Is Tesla's 'Autopilot' mode safe?

Self-driving cars were in the news again last week, as it emerged that the crash that killed Joshua Brown on 7 May happened while his Tesla's 'Autopilot' feature was enabled. The crash seems to have occurred because Autopilot's visual and radar sensors were not able to identify a lorry that was crossing the highway, perhaps due to the ride height and colour of the lorry making it too-closely resemble an overhead sign.

The death was the first in around 130m miles of Autopilot-enabled driving, according to Tesla, compared with one death on average in the US for every 94m miles of normal, unassisted driving. According to some media outlets, this means that Autopilot-enabled driving is safer than unassisted driving. This is incorrect though. By itself, the statistic only means that it might be.
Where there is a large sample size - for example, for deaths in non-autonomous cars - we can be fairly certain of the 'true rate' of these deaths. This 'true rate' won't of course be much good for evaluating any specific journey, which will depend on the type of car, roads, weather conditions, and so on. But we can be fairly certain that averaged across all types of car journeys, the death rate is around one per 94 million miles for non-autonomous driving in the US.
But with Tesla's Autopilot, we only have one death so far. The 'true rate' of deaths for Autopilot-enabled driving could conceivably be significantly higher than 1 per 130m miles (and so far, we've been lucky) or significantly lower (and Mr Brown was very unlucky). Using a simple model for the way these kinds of events occur (based on the Poisson distribution), and if we have no other assumptions about how safe or dangerous Autopilot is (i.e. if our prior probability distribution is locally flat), the probability we should place on the hypothesis that it's more dangerous than normal driving should in fact be quite high - just over 60% in fact. This is shown below as the area beneath the curve that is to the right of the long-run average death rate of 1 every 94 million miles.


This is only a starting point of course. On one hand, we might think the probability is more likely to be lower because of our understanding of the technical characteristics of the Autopilot feature. Indeed, since Autopilot is only meant to augment human driving, we might think that used properly it cannot possibly be less safe. On the other hand, however, we might think that having the Autopilot feature enabled will encourage people to drive more dangerously with less attention, perhaps more than offsetting the safety benefit (consistent with research showing that drivers tend to 'consume' safety increases by 'buying' additional speed). And bugs and other unforeseen technical problems are of course an ever-present possibility for any new technology.
We will not know for some time, of course. The single Autopilot fatality in 130m miles so far is information, but it's not much information. It certainly doesn't mean that Autopilot is more dangerous than normal driving, but it doesn't necessarily mean it's safer either.

[Edit on 13 July: maths error - area to the right of the long-run rate is actually 60% of the total probability density, not 40% as originally stated]