So far there's been one successful attack that involved surfing to a 'bad' webpage on the car's touchscreen browser, followed by a malicious firmware update. Tesla's been closing the known holes, of course.