AI agents and robots change the autonomous vehicle threat model by adding new inputs that can steer behavior, new tools that can act on fleets, and new places where a wrong decision matters. Extend your existing model with those three, rather than starting over, and keep safety processes as the backbone.
What did the threat model look like before?
A classic vehicle threat model covers the vehicle's networks, update mechanism, sensors, back end and supply chain. Road vehicles also sit under cybersecurity regulation, and equipment inside a plant follows different rules. We did not confirm the text of any vehicle regulation for this post, so check which rules apply to your equipment.
For operational technology in general, NIST SP 800-82 Rev. 3 lists transportation systems among programmable systems that monitor or control physical processes and recommends countermeasures that account for safety and reliability.
What do agents and robots add?
Fleet and operations agents. Companies may use AI agents to schedule vehicles, triage faults, write work orders or answer drivers. They read tickets, logs and messages, which makes those text sources inputs to a model. OWASP defines indirect prompt injection as external content that alters a model's behavior, and says foolproof prevention may not exist.
Remote assistance and teleoperation helpers. If an assistant summarizes a scene or recommends an action to a human operator, a wrong or manipulated summary becomes a safety input. Keep the person responsible and show the underlying data, not only the summary.
Maintenance and service robots. Robots that charge, clean or inspect vehicles carry their own software and network access. They join the asset list and can be a path between zones.
Onboard models. Perception and planning models are part of the safety case. Their supply chain includes model files, training data and libraries. NIST's SSDF community profile for generative AI, SP 800-218A, extends secure development practices to AI model producers, AI system producers and acquirers.
Which controls matter most?
OWASP's excessive agency guidance is the most transferable: minimize the tools given to a model, avoid open ended ones, grant least privilege, run actions in the user's context, require human approval for high impact actions and have downstream systems enforce policy rather than trust the model. For vehicles, high impact means anything that changes motion, speed limits, geofences, software versions or safety settings.
Add three more.
Separation. Keep agents on the business side of the network. They should not have a path to vehicle control systems. A request to change something safety relevant should go through a deterministic, audited workflow.
Provenance. Record which model, version and prompt produced an action, and log it where the agent cannot edit it.
Inventory. Include models, agent frameworks and robot firmware in your software bill of materials.
What should we not claim?
We cite no specific attack on a production vehicle through an AI agent, because the sources we reviewed did not require one. The argument is about design, and it stands on its own.
What to do
- List every AI agent and robot connected to your vehicle operation and what it can read and do.
- Remove any path from agents to vehicle control networks.
- Require human approval for changes to motion, geofence, speed or software version.
- Treat tickets, logs and messages as untrusted input to prompts.
- Add model files and agent frameworks to the SBOM.
- Log agent actions in append only storage.
- Review the threat model after each new agent or tool.
Quick check
Is one regulation enough for the whole fleet?
Not usually. Road vehicles, depot robots and plant vehicles can fall under different rules, so check each class.
Can a human in the loop be enough?
Only if the person sees the underlying data and has time and authority to say no.
Sources
Last reviewed: 18 October 2026.
