Updated July 2026 · Free · No sign-up

Is a hidden alarm putting your car at risk?

Security researchers at UC San Diego found a Bluetooth flaw in a dealer-installed car alarm called KARR — and it's in an estimated 2 million-plus US cars. Many owners never asked for it and don't know it's there. The good news: checking takes about a minute, and the fix is free.

Check my car (60 sec) Skip to the free fix

What it is: a KARR / SWDS dealer alarm Who's affected: cars sold at many US dealers since 2017 Cost to fix: $0

Step 1 — Check in 60 seconds

Three signs your car has it

You don't need any app or tool to check. Look for any one of these — most affected cars show the sticker and the blinking light.

A "KARR" window sticker

Usually on the driver's-side window or windshield corner. The brand name is printed plainly.

On the glass

An "SWDS" sticker

Stands for SouthWest Dealer Services — the installer. Often appears alongside or instead of the KARR sticker.

On the glass

A small blinking light

A little button or box with a blinking LED tucked under the dashboard, near the steering column.

Under the dash

No sticker but unsure? Check your original dealer paperwork for "KARR," "SWDS," or an alarm/anti-theft add-on — or just run the fix below anyway; it's free and harmless if your car doesn't have the device.

What it is

A car alarm you may never have asked for

KARR (also sold as "KARR BT") is an aftermarket alarm and engine immobilizer that some dealerships install before a car is sold — often pitched as a paid add-on during price negotiation. According to UC San Diego, the device is frequently left wired into the car even when the buyer declines it, and it can keep operating quietly in the background.

Researchers estimate it's in more than 2 million vehicles across the US — many originally sold at dealers in Southern California from 2017 onward, then resold nationwide. It shows up across brands, because it's added by the dealer, not the automaker.

The problem: the UCSD team found that every one of these alarms is protected by the same shared digital key — the researchers compared it to setting every device's password to "1234." That key can't easily be changed, so anyone who has it could reach any car that still has an unpatched device.

What's the actual risk?

I'll let both sides speak

Here's the honest picture from the two parties closest to it. You can decide how much it matters for you — patching costs nothing either way.

The researchers (UC San Diego)

Someone within Bluetooth range (roughly a few yards) of an unpatched car could unlock the doors, set off the horn and lights, or immobilize the engine so it won't start. Because the same key works on every device, a whole parking lot could be affected. One lead researcher called it, in terms of severity, "probably the worst" car-hacking issue he's seen — largely because owners often don't know the device is even there.

Source: UC San Diego, "BLE Theft Auto" research (2026)

The vendor (Acrisure Protection Group)

The company that sells KARR says the technique described in the research is highly complex and presents a low risk to customers under real-world conditions. It says it responded by developing a firmware update that closes the issue, now available to install through its app.

Source: Acrisure Protection Group statement (2026)

Step 2 — The fix (free, ~2 minutes)

Patch it yourself from your phone

There's no automatic update — every car has to be patched by hand. Even if you declined the alarm or never knew you had it, this is how you close the flaw. It's free.

  1. Download the free KARR Security app

    Get "KARR Security" from the Apple App Store or Google Play. The app is free — you don't need an account or a subscription to run the update.

  2. Open it and go to Customer Service

    Inside the app, tap Customer Service, then Firmware Update. Follow the prompts and keep Bluetooth on with your phone near the car.

  3. Confirm the update finished

    Wait for the app to report the firmware update as complete. If you already use the app, look for an update notification and confirm it installed.

  4. Can't find it, or unsure it's your app?

    If you can't locate the device or complete the update, contact the dealership that sold you the car, or KARR customer support at KARRsecurity.com.

Heads-up: the fix only protects the car it's run on, and there's no push-update — so if you have more than one affected vehicle, run it on each. The firmware patch was released July 20, 2026.

Get the KARR Security app (App Store) → KARRsecurity.com

Common questions

Good to know

I told the dealer I didn't want the alarm. Am I still affected?
Possibly yes. UC San Diego found the device is often left installed and still operating even after a buyer declines it, and even after it's "deactivated." Running the free firmware update is the way to be sure it can't be exploited.
Is my make and model affected?
It's not tied to a specific automaker — it's added by the dealer, so it spans many brands. Affected cars were largely sold through dealers in Southern California from 2017 onward and then resold across the country. The three signs above are the reliable way to tell, not the badge on your car.
Do I have to pay anything?
No. The KARR Security app and the firmware update are free. You do not need a paid plan or subscription to patch the flaw. If anything asks you to pay to "remove a vulnerability," be cautious — the official fix is free.
Who discovered this?
Security researchers at UC San Diego, in work titled "BLE Theft Auto," presented in 2026. They reported it to the vendor before it was made public, and a fix followed. See the UC San Diego announcement.
Who made this page — are you KARR?
No. This is an independent, free public-safety summary made by PLAYRIOT, a San Diego app studio. I'm not affiliated with KARR, Acrisure Protection Group, SouthWest Dealer Services, or UC San Diego. I made it because the fix has to reach millions of people who may not know they need it. Always confirm details with the official sources below.

Sources

This page is an independent public-safety summary provided free of charge by PLAYRIOT LLC. It is not affiliated with, endorsed by, or connected to KARR, Acrisure Protection Group, SouthWest Dealer Services, or the University of California, San Diego. "KARR" and other names are trademarks of their respective owners, used here only to describe the product being discussed. Information is summarized from public reporting and may change — always verify with the official sources above, your dealership, or the manufacturer before acting.