alt Hacker NewsLLM seems to think it’s Toyota/Lexus based on an open source alternative client[1] documenting the same APIs that appear in the blog post.
A cursory glance seems to suggest it’s right and it took less than 2 mins to both ask and check its answer, which is a little scary.
[1] https://github.com/ide/lexy/blob/main/docs/vehicle-status-an...
I received an email from Toyota asking me to connect to a newly-purchased vehicle in their app. I hadn't actually purchased a Toyota, but I went ahead and installed the app to see what it would do, and I ended up having full access to someone's car. I could see the car's location, lock/unlock it, and even start the engine remotely. I did try to contact Toyota about the issue through various channels and never got a response.
If they can't get the simple parts of security right, like verifying a user's email before creating an account and linking it to a vehicle, then I have little confidence in the security of other parts of their systems.