Fifty self-driving cars converging on Telegraph Hill at dusk sounds like a software glitch. In reality, it was the world's first real-world distributed denial-of-service attack on autonomous vehicles—orchestrated by a 23-year-old software engineer who's quickly becoming San Francisco's most notorious tech prankster.
Riley Walz, a North Beach resident and self-described data enthusiast, revealed over the weekend that he and approximately 50 accomplices simultaneously ordered Waymo rides back in July to San Francisco's longest dead-end street near Coit Tower at 1 Telegraph Hill Boulevard. The result was exactly what you'd expect: a traffic jam of white Jaguar I-Paces with spinning roof sensors, lined up bumper-to-bumper on the narrow road leading to the iconic Art Deco landmark.
"The plan? At dusk, 50 people went to San Francisco's longest dead-end street and all ordered a Waymo at the same time," Walz posted on X. "The world's first: WAYMO DDOS."
The plan? At dusk, 50 people went to San Francisco's longest dead-end street and all ordered a Waymo at the same time.
— Riley Walz (@rtwlz) October 12, 2025
The world's first: WAYMO DDOS pic.twitter.com/DEDH0tdMKP
Middle School Energy, Tech Execution
The images tell a remarkable story. In the gathering twilight, dozens of autonomous vehicles dutifully arrived to collect their passengers, their headlights creating an eerie procession as they navigated the winding Telegraph Hill roads. One Waymo sports colorful graffiti-style art wrapping its white exterior—a jarring contrast to the fleet of pristine robocars surrounding it. Participants captured the moment from multiple angles: some showing the dense pack of vehicles from street level, others from elevated vantage points revealing the true scope of the automotive congregation.
"Everyone was giddy, and when another car showed up there were cheers," Walz recounted in his post, according to San Francisco Chronicle. "Maybe 3 or 4 real drivers—all laughed and just drove around."
that was wild pic.twitter.com/dCF6ByDf50
— calvin.sh (@Calvin__Liang) October 13, 2025
None of the pranksters actually boarded the vehicles. After approximately 10 minutes of waiting, the autonomous fleet departed, each charging its would-be passenger a $5 no-show fee. The real cost to Waymo was likely higher: the company temporarily disabled all pickups and drop-offs within a two-block radius until the following morning.
A Pattern of Provocative Projects
This isn't Walz's first viral moment. Just weeks before revealing the Waymo stunt, he launched "Find My Parking Cops," an app that tracked San Francisco's parking enforcement officers in real time by reverse-engineering the city's parking ticket system. The app attracted over 50,000 views in its first few hours—before the San Francisco Municipal Transportation Agency shut it down by changing how citation data was published online.
The parking app featured a leaderboard showing which officers issued the most tickets, revealing that some enforcement workers were writing over 100 citations per shift while others managed just 10. According to The Star, his mother Stacey Walz expressed both pride and concern: "I'm really scared. I know he's just on the brink. But of all the people in the whole world, he inspires me."
Other Walz creations include "Bop Spotter," which uses a pole-mounted phone in the Mission District to Shazam songs playing on the street 24/7, and "IMG_0001," which cycles through millions of early iPhone videos uploaded with default filenames. He's also reportedly scraped Spotify data from political figures, including Vice President JD Vance's listening history.
Waymo's Troubled Year
The Coit Tower prank arrives during a particularly challenging period for Waymo's San Francisco operations, which have faced everything from coordinated vandalism to becoming unwitting props in political protests.
In August, prosecutors charged 45-year-old Walker Reed Quinn with four separate vandalism incidents targeting Waymo vehicles in the SoMa neighborhood. The incidents escalated from placing traffic cones on sensors to stomping through windshields while passengers were inside. Quinn allegedly committed these acts while out on bail for previous vandalism charges—including earlier Waymo damage.
The company's troubles with serial vandal Quinn represent a different threat than Walz's coordinated prank. While Walz paid the no-show fees and caused only temporary inconvenience, Quinn's alleged attacks caused thousands of dollars in property damage and created safety risks for passengers.
Even more dramatic incidents have occurred beyond San Francisco. In June, Fortune reported at least six Waymo vehicles were vandalized—some torched completely—during anti-ICE protests in downtown Los Angeles. The company suspended service across the region as protesters used the autonomous vehicles as both targets and makeshift barricades during confrontations with authorities.
In January, an attempted hijacking of a Waymo taxi was thwarted by LAPD in downtown Los Angeles, adding carjacking to the list of security challenges facing driverless vehicles.
Even law enforcement hasn't been immune to Waymo mishaps. In September, San Bruno police officers pulled over a Waymo that appeared to be fleeing a DUI checkpoint—though the vehicle, operating without passengers, was simply following its navigation algorithms.
Stress Test or Security Risk?
Online reaction to Walz's stunt split sharply. Some saw it as a harmless technical experiment that revealed potential vulnerabilities. "They were not vandalizing the vehicles and they paid the no show fees," one commenter noted on X, according to San Francisco Chronicle. "Waymo should be doing this kind of thing itself."
Others raised darker implications. "Someone will figure out how to use this to jam up traffic in targeted urban centers on election day," one user warned. Another suggested the stunt could violate federal computer fraud and abuse laws, though legal experts would likely debate whether ordering rides constitutes unauthorized system access.
For his part, Walz praised Waymo's response. "Waymo handled this well," he said, noting the company's ability to identify the coordinated attack and implement geographic restrictions. "I assume this isn't much different than if a big concert had just ended." The comparison isn't unreasonable—major venues regularly generate surge demand for rideshare services, though typically not to dead-end streets with limited egress.
Waymo spokesperson statements to Road & Track emphasized the company's experience managing high-demand situations: "We are always refining our system to manage distribution at specific locations, ensuring we balance our service's physical footprint with the need to deliver an excellent rider experience." The company noted it provides hundreds of thousands of fully autonomous trips weekly across five cities with over 2,000 vehicles.
The Philosophy of Following Through
Walz, who co-founded data company Numerous.ai, has defended his provocations as experiments driven by curiosity rather than malice. "You have to follow through on your ideas because if you don't, you might stop having them," he told The Star, describing creativity as a muscle requiring constant exercise.
His apartment reportedly features satirical "city signs" mocking California's now-overturned shoplifting laws, and his roommate Mehran Jalali—also a tech entrepreneur—quipped that "when Andy Warhol said everybody will be famous for 15 minutes, he forgot to say that Riley Walz will do it a million times over."
Whether Walz's projects represent valuable stress tests of urban systems or reckless provocations depends largely on perspective. What's undeniable is that they highlight real vulnerabilities in how cities integrate emerging technologies. The parking enforcement app revealed how easily public data can be weaponized against the agencies providing it. The Waymo "DDOS" demonstrated that coordination among relatively few people can temporarily overwhelm autonomous vehicle distribution systems.
Why This Matters Now
Walz waited three months to publicly reveal the July incident, posting about it only on October 12. The timing coincides with growing national attention on autonomous vehicle regulation and safety. California regulators continue expanding Waymo's operating permissions while grappling with incidents ranging from minor traffic violations to serious collisions.
The broader question is whether pranks like this illuminate genuine security concerns or simply inspire copycat disruptions. As autonomous vehicles proliferate across American cities—Waymo now operates in San Francisco, Los Angeles, Phoenix, and Austin, with Miami and Atlanta expansions planned—their vulnerability to coordinated human interference becomes increasingly relevant.
For now, Waymo appears to have adapted its systems to detect and respond to unusual demand patterns. But as Walz's exploit demonstrates, the gap between technological sophistication and human creativity remains entertainingly—and potentially troublingly—wide.
