AI agents change the threat model for hospital robots by adding a decision layer that reads untrusted input, calls tools and touches systems that move in physical space. The old questions about patching and network access still apply. The new ones are about what the agent is allowed to do, and who approves it.
What is different about a robot in a hospital?
A robot is software with a body. When a web server is compromised, data leaks. When a machine that moves near people or tools behaves wrongly, the consequence can be physical. That is why safety engineers and security engineers have spent years learning to talk to each other.
NIST's guide to operational technology security, SP 800-82 Rev. 3, was published in September 2023. It covers programmable systems that monitor or control physical processes, and it frames security around performance, reliability and safety requirements, not confidentiality alone. Hospital robotics fits that frame even though the guide's examples centre on industrial control systems and building automation.
Which standards are worth reading?
Only a few are worth naming here, because these are the ones we fetched and read about.
- ISA/IEC 62443 is a series for industrial automation and control systems. ISA says it is used in sectors that include medical devices. It splits duties between asset owners, system integrators and product suppliers, and it includes secure product development lifecycle requirements.
- FDA premarket cybersecurity guidance for medical devices was issued as a final document in February 2026. It covers cybersecurity design, labeling and premarket documentation, and FDA's recommendations under section 524B of the Federal Food, Drug, and Cosmetic Act for cyber devices.
- ISO 10218 covers industrial robots. Industry press reports that Part 1 addresses robot manufacturers and Part 2 addresses integrators and robot applications, and that the 2025 revision added cybersecurity measures. It is written for industrial settings, so check whether it applies to your device before relying on it.
Your regulatory counsel and the device manufacturer decide which standards bind a specific product. This post is orientation, not advice on conformity.
What does an AI agent add?
An agent is a loop: it reads input, decides, calls a tool, reads the result. In a hospital that input might be a work order, a note in a ticketing system, a maintenance document or a message from a vendor portal. Anything free text can contain instructions the agent was never meant to follow.
The OWASP risk called excessive agency describes the pattern in general: a system takes damaging actions because its output was unexpected, ambiguous or manipulated, and had more functions, permissions or autonomy than it needed. In a software-only product the damage is a deleted record. Near a robot, the same design flaw has a different ceiling, so the ceiling is what you design around.
What stays the same?
Dependencies. A robot's controller, its vision stack, its fleet management service and any agent framework are built from open source packages and vendor firmware. The usual questions apply: what is in the build, which known vulnerabilities are present, and how does an update reach the device and get verified.
What to do
- Ask the manufacturer for a software bill of materials for each robot and its management software, and for how updates are signed and delivered.
- Map the network paths. Which systems can reach the robot, and which can the robot reach?
- Keep any AI agent away from motion and safety functions. Let it read status and draft tickets, and keep commands behind a person or a deterministic, tested interface.
- Give each agent tool the narrowest permission it needs and log every call.
- Treat free text from tickets, documents and portals as untrusted input.
- Ask who owns patching under your contract, and how fast critical fixes arrive.
- Rehearse a manual fallback so care does not depend on the robot being online.
Software inventory is the part a scanner can help with. Safeguard's CLI can scan an SBOM a vendor supplies, which shows known vulnerabilities in listed components. It cannot tell you whether the SBOM is complete, and it does not assess a robot's physical safety.
Quick check
Does an AI agent make a hospital robot less safe by default?
No. The risk comes from what the agent can do. A read-only agent that summarises logs adds little physical risk. One that can issue commands needs the strictest controls.
Is ISO 10218 the standard for surgical robots?
Not on the sources we read. It addresses industrial robots. Check with the manufacturer and your regulatory advisers which standards apply to a given medical device.
Sources
- NIST SP 800-82 Rev. 3, Guide to OT Security
- ISA/IEC 62443 series overview
- FDA: Cybersecurity in medical devices, premarket guidance
- Material Handling and Logistics: ISO updates robot safety standards
- OWASP LLM06:2025 Excessive Agency
Last reviewed: 18 October 2026.
