Xiaomi SU7 vehicle moved remotely without owner authorization in China
A Xiaomi SU7 electric vehicle in Shandong, China unexpectedly moved forward from a parked position on 30 September 2025 when no one was inside the vehicle. Xiaomi's investigation found that the vehicle received a Remote Parking Assist command from an iPhone 15 Pro Max within Bluetooth range, and the company acknowledged customer service confusion about device identification.
What happened
On 30 September 2025, a Xiaomi SU7 owner in Shandong, China reported that their parked vehicle suddenly moved forward without anyone inside. Video footage showed the blue vehicle advancing from an open parking area at the owner's home while both the owner and a woman inside the house were present.
Xiaomi's investigation found that the vehicle received a Remote Parking Assist (RPA) command from an iPhone 15 Pro Max in Bluetooth range. The investigation concluded that the car's backend data, operation logs from the iPhone 15 Pro Max, response times, and parking exit instructions precisely matched. The RPA feature activates parking exit operations when activated via smartphone app within Bluetooth range.
Reported impact
The owner initially contacted Xiaomi customer service after the incident. The company's online customer service initially attributed the movement to a command from an iPhone 16 before later clarifying confusion over device model identifiers. The vehicle's unexpected movement caused alarm to the owner and occupants who were unaware the parking assist function had been activated.
Index analysis
The incident involved unintended activation of the RPA feature, which operates without human intervention once triggered. Xiaomi attributed this to a mismatch between the device identifier (iPhone16,2) and the actual device model (iPhone 15 Pro Max), suggesting a potential lack of clarity in how the system distinguishes between connected devices or how users understand device authorization.
Governance controls
Xiaomi assembled a special task force to investigate the incident, obtaining backend vehicle data and operation logs from the two authorized phones with the owner's consent. The company acknowledged confusion in its customer service communication regarding device model identification and committed to optimizing and improving service processes going forward.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.