Back to the Future Promised Flying Cars by 2015. Tesla Flew One in 2026

October 21, 2015 was Marty McFly's Back to the Future Part II arrival date. The flying car arrived eleven years late at SpaceX's McGregor site. On October 15, 2026, Tesla livestreamed a white Roadster climbing a ramp, flipping inverted, and coming down on its wheels. Elon Musk called it the product of "the world's best car company and the world's best rocket company" making "something that you haven't seen in any movie," then said "Flying cars are real." He noted the demo ran remotely with nobody inside "to make sure we don't kill anyone," success was not guaranteed, and the car is "not necessarily a safety optimized." Electrek reported the remote plan in August.

Let's look into Back to the Future 2015 predictions against what gadgets shipped by 2026, with the security fine print each device brought along the way.

Marty's gadgets worked the day he bought them and every day after. Ours come with an app, an account and an update channel, so the thing in your hand can change after you pay for it. In February 2019, GearBrain reported that a firmware update left the Android app unable to pair with Nike Adapt BB shoes, while the buttons on the shoe still tightened the laces. List every office device that phones a vendor's cloud, name the person who reads its update notices, and write down what it does when that cloud goes dark.

Doc Brown needed 1.21 gigawatts. Tesla brought a fan and some very cold gas. Fox Business reported that fan-based suction pinned the Roadster to the ramp until it was upside down, that its cold-gas thrusters were developed with SpaceX, and that Tesla showed 0 to 60 mph in under one second. Bring earplugs or binoculars: Electrek reported spectators would stand several hundred yards back because the thrusters are loud enough to damage hearing.

The flight was a hop with a roll in it, which is still more air time than any car on the 2015 calendar managed.

We queried the National Vulnerability Database the morning after the flight and found 24 CVEs matched to Tesla products, published from February 2017 to July 2025: 14 rated High, 10 Medium, none Critical. Twenty-one sit on the cars (Model 3 appears in 11, Model S in 7, Model X in 5), two on the Wall Connector charger and one on a SolarCity solar gateway.

Method: NVD CVE API 2.0, virtualMatchString=cpe:2.3:*:tesla:*, run October 16, 2026, n = 24. A keyword search returns 40, adding NVIDIA's Tesla GPUs, third-party apps and four car flaws filed against suppliers' parts, so the true car count runs a few higher.

The whole check is one line, and 24 is the output that mattered: curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?virtualMatchString=cpe:2.3:*:tesla:*" | jq '.totalResults'

Eleven of the 21 car flaws can be exploited without physical access to the car. The newest Model 3 entry, CVE-2025-2082, starts with a tampered certificate response from a tire pressure sensor and ends with an attacker sending messages onto the car's CAN bus. We checked the day after the flight: the company building a car that flies has two dozen published flaws in products that stay on the ground.

A remotely flown car takes commands over a link by design, and anything that takes commands can be attacked through them. In February a Tesla vice president told a Senate committee its driving controls "cannot be accessed from outside the vehicle." Keen Security Lab had shown otherwise in 2016, controlling a Model S remotely through its CAN bus.

Keen did it on an unmodified car running the latest firmware, in parking and driving mode, according to its September 2016 write-up. Electrek adds that the researchers reached the brakes from 12 miles away, that Tesla patched the flaws within 10 days, and that there is no evidence of a malicious takeover outside research. Nothing public describes how the McGregor car's control link was secured. For a business, the same test applies to anything it runs from an app: find the link, then find out who else can talk to it.

The real 2015 delivered a car hack before a flying car. NHTSA recall 15V-461, filed July 23, 2015, covered 1,416,903 Chrysler, Dodge, Jeep and Ram vehicles whose radios had "software vulnerabilities that can allow third-party access to certain networked vehicle control systems," fixed by a mailed USB drive after the carrier closed the open cellular connection.

Tesla's cars get attacked in public, on purpose. At Pwn2Own Vancouver 2023, Synacktiv took unconfined root on the Model 3 infotainment system for $250,000, and the team won $35,000 at Pwn2Own Automotive 2026 for a USB attack on Tesla infotainment. A remotely flown car adds the control link itself: who can send commands, how each is authenticated, and what happens if the link drops mid-roll. A bug bounty program scope should ask the same three.

Every connected thing a business buys brings a vendor, an update channel and a remote path in. Our threat data page tracks the attacks reaching small offices today, and the cybersecurity services list covers audits that find those paths first.

• IMDb: Back to the Future Part II (1989)
• Tesla: Roadster reservations and trims
• NIST NVD: CVE API documentation
• NHTSA: Vehicle recall lookup
• Zero Day Initiative: Pwn2Own results blog

Back to the Future Part II is a 1989 Universal Pictures film directed by Robert Zemeckis. The NVD is maintained by the US National Institute of Standards and Technology, and Pwn2Own is run by Trend Micro's Zero Day Initiative.

Sources: Fox Business, Tesla's new Roadster makes flying debut; Electrek, Tesla flying Roadster demo with no driver; NIST NVD, CVE API query for Tesla products; NHTSA, recall 15V-461; Zero Day Initiative, Pwn2Own Vancouver 2023 day two; BleepingComputer, Pwn2Own Automotive 2026; GearBrain, Nike Adapt BB firmware fault.