U.S. Department of Defense first added Hesai to its list of "Chinese military companies" in January 2024; Hesai sued, the DOD removed the company from the list in August 2024 for not meeting legal criteria, then relisted it in October 2024 based on new information, and Hesai's legal challenge remains active, with an appeal filed after a federal court upheld the designation in mid-2025.
Technical context
According to CNBC, Michael Robbins, CEO of the Association for Uncrewed Vehicle Systems International, cited a February 29, 2024 incident in which a Hesai firmware update failed to account for the leap year, causing lidar units to stop working, as an example of how a firmware push could in principle be used to disable sensors intentionally rather than by error. Hesai's own public response at the time said the bug affected two older L4 mechanical lidar models specifically, was identified and fixed within about 24 hours, and did not affect its automotive AT128 sensor or any OEM or passenger-vehicle customers -- a materially narrower scope than an "every lidar in use" framing.
For practitioners
Hesai and Nvidia have worked together since 2019, and the relationship has deepened: Hesai was selected as a lidar partner for Nvidia's DRIVE AGX Hyperion 10 reference architecture for Level 4 autonomous vehicles, and in March 2026 Hesai joined the NVIDIA Halos AI Systems Inspection Lab, an ANSI-accredited program for validating safety, cybersecurity, and AI compliance in physical AI systems, according to Hesai's own announcement. That combination -- a hardware vendor under an active foreign-entity national-security designation, deeply embedded in a major AI compute platform's autonomous-vehicle reference stack -- is what elevates a firmware bug from an operational nuisance to a policy question about supply-chain trust for safety-critical AI sensors.
What to watch
Watch the outcome of Hesai's pending appeal of the DOD designation, any additional guidance from the Pentagon or automotive OEMs on qualifying non-U.S. lidar suppliers, and whether Nvidia or its automaker partners place new firmware-auditability or supply-chain requirements on lidar vendors following this reporting.
Key Points
- 1CNBC ties Hesai's Nvidia-linked lidar business to a 2024 DOD 'Chinese military company' designation that Hesai is still appealing.
- 2A 2024 leap-year firmware bug that disabled some Hesai lidar units is cited as evidence sensors could be disabled deliberately.
- 3Hesai says the bug hit only two older lidar models, not its automotive AT128 sensor or OEM customers, a narrower scope than alleged.
Scoring Rationale
A well-corroborated national-security/supply-chain story with direct relevance to safety-critical AI systems (autonomous-vehicle lidar deeply embedded in Nvidia's AV reference stack), strengthened by a concrete, independently verified precedent (the 2024 firmware bug) rather than a purely hypothetical risk. Held below 'major' because the core DOD designation is not new (Jan 2024) and the cyber-risk framing itself rests on a single CNBC report and a source (AUVSI) with an advocacy interest, with Hesai's own narrower account of the firmware incident noted.
Sources
Public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
