Why the loudest security warnings about China's biggest lidar maker may be aimed at the wrong layer of the stack.
On July 7, 2026, CNBC ran a story headlined around a now-familiar accusation: Hesai Technology, the Shanghai-based lidar giant with deepening ties to Nvidia's autonomous-driving platform, is a "cyber risk" and a "direct risk to national security." It is the latest entry in a genre that has been building for two years — a genre in which a Chinese sensor company is cast as a Trojan horse rolling into American driveways, warehouses, and city streets, three million laser eyes quietly reporting home to Beijing.
It is a compelling story. It is also, on the engineering merits, a story that deserves a much harder cross-examination than it usually gets. This piece is that cross-examination. It is written deliberately as a devil's advocate: not to insist that Hesai is harmless, not to wave away the genuine geopolitical questions, but to argue the case that the industry's own engineers have been making, quietly and unglamorously, for years — that a lidar unit is a dumb sensor until somebody else's software makes it smart, and that most of the threat narrative confuses the sensor with the system it plugs into.
If we are going to build national policy around this technology, we should at least get the technology right first.
Let's state the prosecution's case fairly, because a devil's advocate who strawmans the other side isn't worth reading.
The concern rests on three pillars. First, the corporate one: the U.S. Department of Defense placed Hesai on its Section 1260H list of "Chinese Military Companies." The Pentagon briefly removed the company in 2024 after Hesai sued, then relisted it in October 2024 citing additional evidence. In July 2025, a federal district court upheld the designation; Hesai has appealed. Meanwhile, U.S. senators including Rick Scott, Marsha Blackburn, and Bernie Moreno have pressed Treasury and the SEC to force a delisting of Hesai's shares. Hesai itself has acknowledged in investor disclosures the ordinary-but-unnerving reality that the Chinese government "may influence or intervene" in its operations. In an era of strategic competition, a market-leading sensor supplier with that profile is a legitimate policy concern regardless of what its hardware does.
Second, the technical one, and it is the sharpest: Duke University professor Miroslav Pajic has demonstrated in his lab that a compromised lidar unit can be made to lie. After activating malware embedded in the sensor, his team caused a phantom person to appear in the point cloud, and in separate tests made real, physically present obstacles vanish from the sensor's output. Pajic's point is that malware could be inserted at the factory during production or pushed later through a firmware update, and that similar attacks could theoretically be aimed at whole fleets of autonomous vehicles operating in cities. A car that can be told a pedestrian isn't there is not a hypothetical horror.
Third, the scale one: Hesai is not a boutique. It is the world's volume leader in automotive and robotics lidar, and its expanding partnership with Nvidia means its sensors are becoming a default option automakers can drop into a mainstream autonomy platform. Ubiquity is itself a risk multiplier. If you were going to worry about one lidar company, you'd worry about the biggest.
None of that is fabricated. The devil's advocate concedes all of it. The question is what it actually adds up to — and here the story starts to fray.
Strip away the geopolitics for a moment and look at the device on the bumper.
A lidar sensor fires laser pulses and measures how long they take to bounce back. Out of that, it produces a point cloud: a dense spray of three-dimensional coordinates, essentially a list of "there is a reflective surface at this distance and angle, right now." That's it. The raw output of a lidar is not a decision, not a label, not a map of "pedestrian" and "stop sign" and "curb." It is geometry. A firehose of dots.
Everything that turns those dots into behavior — object detection, classification, tracking, path planning, the choice to brake or swerve — happens downstream, in perception and autonomy software that is almost never written by the lidar maker. In the Hesai–Nvidia arrangement that triggered the latest round of alarm, the sensor feeds into Nvidia's platform. The intelligence, the judgment, the code that decides whether that cluster of points is a child or a shadow, lives with the automaker and its perception stack — not inside the Chinese sensor.
This is the "dumb sensor" argument, and it is not Hesai spin invented for a bad news cycle. It is simply how the autonomy industry is architected. Sensor vendors sell photons and timing. Perception vendors sell meaning. The whole business model of companies building autonomous systems is that they own the brain and treat sensors as interchangeable, commoditized inputs — which is precisely why an automaker can offer Hesai as "one of the options" alongside others. You do not architect your safety-critical decision-making around a component you consider a black box you can't trust; you architect it so the component is replaceable and its output is validated.
Hesai's CEO made the corollary point directly in response to the CNBC piece: the hardware has no onboard storage, so it is incapable of retaining what it sees, and whatever data the sensor feeds into a partner's system belongs entirely to that partner, beyond Hesai's reach. Whether or not you trust the messenger, the architecture claim is checkable, and it matters.
The most emotionally resonant version of the threat is the surveillance one: millions of Chinese sensors mapping American roads, ports, and bases, streaming it all back to Shanghai. It is worth taking seriously precisely because it is so intuitive — and it is worth noticing how quickly it runs into the actual design of the device.
By Hesai's account, and consistent with how automotive lidar is generally built, these units have no mechanism to store even a second of what they observe, and no way to transmit data wirelessly — no cellular radio, no Wi-Fi, no Bluetooth. The only path for the point cloud to leave the sensor is a one-way wired connection into the host vehicle, where the data is owned and controlled by the customer. A sensor with no memory and no radio is a poor spy. It cannot phone home because it has no phone. It cannot keep a diary because it has no drawer to put one in.
Could those claims be false? In principle. But this is exactly where the threat discourse should get more technical and instead usually gets less. If the accusation is that Hesai units contain hidden storage or covert transmitters, that is a falsifiable, testable claim. You can X-ray the board. You can put the device in a Faraday cage and watch for emissions. You can monitor the wire. Independent labs, insurers, and government buyers do this kind of teardown routinely. A hidden cellular modem on a mass-produced automotive part sold into a hostile regulatory environment would be one of the easiest-to-discover and most catastrophic-to-the-vendor design decisions imaginable. The espionage theory asks us to believe Hesai bet its entire global business on a secret that a single competent teardown would expose.
That doesn't make it impossible. It makes it the kind of claim that should come with evidence from a lab, not adjectives from a press release.
Now the harder part, because the honest devil's advocate has to engage Pajic's work rather than dodge it. His demonstrations are real and important. But look closely at what they actually establish.
First, note that Pajic himself says it is "easy to physically spoof lidar" — and much of the academic literature on the subject, going back years, involves attacking lidar from the outside with lasers and photodiodes, using off-the-shelf parts against sensors from many manufacturers, including Western ones. Spoofing a lidar with a cleverly timed laser is a property of lidar as a sensing modality, not a property of Hesai as a Chinese company. If external spoofing is the worry, then every lidar on every robotaxi from every vendor shares it, and the fix is sensor fusion and anomaly detection in the perception layer — not a country-of-origin ban.
Second, the malware demonstration — the phantom pedestrian, the vanishing obstacle — is genuinely alarming, but notice the premise: it requires malicious code already inside the unit, placed at the factory or delivered by firmware update. That is a supply-chain and firmware-integrity problem. And supply-chain and firmware-integrity problems are exactly the class of risk that is managed, not by trusting or distrusting a brand, but by controlling the update path, signing and verifying firmware, and validating sensor output against independent sensors. Pajic's own framing — that any lidar can be compromised with factory malware or a tainted firmware push — is an argument for rigorous firmware governance across the board. It is not, on its own terms, an argument that Hesai specifically has done this.
Which is the uncomfortable irony at the center of the alarm. The spoofing research is often cited as proof that Hesai is dangerous. Read carefully, it proves that lidar is spoofable and that firmware is the attack surface — two facts that apply to the whole industry and that point squarely at the perception-and-integration layer as both the vulnerability and the mitigation. It is evidence for the "dumb sensor, smart software" model, not against it. The sensor is the thing being lied to or lied through; the software is the thing that has to catch the lie.
Every argument in the indictment — the sensor is spoofable, the firmware is an attack surface, the vendor sits under a foreign jurisdiction — generalizes. Point it at the rest of the market and watch how little of it is actually specific to Hesai.
On spoofing and firmware, there is nothing special about Hesai's boxes. RoboSense, Seyond (formerly Innovusion), Innoviz, and Ouster's own OS series lidar and Velodyne-derived units are all spoofable by the same laser tricks and all carry the same firmware-integrity exposure. That is a property of lidar as a modality, not of the flag on the housing. A ban that targets one vendor's serial numbers while leaving the identical attack surface on every other vendor's hardware isn't a security policy; it's a market intervention wearing one.
On jurisdiction, the concern is at least consistent — but consistency is the problem. If the worry is Chinese law compelling data handover, it lands on RoboSense or LS Lidar exactly as hard (Both are Chinese; the Pentagon added RoboSense to its 1260H list in 2026). That's a coherent position, and it's a fair reason not to wave away the China-origin question. But notice what it is: a country argument, not a Hesai argument. It says nothing about Israeli-founded Innoviz or American Ouster, whose sensors are architecturally identical to Hesai's. If the real objection is "made in China," the honest move is to say so plainly and argue it as trade and industrial policy — not to dress a country-of-origin rule as a claim about one company's uniquely dangerous hardware.
And then there are cameras, which is where the surveillance theory should lose its nerve. A camera records actual images — faces, license plates, storefronts, the inside of a garage — and plenty of networked cameras ship with onboard storage and wireless links. If your fear is a foreign sensor hoovering up identifiable imagery of American streets, a camera is a dramatically better spy than a lidar point cloud, which is anonymized geometry by construction. Yet the alarm is loudest about the sensor that sees the least about you. That inversion is a tell that the argument is tracking something other than the actual data-exfiltration risk.
There's one more piece the coverage tends to leave out: who is doing the shouting. The loudest push to bar Hesai from the United States has not come only from think tanks and members of Congress — it has come from a direct competitor. Ouster, which owns Velodyne, has sued Hesai over patents and moved to block its imports, reportedly spent roughly $800,000 lobbying in Washington while casting Hesai as a data-security and national-security risk. Hesai's own response was blunt: its CFO called the campaign xenophobic and "downright un-American" — competitive tactics dressed up as patriotism.
Be fair about what that does and doesn't prove. A rival's self-interest does not make the security concern false; Ouster can be both self-interested and partly right, and the government's own actions against multiple Chinese lidar firms did not originate in Ouster's lobbying shop. But when the entity most loudly demanding a ban is the one positioned to absorb the banned company's market share, that is a reason to demand independent evidence, not to take the alarm at face value. Security policy laundered through a competitor's income statement should clear a higher bar of proof, not a lower one.
If you want to test whether the "Chinese Trojan horse" narrative holds together, stop looking at Hesai for a second and look at the American company that chose to build on top of it. Because the single most awkward fact for the alarmist story is this: Nvidia — a U.S. company, arguably the U.S. company of this technological moment, with more to lose from a security scandal than almost any firm on earth — didn't just tolerate Hesai. It picked Hesai as its default.
In March 2026, Hesai was named the primary lidar partner for Nvidia's DRIVE AGX Hyperion 10, the reference compute-and-sensor architecture Nvidia sells to automakers as a turnkey, Level 4–ready autonomy platform. That is not a peripheral supplier relationship. It means that when an OEM builds a self-driving car on Nvidia's flagship stack, the Chinese sensor everyone is warning about is the one that comes in the box by default. In the same window, Hesai joined Nvidia's Halos AI Systems Inspection Lab — described as the first ANAB-accredited inspection lab for AI-driven physical systems — specifically to validate its lidar for functional safety, cybersecurity, and AI compliance. Nvidia is simultaneously being told Hesai is a national-security threat and choosing to make it the standard eye of its autonomous fleet.
So ask the obvious question the headlines don't: why would Nvidia do that if Hesai were what its critics claim?
Consider what's actually at stake for Nvidia. Its automotive business hit a record $2.3 billion in fiscal 2026, up 39%, and the company is betting far bigger — it has partnered with Uber to stand up a 100,000-vehicle, Level 4–ready mobility network beginning in 2027, and it's in full production on autonomy for marquee customers like Mercedes-Benz. Nvidia's entire automotive thesis rests on convincing regulators, insurers, automakers, and the riding public that its self-driving platform is safe. A single credible demonstration that a core, default component was secretly exfiltrating data or could be remotely told to make pedestrians disappear would not dent that business — it would detonate it, along with a chunk of the most valuable brand in computing. Nvidia has vastly more to lose from a compromised Hesai unit than Hesai does.
Now weigh the two explanations. Either Nvidia — with its resources, its security organization, its lawyers, and its existential exposure to exactly this risk — somehow failed to notice a threat that a cable-news segment and a Senate letter caught. Or Nvidia looked at the same sensor, evaluated it the way an integrator actually evaluates hardware, and concluded that a validated, fused, firmware-governed lidar is a component it can safely stand behind because the trust lives in Nvidia's layer, not Hesai's. One of those explanations requires believing the most sophisticated systems company in the world is asleep at the wheel of its own fastest-growing division. The other just requires believing that engineers understand their own architecture.
This is the part the "Trojan horse" story has to explain away, and it usually just doesn't try. If the sensor were the intelligent adversary the framing implies, the rational move for Nvidia would be to design it out — and it has every technical and legal reason to. Instead it did the opposite: it pulled Hesai deeper into a formal, accredited safety-and-cybersecurity certification process, under Nvidia's own control, on Nvidia's own turf. That is not the behavior of a company that thinks it's holding a live grenade. It is the behavior of a company that thinks it's holding a commodity sensor whose output it fully governs.
None of this is a character reference for Hesai, and it isn't meant as one. Nvidia's judgment is not infallible, and a commercial partner has its own incentives to downplay risk. But the certification cuts the other way from the accusation: an integrator with everything to lose chose to validate this hardware rather than avoid it. Follow the incentives and the picture inverts. The people with the most to lose from a compromised Hesai unit — the integrators whose software actually drives the car — are the ones choosing to certify and deploy it, precisely because they hold the layer where trust is actually enforced. When your prime example of a national-security menace is a component that the most security-exposed American tech company willingly made its default, the burden of proof shifts. "It's dangerous" now has to explain why the people most endangered by it disagree.
Here is the crux the headlines keep skating past. A Hesai unit sitting in a warehouse or on a highway does nothing on its own. It becomes a functioning perception system only when a vendor — frequently a Western one — writes and owns the code that ingests the point cloud and acts on it. Industrial deployments pair Hesai hardware with third-party perception software; automotive deployments run it into platforms like Nvidia's. The "smart" is added downstream, by companies operating under U.S. and allied jurisdiction, with their own security teams, their own validation pipelines, and their own commercial incentive to never let a sensor silently dictate a safety decision.
That architecture is not a loophole; it is the mitigation. If you don't trust the sensor, you don't have to. You put it behind a perception layer you do control, you cross-check it against radar and cameras, you reject outputs that don't cohere, and you own the firmware update process end to end. This is standard defensive design, and it is available today without banning anyone. The threat model that treats the sensor as an autonomous adversary quietly assumes the integrator is asleep — when the integrator's entire job, and liability, is to not be.
It's also worth being honest about Hesai's compliance posture, not because certifications settle a geopolitical dispute but because they're part of the factual record: the company says it holds ISO/IEC 27001 information-security certification and a top-tier TISAX assessment, and it participates in — sometimes leads — international lidar safety and test-method standards bodies. A firm angling to smuggle backdoors into critical infrastructure is playing a strange long game by simultaneously submitting itself to the audit regimes designed to catch exactly that.
The corporate pillar of the accusation leans hard on a single implied word: controlled. The mental image is of a company that is effectively an arm of the Chinese state, its cap table stacked with government entities, its board taking orders from Beijing. It's worth actually looking at who owns Hesai, because the ownership structure is one of the least state-entangled of any major Chinese technology company — and that's not a talking point, it's on the public record.
Hesai is a Nasdaq-listed company (it went public in 2023) structured through a Cayman Islands holding entity, subject to U.S. securities disclosure. Its principal shareholders, per those disclosures, are private venture and strategic investors — Lightspeed's funds, Bosch, Xiaomi, Baidu — alongside its founders and insiders, who hold a substantial block, and institutional investors who collectively own roughly 45%. These are German industrial firms, U.S.-based venture funds, and Chinese private tech companies. What you do not find among the principal holders is a Chinese state-owned enterprise or a government fund holding a controlling or even a significant stake. By Hesai's account and its defenders', direct Chinese-government ownership sits below 2% — a rounding error, not a control position, and far lower than the state stakes embedded in many Chinese firms that draw less security attention.
This matters because it punctures the strongest emotional version of the corporate argument. "The Chinese government may intervene" is, as a matter of Chinese law, a sentence that can be written about virtually any company operating in China — it's a jurisdictional risk, not evidence of a specific ownership or control relationship. But when the concrete claim escalates from "subject to Chinese law like everyone else" to "state-controlled instrument of Beijing," the cap table is allowed to have a vote, and the cap table says otherwise. A company that is 45% institutional, heavily insider- and founder-owned, backed by Bosch and Lightspeed, and less than 2% government-held is not, on the ownership evidence, the wholly-owned puppet the framing needs it to be.
The honest caveat cuts the other way too, and I'll put it plainly so this doesn't read as a whitewash: ownership percentage is not the same as leverage. The Chinese state has tools — regulatory, legal, informal — that don't require equity, and a 2% stake tells you nothing about what a government could compel in extremis. But that's a very different, and much weaker, claim than the one usually made. "China could pressure any firm in its jurisdiction" is true and applies to the entire Chinese economy; "Hesai is state-owned and state-directed" is a specific factual assertion, and the shareholder register does not support it. If the case against Hesai has to quietly downgrade from the second claim to the first to survive contact with the ownership data, that tells you something about how much of the original alarm was built on an image rather than a filing.
None of this means the policy hawks are simply wrong, and a piece that pretended otherwise would be as dishonest as the coverage it critiques.
There are real arguments on the other side, and they deserve to be stated in full. Firmware integrity is only as good as the update channel, and a vendor that can push signed updates can, in principle, push a malicious one — trust in the sensor ultimately collapses into trust in whoever controls its firmware keys, and for Hesai that is a company operating under a government that reserves the right to intervene. The ownership data above tempers this but doesn't erase it: a sub-2% state stake means Beijing doesn't own Hesai, but jurisdictional leverage doesn't run through equity, so "who could be compelled to sign a bad update" is a fair question even for a privately held firm. Certifications and one-way cables describe today's shipping products; they don't bind future revisions, and an adversary playing a long game would behave impeccably right up until it didn't. Concentration is its own hazard: even if any single unit is benign, standardizing critical American infrastructure on one geopolitically exposed supplier creates a coercion and single-point-of-failure risk that has nothing to do with hidden modems. And "you can just audit it" is easier to say than to do at fleet scale, across firmware versions, forever. Analysts at hawkish think tanks like the Foundation for Defense of Democracies have laid out the critical-infrastructure and military-adjacent versions of these worries in detail, and dismissing them as mere protectionism would be its own kind of intellectual dishonesty. Some of the impulse here is industrial policy dressed as security — but some of it is security, and telling the two apart is the actual work.
The point of the devil's advocate is narrower and, I think, more useful: the dominant framing has the abstraction layer wrong. It treats a geometry-producing, memoryless, radio-less component as if it were the intelligent agent in the system, when the intelligence — and therefore the real, addressable risk — lives in the software and the supply-chain governance around it. That misdiagnosis matters, because it produces the wrong remedies. If the fear is espionage, the honest response is a teardown and an emissions test, and a demand that specific evidence be produced. If the fear is spoofing, the response is sensor fusion and anomaly detection, which every serious autonomy stack already needs against a modality that is spoofable regardless of nationality. If the fear is firmware sabotage, the response is signed updates, controlled update channels, and output validation — again, engineering, applied to the whole industry. And if the fear is really strategic dependence on a Chinese champion, then that is a legitimate industrial-policy debate that should be argued on those terms, openly, rather than smuggled in under the language of "cyber risk" and "the sensor is watching you."
Hesai may well deserve to lose its case in the court of policy. Reasonable people can conclude that the concentration risk and the firmware-trust problem are disqualifying on their own, and that's a defensible position honestly held. But it should lose, if it loses, for reasons that survive contact with how the technology actually works — not because "Chinese lidar" makes a better headline than "the perception stack is where your security lives." The sensor is dumb. The debate around it shouldn't be.
.svg)
Please share your details with us so we can best assist you.
Alternatively if you are in a rush you can find time to meet with us here
.svg)