As AI agents take on autonomous decision-making in industrial environments, they create an entirely new attack surface that traditional OT security standards weren’t designed to handle. So organizations need strategies to secure these new threat vectors.
By 2027, the International Data Corporation (IDC) predicts that artificial intelligence (AI) agents will autonomously handle 40% of operational data in industrial environments, as software shifts from passive assistant to independent decision-maker, introducing an entirely new attack surface. Developers are deploying these tools faster than security teams can write policies, opening an unmonitored “shadow AI” frontier. Standards designed for deterministic operational technology (OT) environments, like the ISA/IEC 62443 series of standards, cannot fully accommodate machines that change their behavior. The future of cybersecurity belongs to organizations that can secure the integrity of machine reasoning in a world where the attacker’s best weapon is a persuasive conversation with an algorithm.
Inside the perimeter: Why AI agents change the threat model
Traditional OT security was built for a world of predictable inputs and outputs. Signature-based defenses, static rule sets, and deterministic logic assume that a system will behave the same way today as it did yesterday. AI agents break that assumption. Once deployed, they reason, adapt, and act with a degree of autonomy that leaves conventional monitoring tools unable to distinguish normal adaptive behavior from compromise.
Attackers no longer need to breach perimeters if they can influence an AI agent that’s already operating within the environment. Now, when controlling an AI agent, the attackers’ main target is often to manipulate data. Poisoned telemetry or manipulated sensor data can steer towards catastrophic outputs without tripping a single traditional alarm. These attacks will echo the logic of Stuxnet, but without requiring a human on the ground to launch the attack with a thumb drive. The risk isn’t theoretical. Anthropic disrupted an attack that used a compromised AI agent to autonomously infiltrate roughly 30 organizations, including chemical manufacturers.
Indirect prompt injection increases the risks. A legitimate agent can be hijacked by malicious instructions buried in the content it processes, causing the agent to alter a setpoint or override data feeds, leading to valve or centrifuge failure. These instructions don’t need to be obvious; they can be embedded in something as innocuous as a HyperText Markup Language (HTML) comment, invisible to a human reviewer but fully executable by the agent reading the page. By layering in shadow AI, unauthorized agent developers deploy faster than security teams can write policies, leaving organizations to defend an attack surface they can’t fully see.
Adapting ISA/IEC 62443 for AI-powered operational technology
ISA/IEC 62443’s Zones and Conduits model is a viable framework, but it requires a mindset shift. AI engines can no longer be treated as trusted internal nodes. They need to be classified as high-risk zones by default and isolated in the same way as an unpatched legacy device or an external vendor connection. That isolation needs to withstand failure and direct attack. If a hallucinating or resource-exhausted agent is competing for bandwidth or compute as a safety instrument, it can degrade the safety’s reliability without deliberately compromising it. That reclassification has practical implications. It’s vital that every data flow from a physical process to an AI engine passes through a defined conduit rather than a direct connection. Deep packet inspection set up at that boundary needs to do more than flag malicious payloads. They must be configured to enforce flow inspection, policy definition, and application monitoring, essentially validating that only sanctioned data types and volumes move between zones. Data diodes provide a hard backstop, ensuring information can travel from the process to the AI engine without a path back to physical controls.
Change control requires similar scrutiny. A model update is a configuration change and should trigger the same review and testing process as any other change to a certified system, instead of a lighter-touch software patch.
The standard’s security level definitions also need to be re-examined. They were written for systems with fixed, predictable states, and applying them as-is to adaptive AI logic risks underclassifying real risk. As the ISA99 committee works to extend 62443’s guidance to systems that don’t hold a fixed state, organizations adapting now are moving in step with, and not ahead of, where the standard is headed. Even so, a sound practice is to re-audit AI agents to determine whether their current Security Level (Achieved) is defensible for a mechanism whose internal logic shifts over time.
The case for calibrated trust: Why oversight can’t be all or nothing
Human oversight, through regular audits of security controls and output, is critical. Oversight can scale based on actions the AI agent takes. At the low-risk end, agents that draft emails may run autonomously. The highest-stakes actions, like a configuration change, require human approval before execution. There is also a middle ground that allows OT production to continue running while maintaining active human oversight. Real-time control of AI agents can log every autonomous decision as it happens, with secondary AI systems auditing those logs asynchronously. This structure allows process controls to continue running while anomalies are flagged and routed to a human the moment they’re detected. It also works on low-risk tasks, like scheduling maintenance for monitored equipment and load balancing, which sit further along the responsibility spectrum.
The more significant risk isn’t the lack of human oversight but automation complacency. When outputs feel too complex to meaningfully review, operators either stop scrutinizing them or defer to the AI agents by default. Explainable AI (XAI) is a countermeasure that calibrates for trust. When a system can explain why it made a decision in plain terms, operators can evaluate that reasoning instead of rubber-stamping it. To maintain accountability, policies need to state outright that humans remain legally and operationally responsible for AI-driven outputs and be reinforced by a tiered review matrix that maps use cases to the level of scrutiny they demand.
Securing the human element in an autonomous future
As AI agents move deeper into the control layer, the attack surface will continue expanding—along with the stakes. Industrial AI security requires a hard boundary between cognitive AI decisions and deterministic physical safety systems, regardless of how capable agents become. In the near term, organizations can audit the full model inventory to know exactly what’s running and take active steps to protect proprietary model logic from reverse-engineering and theft. Additional steps organizations can take immediately are updating governance policies to reflect AI-specific accountability and ensuring training reinforces that AI outputs are inputs to human judgment, not replacements for it. In the longer term, true OT resilience to growing AI utilization and risks will demand explainable systems and outputs, which will require adapting culture and technology. When the attacker’s best weapon is a persuasive conversation with an algorithm, the best defense is a human who knows to push back.
