George Hotz is the hacker who made a career out of proving that one person, in public, can beat institutions — and then built two companies on that thesis. As "geohot" he was the first person to carrier-unlock the iPhone (August 2007, age seventeen) and the first to publish a break of the PlayStation 3's security (January 2010), which drew a federal lawsuit from Sony that settled in April 2011. As a founder he built comma.ai — the openpilot driver-assistance system running on ~$1,000 windshield devices — and then the tiny corp, whose tinygrad framework and tinybox computers attack the cost of AI compute itself.
The hacker era
Hotz grew up in Glen Rock, New Jersey, attended Bergen County Academies' engineering magnet program, and was a three-time Intel ISEF finalist — the 2007 entry, "I want a Holodeck," won a $20,000 scholarship. That same summer he spent ~500 hours defeating the iPhone's AT&T carrier lock with a soldering iron and software, then posted the instructions free: "This was about opening up the device for everyone," he told the New York Times, and "information should be free," he told NPR. The second unlocked unit he traded to CertiCell for a Nissan 350Z and three iPhones — the first signature geohot move: publish the knowledge, monetize the theater.
The PS3 arc repeated it at higher stakes. His January 2010 exploit — the first crack in a console that had stood for three years — led Sony to strip the OtherOS Linux feature from every PS3. After fail0verflow exposed Sony's ECDSA key-handling mistake at 27C3 in December 2010, Hotz posted the console's private signing key on his website. Sony Computer Entertainment America sued on January 11, 2011 (N.D. Cal. 3:11-cv-00167: DMCA, CFAA, and more), won a TRO and subpoenas covering even who had viewed his YouTube videos, and settled April 11-12, 2011 on a permanent injunction — $10,000 per breach, no admission of liability. Hotz marked the occasion by releasing a rap video mocking Sony and joining a boycott; the Sony subpoenas and the settlement's asymmetry — a hacker enjoined, a corporation unrepentant — made him a cause as much as a defendant.
Between the hacks he did the expected-and-quit circuit: Facebook (May 2011 to January 2012 — "they tell you it's your job to make the minutes number go up," he said at SXSW), back-to-back DEF CON CTF wins with CMU's Plaid Parliament of Pwning as "tomcr00se" (2013, 2014, plus a solo CSAW win), Google's Project Zero in July 2014 where he built the Qira timeless debugger, then Vicarious for the first half of 2015 — his first machine-learning job.
comma.ai: the garage bet
In September 2015 he founded comma.ai and built a self-driving Acura ILX in about a month, documented in Ashlee Vance's December 2015 Bloomberg Businessweek profile. The same story broke the Elon Musk saga: Tesla had offered a deal — a "multimillion-dollar bonus ... that pays out as soon as we discontinue Mobileye" — and Hotz refused ("I'm not looking for a job. I'll ping you when I crush Mobileye"), saying Musk kept changing terms. Tesla publicly called the story inaccurate and a one-person autonomy effort "extremely unlikely" to reach production; the emails, at least in part, were real. It remains the cleanest distillation of his position: the institution's offer versus building the alternative in the open.
The next year wrote the company doctrine in two moves. In September 2016 he announced the comma one, a $999 aftermarket autonomy kit; on October 28 NHTSA's special order arrived — fifteen questions, $21,000-per-day penalty exposure. Rather than answer, Hotz cancelled the product outright ("would much rather spend my life building amazing tech than dealing with regulators"), and five weeks later open-sourced the entire stack: openpilot plus the 3D-printable comma neo hardware plans. "If we really want to be the Android of self-driving cars, we can't be charging $999." The regulator's move had inadvertently produced the company's founding strategy — open software, sold hardware, community ports.
The decade after is the shippable-intermediaries catalog: comma two at CES 2020 ($999; that October-November Consumer Reports ranked openpilot first among the ADAS systems it tested, ahead of Super Cruise and Autopilot), comma three (2021, $2,199), the comma body balancing-robot devkit (May 2022 — "from openpilot's perspective, the comma body is a car," and the first step toward "a robot person"), comma 3X (COMMA_CON 2023, $1,250), comma four (COMMA_CON 2025, $999, built on comma's own San Diego SMT lines), and the chestnut GPU-over-USB accessory (August 2026). The company claims 325+ supported cars and 100M+ user miles, and Hotz stated a $1 billion valuation in mid-2025 — company-reported figures the record does not independently confirm.
His relationship to running comma is deliberately distant. In September 2018 the board — which was only him — fired George Hotz as CEO so he could lead a research division. In October 2022's "The Hero's Journey" he took "some time away" entirely, keeping board seat and president title: "I don't think I'm capable of running a company like that. I've always heard it takes different people at different company sizes." By late November 2025 his profiles listed the comma roles as past tense — though he was still posting comma four promotions, which is the ambiguity the open questions preserve.
The tiny corp and the public practice
On November 5, 2022 — days after the comma announcement — he founded the tiny corp, and in May 2023 announced $5.1 million raised "to commoditize the petaflop." The stack: tinygrad, a deliberately compact open-source neural-network framework that also powers openpilot's models; tinybox workstations sold at hardware margin ("we make money selling computers for more than they cost to make"); and hiring done through paid public bounties rather than resumes. The Latent Space interview frames the wager plainly — local, multi-vendor compute against a CUDA monoculture — while his own January 2025 posts concede the gap ("we are buying NVIDIA... nobody at comma wants to deal with AMD"), a hedge the index keeps visible rather than resolving.
Interleaved: the five-week Twitter internship (November-December 2022) that began as an "extremely hardcore" solidarity stunt and ended with "didn't think there was any real impact I could make"; the livestreamed coding sessions that constitute much of his public output; the tomcr00se SoundCloud rap catalog; cheapETH; the SXSW "Jailbreaking the Simulation" talk; three Lex Fridman appearances; and the August 2023 Dwarkesh-moderated debate where he argued Eliezer Yudkowsky's fast-takeoff scenario is an extraordinary claim requiring extraordinary evidence — while conceding superintelligence is likely real, just after his lifetime.
The throughline
Across twenty years the pattern is consistent enough to state: identify the locked thing, break it in public, publish the method, refuse the institution's terms — settlement, regulator, or acquirer — and convert the fight into leverage for the next build. The epistemic seam worth preserving is that the record is substantially self-narrated: the garage demo, the emails, the valuation, the mileage figures, "the first person to hack the iPhone" itself (a software-only unlock surfaced the same week). His record is real where it matters — the unlock verified by the AP, the docket at N.D. Cal., the GitHub repositories, the CR test — and promotional where it flatters. Both are indexed, separately.
This index was compiled from public sources and does not imply the subject's endorsement. Citations live in the packet's source catalog.