Car factories: how AI agents and robots change the threat model

A car plant is a dense network of robots, programmable controllers, vision systems and logistics software. AI agents now sit on top, scheduling work, tuning parameters and diagnosing faults. The threat model shifts from protecting each machine to controlling what the software that directs many machines is allowed to read, decide and command.

What do the standards cover?

ISO 10218. The 2025 revision of this industrial robot safety standard, dated by trade press to February 2025, adds requirements for cybersecurity to the extent that it applies to industrial robot safety. It also states functional safety requirements more explicitly, brings in collaborative robot content from ISO/TS 15066, and adds new robot classifications with functional safety requirements. Part 1 covers the robot and Part 2 covers applications and cells. The scope is robot safety, so it does not replace a plant security programme.

ISA/IEC 62443. ISA describes the series as standards for industrial automation and control systems, with parts for general concepts, asset owner and service provider programmes, system design and security levels, and component and product development. Asset owners, integrators, product suppliers and service suppliers each have a role.

NIST SP 800-82 Rev. 3. A guide to operational technology security that covers systems controlling physical processes, with performance, reliability and safety requirements in mind.

I read the Robot Report article for ISO 10218 and could not open ISO's own page, so confirm the detail with the standard.

What does a factory look like to an attacker, or to a mistake?

Think of layers, not machines. The cell layer holds robots and their controllers. The line layer holds controllers, manufacturing execution and quality systems. The plant layer holds scheduling, maintenance and supplier connections. Weaknesses at the upper layers can reach the lower ones if the paths are open.

What do AI agents add?

1. Cross-layer reach. An agent that reads quality data and adjusts robot parameters crosses a boundary humans used to stand at.
2. Fast, repeated action. A wrong adjustment applied across a line is a bigger effect than one operator's mistake.
3. Credentials and tools. Each agent holds tokens that connect to systems of record and to controllers.
4. Model and plug-in supply chain. The models, vision components and libraries are dependencies with their own flaws.
5. Maintenance data as a target. Diagnostics and logs feed agents that recommend actions.

The relevant risk is not science fiction. It is that a bad or manipulated input becomes a physical action because nothing stood between them.

How do you reduce it?

Keep safety functions independent of the agent, and bound what the agent can ask for. A parameter change that would take a robot outside its safe limits should be rejected by the controller whatever the agent says.

What to do

1. Map the layers and the conduits between them, and name the owner of each conduit.
2. Define zones and allowed flows in the way IEC 62443 describes, and block everything else.
3. Give agents read access first. Move to write access one function at a time, with approval and a rollback.
4. Enforce limits in controllers and safety PLCs, not in the agent.
5. Record agent actions with identity, inputs and time, and ship them to a store the agent cannot edit.
6. Request component lists from robot and software suppliers, and track known exploited vulnerabilities against them.
7. Patch with a plan. Test updates in a replica cell and schedule downtime.
8. Exercise the response. Practise isolating a cell and running on manual mode.
9. Review risk assessments each time an agent gains a new command.

Safeguard's MCP guardrail and dependency inventory address agent tool calls and software components in code you own, and they sit alongside plant network controls rather than replacing them.

Quick check

Sources

• The Robot Report, ISO 10218 industrial robot safety standard overhaul
• ISA, ISA/IEC 62443 series of standards
• NIST SP 800-82 Rev. 3

Last reviewed: 18 October 2026.