AI agents in Manufacturing & OT: securing real‑time production

01Speed versus safety: why the fastest AI isn’t always the safest

In a modern plant an AI‑driven maintenance assistant watches sensor streams, predicts component wear and proposes a firmware patch for a motor controller. The same system can also generate a new ladder‑logic routine for a programmable logic controller (PLC) and push it to the field bus in seconds. The benefit is obvious – downtime drops dramatically – but the risk is that a mis‑translated condition can bypass a critical shutdown, exposing operators and equipment.

A plausible failure: the agent receives a model update from a third‑party vendor that includes a newer inference library. The new library interprets a pressure‑sensor range differently, causing the AI to deem an over‑pressure event as normal. When the PLC code is regenerated, the safety interlock never fires. The plant continues running until a manual inspection catches the anomaly, after costly damage has accrued.

Imagine the agent is tasked with quality analysis for a high‑speed assembly line. It flags a defect pattern and automatically adjusts a robot’s grip force. If the AI misclassifies a harmless variation as a defect, it could tighten the grip enough to crush parts, leading to scrap and a production halt.

02Hidden failure modes that a CISO must anticipate

Suppose an AI agent is given read‑only access to historical SCADA logs to train a predictive model. The sandbox it runs in is correctly isolated, yet the model inadvertently memorizes a secret device identifier that later appears in outbound traffic. An attacker who compromises the outbound channel could extract that identifier and craft a spoofed command to the control system.

A plausible failure: the agent is instructed to optimize supply‑chain planning by pulling inventory data from an ERP system. The agent’s code contains a bug that writes back a malformed CSV into a shared dropbox used by the warehouse. The warehouse software crashes, causing a cascade of delayed shipments and a backlog on the shop floor.

Imagine a vendor’s remote‑access tool is wrapped in an AI‑enabled troubleshooting script. The script asks for a privileged token, which the sandbox substitutes with a placeholder. If the egress broker misroutes the placeholder, the vendor’s tool could connect with an empty token and be denied, leaving the plant without required support during an outage.

03Practical controls that turn risk into manageable exposure

First, enforce network isolation. The OT plant should run on an air‑gapped segment, and any AI agent that needs to talk outside must be placed on an explicit allow‑list. This matches the IEC 62443 and NIST SP 800‑82 guidance to keep OT traffic separate from corporate IT and the internet.

Second, use immutable checkpoints before any code that touches PLCs or SCADA. A checkpoint saves the whole sealed machine in about 0.7 seconds, allowing an instant rewind if the generated code misbehaves. Pair this with a two‑person rule: risky actions wait for two named human approvers, and every step is logged in a hash‑chained audit trail.

Third, keep each agent in its own sealed microVM. The microVM sees only a single workspace folder, preventing accidental leakage of credentials or configuration files. API keys never reside inside the sandbox; they are injected by an egress broker only at the moment of outbound request.

• Define an allow‑list of OT‑authorized hosts and block everything else.
• Create a checkpoint before any PLC or SCADA modification; rewind on unexpected behavior.
• Require two human approvers for any action that changes safety‑critical logic.

04How kosa8 provides the building blocks for a secure AI workflow

kosa8 supplies sealed microVMs, each with its own kernel, so an AI agent never shares the host kernel with another process. The workspace is the only visible directory, and bind mounts are granted explicitly with read‑only or read‑write flags. Network traffic is closed by default and can be opened only to hosts you list, which fits the need to keep OT networks isolated from IT and the internet.

The platform supports air‑gapped installations, letting you run the entire AI stack inside a plant that has no external connectivity. Checkpoints and rewinds happen in seconds, giving you a fast rollback path whenever an AI‑generated change misbehaves. Risky steps can be gated by a two‑person approval workflow, and every action—human or agent—is recorded in a tamper‑evident audit log that you can verify with a single command.

Because API keys stay on the host and only placeholders appear inside the sandbox, the egress broker can enforce fine‑grained credential injection. This prevents a compromised agent from stealing tokens, while still allowing legitimate outbound calls to model providers or vendor services.

05Monday‑morning actions for the CISO

Update the OT firewall rule set to reflect an explicit allow‑list of AI‑agent hosts and block all other outbound destinations. Use the kosa8 sandbox create sealed --egress-allow api.anthropic.com command to start a sandbox that can only talk to the vetted model endpoint.

Wrap every PLC‑code‑generation job in a checkpoint. Run kosa8 checkpoint sealed --label "before PLC update" before the agent writes any ladder logic, and keep the label handy for a quick rewind if the new code trips a safety interlock.

Enable the two‑person rule for any agent that writes to SCADA tag tables or changes safety parameters. Record the approval in the audit log and verify it nightly with kosa8 audit verify.

• Review and tighten the allow‑list every week.
• Schedule daily audit log verification.
• Document the checkpoint‑rewind process in the incident‑response playbook.