When a utility adds AI agents and robots, the threat model grows in three places: who can instruct the machine, what data it trusts, and what software runs inside it. The safest pattern is to keep agents advisory for anything that can switch, open or energise equipment, put human approval in front of every consequential action, and log each instruction.
What are utilities likely to use?
Typical candidates are inspection drones and crawlers, robots that assist in hazardous environments, agents that summarise alarms and propose work orders, and assistants that help planners draft switching procedures. We are not describing any specific product or incident. The point is the pattern: a machine or program acts on instructions, using data from the field.
Where do the risks sit?
Instructions. If an attacker, or just a mistaken user, can issue a command, the machine may do something unintended. OWASP's excessive agency guidance says damaging actions can follow from unexpected, ambiguous or manipulated outputs, and names excessive functionality, permissions and autonomy as root causes.
Data. An agent that reads field reports, emails or documents can be influenced by content inside them. Treat data from outside your control as untrusted, even when it arrives through a trusted channel.
Software. Robots and edge devices are bundles of third-party code. Without a software inventory you cannot answer whether a newly announced vulnerability is on a machine in a substation.
Network. Machines need links for commands and telemetry. Those links can bridge zones that were deliberately separate.
Which standards help?
NIST SP 800-82 Rev. 3 is a guide to OT security that works within performance, reliability and safety requirements. ISA/IEC 62443 covers industrial automation and control systems and separates the roles of asset owner, integrator, product supplier and service provider. Both treat segmentation and role clarity as basics. The NERC CIP-013 supply chain standard applies to bulk electric system cyber systems in North America. We summarise it from NERC's material and a secondary overview, so read the standard itself.
What does a safer design look like?
- Advisory by default. Agents read and recommend. A person performs or approves any action that changes the state of equipment. OWASP recommends human approval for high-impact actions.
- Least privilege per task. Give an agent only the tools and data the job needs, and run actions in the context of the requesting user.
- Authorisation in the downstream system. The switching system or work management system decides what is allowed. The agent does not decide for itself.
- Separate network zone. Keep agent and robot traffic away from control networks and allow only named flows.
- Inventory and SBOMs. Record each robot, firmware version and component list, and ask vendors for SBOMs.
- Logging. Record each instruction, who issued it, what data the agent used and who approved the action, in storage the agent cannot edit.
- Safe failure. Define what the machine does when it loses its link or its instructions look wrong: stop, hold position or return.
What about a human always in the loop?
Approval fatigue is real. If a person sees fifty prompts a day they will click through. Reserve approval for consequential steps, make the prompt specific about what will happen, and track the rate of approvals that were later reversed.
What to do
- List every AI agent, robot and drone used in operations, with owner and vendor.
- Classify the actions each can take as read, advise or change.
- Require approval and downstream authorisation for any change to equipment state.
- Place agent and robot traffic in its own zone.
- Collect SBOMs and firmware versions.
- Turn on logging and review it monthly.
- Test the loss of link and wrong instruction cases.
Quick check
Should an AI agent ever operate switches directly?
That is a decision for your safety and operations leadership, under the rules that apply to you. The conservative pattern is advisory output with human approval.
Are there utility incidents driven by AI agents we should cite?
We did not find a verified one in our sources, so we cite none.
Sources
Last reviewed: 18 October 2026.
