Aito M9

Security Grade

Calculator v1

AITO M9

   Brand: AITO (Parent: Seres Group)

   Category: Car • Model / Gen: 1 Max, Ultra (EREV and EV versions)

   Release Date: 2023-12-26 • Status: In sale

   Classification Date: 2025-10-05 • Official Website

Security Evaluation

Criterion	Value	Proof	Comment
Known hardware tampering	None	🔗 Proof	Extremely complex and integrated vehicle system. Physical tampering would require authorized tools and diagnostics. No reports of supply chain tampering.
Known vulnerabilities	Rare	🔗 Proof	Runs a closed HarmonyOS ecosystem. Huawei's dedicated Product Security Incident Response Team (PSIRT) manages vulnerabilities, which are patched via mandatory OTA updates.
Prior attacks	None	🔗 Proof	No publicly documented, widespread security breaches have been successful against the AITO vehicle platform.
Updatability	Very common	🔗 Proof	Receives frequent and comprehensive Over-the-Air (OTA) updates for the intelligent cockpit, advanced driving system (ADS), and vehicle control units
Category Score	Score: 2 / 3

Criterion	Value	Proof	Comment
Authentication with other systems	Full	🔗 Proof	Maintains a persistent, secure, and encrypted connection to the AITO/Huawei cloud for remote control, vehicle status, and data services.
Communications	Encrypted with up-to-date encryption	🔗 Proof	All Vehicle-to-Cloud (V2C) and Vehicle-to-App (V2A) data transmissions are protected by end-to-end encryption.
Storage	Encrypted with up-to-date encryption	🔗 Proof	All sensitive user data, including biometric information and driving logs, is encrypted at rest both on the vehicle's internal storage and in the cloud.
Category Score	Score: 1 / 3

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	Requires an AITO/Huawei ID for full functionality. Supports multiple driver profiles with granular permissions and personalized settings.
Authentication	Secure	🔗 Proof	Multi-modal authentication: Phone as a Key (PaaK via Bluetooth/UWB), NFC card, 3D facial recognition for driver profile login, and an in-vehicle PIN for sensitive operations.
Brute-force protection	Exist	[1] 🔗 Proof]	In-vehicle systems lock out after multiple incorrect PIN/authentication attempts. The cloud account has standard server-side brute-force protection.
Event logging	Access event logged	[2] 🔗 Proof]	The vehicle maintains comprehensive logs for access, driving data, and system diagnostics. Cloud account access is also logged for security audits.
Passwords	Require change after setup with complexity requirements	🔗 Proof	The required AITO/Huawei account enforces password complexity. The in-vehicle PIN must be set up by the user after vehicle delivery.
Category Score	Score: 1 / 3

Property	Details
Operating System & App	HarmonyOS Cockpit (Companion App: AITO App (for iOS and Android))
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity:
Physical (Dimensions & Mass)	Dimensions: 5230 x 1999 x 1800 mm • Mass: ~2560 - 2725 kg