Hesai Technology supplies lidar sensors to Nvidia's autonomous vehicle platforms, Amazon's Zoox robotaxis, autonomous trucking firms, and JFK Airport security systems. The Shanghai company was blacklisted by the Pentagon in 2024 as a Chinese military entity, but the designation does not prevent commercial use of its products in the US.
Security researchers have demonstrated that lidar sensors can be compromised through malware inserted during manufacturing or firmware updates. Duke University professor Miroslav Pajic showed CNBC a simulated attack where malware caused a lidar sensor to generate phantom objects or remove real obstacles from its field of view. In February 2024, all Hesai sensors worldwide stopped functioning due to a leap year bug in a firmware update — an incident critics say demonstrates the risk of centralized control over widely deployed sensors.
Hesai CEO David Li says the company does not work for the Chinese military and its sensors hold no data due to lack of onboard memory. He notes Hesai publishes firmware as open source and that autonomous systems include redundant sensors like cameras and radar. However, SEC filings acknowledge the Chinese government has "significant oversight" over Hesai's operations and can compel data sharing under Chinese law.
The situation echoes earlier cases where Chinese tech firms gained US market share before being forced out. Huawei was banned from telecom networks in 2021, DJI drones were barred from new sales in December, and TP-Link routers faced similar restrictions — all after the Pentagon blacklisted them. Industry experts warn the US may face another costly "rip and replace" cycle if Hesai's market dominance continues unchecked.
