Food processing lines: how AI agents and robots change the threat model

On a food processing line, AI agents and robots add new software paths to physical equipment: model updates, cloud links, tool permissions and vision systems that feed decisions. The threat model changes because a wrong or manipulated action can affect machines and product, not only data. Standards from NIST, ISA and ISO give a way to scope it.

What counts as the new attack surface?

Start from what the software can touch.

• Agents with tools. An assistant that schedules maintenance, adjusts setpoints or raises purchase orders has permissions. OWASP calls the risk of an LLM system taking damaging actions excessive agency, caused by excessive functionality, permissions or autonomy.
• Robot cells. Cells combine a robot, a gripper, safety sensors and software from several suppliers.
• Data pipelines. Camera and sensor data train or feed models, which then influence decisions.
• Remote support. Vendors connect to tune robots and models.

None of this requires an invented incident to take seriously. It follows from adding software that can act.

Which standards apply?

NIST SP 800-82 Revision 3 is a guide to securing operational technology, defined as programmable systems and devices that interact with the physical environment. It lists manufacturing among its sectors and covers topologies, threats and countermeasures with attention to safety and reliability.

ISA/IEC 62443 targets industrial automation and control systems and addresses asset owners, product suppliers, integrators and service providers. Part 2-4 covers service provider requirements, 2-3 patch management, and 4-1 the secure product development lifecycle.

For robots, the 2025 revision of ISO 10218 is reported by trade coverage to be the first major update since 2011. It covers Part 1 for robots and Part 2 for applications and cells, states functional safety requirements more explicitly, folds in collaborative application requirements previously in ISO/TS 15066, and adds cybersecurity requirements tied to robot safety. We read that from an industry news article, not the standard itself, which is sold by A3. Check the standard for the exact wording.

How does an agent change the questions?

Ask the OWASP questions of any agent near the line.

1. Which functions can it call, and does it need all of them? OWASP advises limiting extensions and avoiding open-ended ones such as arbitrary shell commands.
2. Under what identity does it act? OWASP recommends using minimal scopes in the user's context and enforcing authorization in the downstream system, not trusting the model to decide.
3. Which actions need a human? High-impact operations should require approval.
4. What does the log show? Logging and rate limits do not prevent a bad action but they limit damage and help investigation.

Where an action touches a physical process, the hard limits belong in the control and safety systems, outside the AI.

What do we know and not know?

Standards give structure, but there is no single checklist for AI on a food line. Product safety rules, food regulations and plant risk assessments also apply, and we did not review them here. Treat this post as a starting frame for a conversation with your OT, safety and quality teams.

What to do

1. Draw a diagram of every system an agent or robot can read from or act on.
2. Separate control networks from business networks and the internet, as NIST and ISA guidance describes.
3. List each agent tool and remove any that is not needed.
4. Give agents read-only access by default, and require approval for actions that change setpoints or recipes.
5. Keep safety functions independent of AI and test that independence.
6. Ask suppliers for a component list and patch policy for robots and models.
7. Log agent actions and review them weekly at first.

Quick check

Sources

• NIST SP 800-82 Rev. 3, Guide to OT Security
• ISA/IEC 62443 series
• Automation World: A3 updates industrial robot safety standards
• OWASP GenAI: LLM06 Excessive Agency

Last reviewed: 18 October 2026.