AI agents and robots change a steel mill's threat model by adding something that reads untrusted input and can act on physical equipment. The old question was who can reach the control network. The new one is what an agent can be talked into doing. Answer three questions: what it can touch, who can instruct it, and how it stops.
This is a general analysis of heavy industrial sites, not a report on any real incident or any specific mill. We cite NIST's operational technology guide, OWASP's guidance on agent permissions, and NIST's AI Risk Management Framework. We did not review robot-specific safety standards for this article, so we do not summarize them here.
What is different about operational technology?
NIST SP 800-82 Rev. 3, the guide to operational technology security, explains why OT is not ordinary IT. Logic running in OT has a direct effect on the physical world, so incidents can threaten health and safety, damage the environment and cause severe production losses. NIST says OT security objectives typically prioritize integrity and availability, followed by confidentiality, and that safety is an overarching priority. It also notes that goals of safety and efficiency sometimes conflict with security.
That is the baseline any agent has to fit into. A steel mill is one example of a site where a wrong command has physical consequences, which makes the order of priorities matter more than usual.
What can the agent touch?
An agent is software that decides what to do next and calls tools. OWASP's entry on excessive agency names three root causes of damage: excessive functionality, excessive permissions and excessive autonomy. In a mill, translate each:
- Functionality. If an agent summarizes maintenance logs, it needs read access to logs. It does not need a path to a controller. Give it a tool for logs and nothing else.
- Permissions. An agent that reads historian data should connect with an account that can only read.
- Autonomy. Any action that moves equipment, changes a setpoint or alters a safety function needs a person to approve it, every time.
NIST's OT guidance supports the same structure: logical separation between corporate and OT networks, multiple layers with the most critical communications in the most secure layer, a DMZ, and multi-factor authentication for remote access. An agent running in the corporate network should reach OT through those same controlled paths, not around them.
Who can instruct the agent?
An agent takes instructions from its operator and also from whatever text it reads. OWASP's prompt injection entry says indirect injection happens when a model accepts content from external sources, and that the effect can occur even when the content is imperceptible to humans. A work order, a vendor manual, an email attachment or a sensor annotation could all carry text aimed at the agent.
So treat inputs to an agent as untrusted data, and keep the agent's authority independent of what it reads. OWASP says critical controls such as authorization checks must be enforced outside the model in a deterministic way. If a text instruction can change what the agent is permitted to do, the control is in the wrong place.
How does it stop?
NIST's AI RMF has two subcategories that read well for a plant. MANAGE 2.4 calls for mechanisms to supersede, disengage or deactivate AI systems that behave inconsistently with intended use, with responsibilities assigned. MEASURE 2.6 says the system should be demonstrated to be safe and able to fail safely, particularly if made to operate beyond its knowledge limits. NIST's OT guide adds designing critical systems for graceful degradation to prevent cascading events.
In practice: a physical stop that does not depend on the agent's software, a defined safe state, and a rehearsed procedure for taking the agent offline.
What are the limits of this analysis?
Real mills differ greatly in age and design. NIST notes that OT lifespans can exceed 20 years, and some systems cannot be patched, which means compensating controls are the answer there. We have not assessed any specific vendor's robot or agent product. Standards for functional safety and for industrial cybersecurity, such as ISA/IEC 62443, apply to the control system itself, and an agent added on top must not undermine them. Ask your integrator how it fits.
What to do
- List every AI agent or assistant that can reach, or could be asked to reach, OT systems.
- Cut each agent to the fewest tools and the lowest permissions its job needs.
- Require human approval for any action that changes equipment state.
- Route agent access through the same segmented paths and MFA as other remote access.
- Treat documents and messages an agent reads as untrusted input.
- Test the stop procedure and document who owns it.
Quick check
Should an AI agent be able to send commands to plant equipment?
Only with human approval for each state-changing action, and only through controlled network paths. Safety functions should not depend on the agent.
What does NIST say about OT priorities?
NIST SP 800-82 Rev. 3 says OT security typically prioritizes integrity and availability, then confidentiality, with safety as an overarching priority.
Sources
- NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
- OWASP LLM06:2025 Excessive Agency
- OWASP LLM01:2025 Prompt Injection
- NIST AI RMF 1.0 (AI 100-1)
- ISA/IEC 62443 series overview
Last reviewed: 18 October 2026.
