When farm machines take instructions from software agents, such as scheduling, route planning or remote tasking, the threat model gains new inputs and new decision makers. The main change is that a manipulated input can now become a physical action. Start by listing what each agent can read, decide and command, then limit each one.
What do the standards say about automated machines?
ISO 18497 addresses design principles for the highly automated functions of agricultural tractors, tractor-implement systems, implements and self-propelled machines used in field operations. The Estonian standards listing says it excludes forestry, farmyard or barn machinery and operation on public roads, and that its principles may need to be extended for a given machine through type-C standards or the manufacturer's risk assessment. It also covers guidance on safe working information, including residual risks, that manufacturers supply.
It is a safety standard. Security is a separate discipline that has to sit next to it. ISA describes the ISA/IEC 62443 series as consensus standards for industrial automation and control systems, bridging operations and IT, and process safety and cybersecurity. NIST SP 800-82 Rev. 3 adds guidance for securing operational technology, including threats, vulnerabilities and countermeasures, with performance, reliability and safety in mind.
What is new when AI agents are involved?
An agent is software that plans and acts, often by calling tools. On a farm that might mean a fleet planner assigning tasks, a service that reads weather and field data and changes operating plans, or an assistant that talks to the dealer system.
- More inputs. Data feeds, field maps, prescriptions and messages all influence decisions, and each can be wrong or manipulated.
- Delegated authority. An agent that can send a command is a path to the machine.
- Opaque reasoning. It may be hard to explain why a plan was chosen, which complicates investigations.
- New credentials. Agents hold API keys and tokens, which need the same care as human accounts.
- Model and component supply chain. The models, plug-ins and libraries behind the agent are dependencies.
None of this requires a dramatic attack story. A wrong prescription file or a poisoned data feed is enough to cause a bad action if nothing checks it.
How do you model the threat?
Use four plain questions per agent.
- What can it read? Name the data sources and who can write to them.
- What can it decide? List the choices it makes without a human.
- What can it command? Tie each command to a machine function and the safety function around it.
- What stops a bad command? A limit outside the agent, such as an interlock or a bounded range.
The last answer matters most. Safety functions should not depend on the agent behaving. Keep the safety layer independent and fail safe.
What to do
- Draw the data flow from every input source to every actuator.
- Give each agent the least authority it needs, with separate credentials per agent and per fleet.
- Bound the actions. Set hard limits on speed, area and implement state in the machine controller, not in the agent.
- Validate inputs such as prescriptions and maps for range and format before use.
- Require approval for actions outside normal limits.
- Log every command with the agent identity and its inputs, and send logs off the machine.
- Inventory the AI components and treat them as supply chain, with versions, sources and update owners.
- Practise the stop. Test the remote stop and manual override on a schedule.
- Review the risk assessment when an agent gains a new capability, as the standard's reliance on manufacturer risk assessment implies.
Safeguard's MCP guardrail is built for controlling what agents can call, and the same pattern of an allowlist outside the agent applies to machine commands.
Quick check
Is ISO 18497 a cybersecurity standard?
No. It sets safety design principles for highly automated agricultural machines. Pair it with security guidance such as ISA/IEC 62443 and NIST SP 800-82.
Where should safety limits live?
In the machine controller, outside the agent. An agent that can be manipulated should never be the last line before a physical action.
Sources
- Estonian Centre for Standardisation, ISO 18497:2018 listing
- ISA, ISA/IEC 62443 series of standards
- NIST SP 800-82 Rev. 3, Guide to Operational Technology Security
Last reviewed: 18 October 2026.
