OSHA filings log more than two dozen hard-braking injuries to Waymo and Zoox test drivers

A stop that hits nothing leaves no dent and no police report, so it never enters the collision comparison the industry publishes to argue that its cars are safer than ours ^[12]. It does enter a workplace injury log, but only if the employer is one that has to file ^[11].

Spread the count over the 24 months it covers and you get roughly one reported injury a month across the two fleets combined ^[10]. That is a small number next to the miles driven. The pattern is what makes it legible: soft-tissue harm of the same family, reported again and again, at two separately run programmes ^[4]. The filings cluster in Los Angeles, Phoenix and San Francisco, which are also among the biggest markets any AV operator is working ^[7].

Teams describe the safety driver as a mitigation, the reason a permit is defensible, and the person who catches what the stack misses. What the filings show is different: the driver absorbing the deceleration that the stack chose. Braking early and hard is the defensible call when the object ahead is ambiguous, and the cost of that call lands on the person strapped into the seat. Some of it does not even happen in traffic. Waymo logged incidents inside service depots ^[5].

The vehicles matter here too. Many of the test cars were not the purpose-built Zoox Robotaxi or the Waymo I-Pace, but Toyota Highlanders retrofitted to carry the sensor stack ^[8]. So the ride being absorbed by a tester is not necessarily the ride a paying passenger gets, which cuts both ways: it weakens any claim that riders are taking the same knocks, and it means the fleet generating the injury data is not the fleet being validated.

The forcing question applies well beyond robotaxis. Draw two axes for whatever you are shipping with a human in the loop. One axis is who absorbs a failure: the paying user, or your own operator. The other is whether your instrument records it: a metric someone reviews, or a form filed elsewhere. Three of those quadrants are managed already. The fourth is not: your own operator absorbs the failure, and the record lands on a workers' compensation form the product team never opens, so what shipped on Monday only becomes visible days later, once someone outside product reads the file. For every automation with a human fallback, the test that travels is simple: name the dashboard where that human's bad day appears. If the answer is a regulator's database and a reporter reading it, that means the fallback was assumed rather than instrumented. Gizmodo's read is that this attention will grow rather than fade ^[14].