Researchers Show a $100 Coin-Sized Device Can Hack a Boeing 737's Autopilot

A team of academic researchers says they can hijack a Boeing 737's autopilot and falsify critical flight data using a device the size of a coin that costs less than $100 to build.

The researchers, from the University of California San Diego and Oberlin College, are presenting the work Wednesday, August 12, 2026, at the Usenix Cybersecurity Conference, according to Wired. The project took more than a decade and required buying tens of thousands of dollars in real 737 components to test the attack against actual hardware, Wired reported.

The device plugs into a port accessible through a hatch on the plane's exterior, one that maintenance crews and airport staff routinely use between flights. Wired reports it takes less than a minute to install. Once connected, the Wi-Fi-enabled implant can inject electrical signals onto one of the 737's internal data networks, the same network that feeds the autopilot and displays values like total aircraft weight and outside air temperature, both of which factor directly into takeoff calculations.

The researchers say the device can silently alter those numbers while spoofing the correct readings on the pilot's display, so a crew would have no visual indication anything is wrong. Stefan Savage, a UC San Diego computer science professor who led the project, told Wired the whole effort started with a simple question: "If you could get 60 seconds with an airplane, what could you do?"

The answer, according to the research, is substantial. Wired reports the manipulated data could cause runway overruns during takeoff, unauthorized diversions into another country's airspace, or in a worst case, a crash. The researchers argue this kind of physical-access attack gives a saboteur more stealth, control, and deniability than something crude like planting an explosive.

What's proven and what isn't

This is a demonstrated proof-of-concept built and tested by credentialed academic researchers on real aircraft components, not a theoretical claim. It has not been reported as something that has happened to an actual passenger flight, and Wired's reporting does not cite any confirmed real-world incident where this technique was used against a commercial airliner.

The vulnerability rests on a real, physical design feature, an externally accessible maintenance port, that the researchers say is routinely reachable by ground crews and airline staff. Whether that access point is realistically exploitable by an outside attacker without insider help, airport security cooperation, or specialized knowledge of 737 internals is a fair open question the available reporting doesn't fully resolve. Airports and airlines maintain their own physical security protocols around aircraft on the ground, and the research doesn't establish how those existing safeguards would perform against a real attempt.

This is not a remote hack. It's not something that can be done over the internet or from a passenger seat mid-flight. It requires physical proximity to a parked aircraft and roughly a minute of uninterrupted access, a bar that filters out casual attackers but does not filter out anyone with insider access or the ability to pose as maintenance staff.

The bigger picture on aviation cybersecurity

Wired frames this as part of a broader pattern. Cars, medical devices, water utilities and power grids have all proven vulnerable to digital sabotage in recent years, while aircraft computer systems have largely stayed outside the reach of hackers, until now. The researchers themselves are the ones making the comparison, and they have an obvious interest in emphasizing the significance of their own work.

Neither Boeing nor the Federal Aviation Administration is quoted in the available reporting responding to these specific findings. That's a notable gap. A vulnerability disclosure of this magnitude, aimed at the autopilot and takeoff systems of one of the most widely flown commercial aircraft in the world, should draw an on-the-record response from the manufacturer and the regulator responsible for certifying it airworthy.

The unresolved question is what happens next. Academic researchers typically follow responsible disclosure norms, meaning Boeing and aviation regulators may have already been notified privately before the Usenix presentation. Whether the FAA opens a formal review of maintenance port security across the 737 fleet, and whether Boeing issues any hardware or protocol fix, are the concrete developments worth watching in the weeks following this disclosure.