Steering a Tesla With a Nintendo Switch 2: How Security Researcher Matthew KuKanich Hijacks the Car's CAN Bus With CAN Commander
Turning Kyoto's latest hybrid console into a full-scale automotive cockpit sounds like a fever dream, yet cybersecurity researcher Matthew KuKanich has turned it into a working hardware demonstration. By running custom user-space (userland) homebrew code on a Nintendo Switch 2 paired with his open-source CAN Commander architecture, the engineer can steer, accelerate, and brake his Tesla directly from the Joy-Con 2 controllers while reading live vehicle telemetry on the handheld's 1080p display.
Switch 2 Userland Homebrew Wired Directly to the Tesla CAN Bus
Matthew KuKanich is no stranger to low-level automotive network research. After co-developing the CAN Commander hardware and software toolkit alongside Rabbit Labs (originally built for the Flipper Zero to handle vehicle network reverse engineering) and previously demonstrating how to pilot his Tesla using an Xbox controller and a motion-sensing Wii Remote, the researcher set his sights on the Nintendo Switch 2.
Rather than spoofing commands through Tesla's official mobile application or routing requests through remote cloud servers, the setup establishes a direct hardware link with the vehicle's internal CAN bus (Controller Area Network). The custom homebrew application running in userland on the Switch 2 communicates with an external transceiver box wired straight into the car's CAN harness. That bridge translates controller inputs on the fly into raw network frames understood by the electric sedan's power steering, drive inverter, and body control modules.
Watching custom software communicate so fluidly with Nintendo's new hardware echoes the rapid progress made by low-level developers in recent weeks, shortly after Valve helped bring a native Nintendo Switch 2 controller and Joy-Con 2 driver to the Linux 7.4 kernel on PC.
Steering, Braking, Gear Shifts, and Emergency Cutoff: Full Joy-Con 2 Mapping
To turn the console's detachable controllers into a responsive driving interface, Matthew KuKanich mapped every primary vehicle control alongside turn signals, wipers, and a dedicated fail-safe release:
| Nintendo Switch 2 Input | Assigned Tesla Function (via CAN Bus) |
|---|---|
| Left Analog Stick | Direct power-steering column control (wheel angle) |
| ZR Trigger | Throttle / acceleration |
| ZL Trigger | Braking |
| A Button | Gear shift toggle between Drive and Reverse |
| L and R Shoulder Buttons | Left (L) and right (R) turn signals |
| X Button | Single windshield wiper sweep |
| Y Button | Horn activation |
| B Button (Long Press / Hold) | Software kill switch: exits the control loop and restores physical vehicle controls |
Requiring a deliberate long press on the B button to terminate the control loop serves as an essential safety mechanism during closed-course testing: it prevents an accidental thumb brush from dropping the connection mid-turn while guaranteeing that the driver can immediately hand authority back to the mechanical steering column and pedals whenever needed.
Two-Way Live Telemetry on the 1080p Screen and Reverse Engineering
The demonstration goes well beyond one-way command injection. Because the CAN Commander link operates bidirectionally, the Nintendo Switch 2's 1080p screen doubles as a real-time digital instrument cluster. The custom interface parses incoming vehicle frames on the fly to display the Tesla's live speed, exact steering angle, currently engaged gear, and hardware link status.
For the hardware community, the project highlights how quickly independent engineers are exploring unsigned userland execution on Nintendo's newest architecture, carrying forward the same inventive spirit seen in retro milestones like the Dolphin Depot homebrew app store bringing 64 applications to the GameCube. On the automotive cybersecurity side, KuKanich's work is a vivid reminder that physical access to an internal CAN bus bypasses high-level software perimeters altogether, granting direct authority over a modern electric vehicle's core actuators.
My Perspective
As a developer who loves digging into low-level Switch 2 architecture, watching userland homebrew parse and inject raw CAN frames with virtually zero latency is pure engineering eye candy. What makes Matthew KuKanich's proof of concept so compelling is its architectural cleanliness: there is no bloated cloud API or network relay in the middle, just direct hardware-to-hardware communication turning the console into a bidirectional diagnostic and control terminal.
Still, as I joked with Heimdall after watching the clip, I am much happier admiring this reverse-engineering feat on an empty lot than on a public highway: the thought of potential Joy-Con drift dictating the steering angle of a two-ton electric sedan is slightly more terrifying than eating a Blue Shell on the final lap of Mario Kart World!
Based on the outskirts of New York City, Chaya 'Chayane' spent five years studying software engineering in Montreal before returning to her home state. A Full-Stack developer and Deep Learning AI architecture researcher, she explores neural networks and algorithmic optimization while engineering data pipelines for Retrocharting and Gamescharting alongside Grimtag. A gamer for over 20 years and an avid collector of Nintendo history and The Legend of Zelda, she explored World of Warcraft's Azeroth before bringing her deep technical background to video game analysis.
