Manufacturing's Newest Attack Surface Is the AI Agent You Just Deployed
Manufacturing has been the most-attacked industry for five years running, according to IBM’s threat data. It is also, right now, the sector wiring AI agents into the systems that run production. Those two facts are about to meet.
Over the past few months, security researchers have disclosed a run of vulnerabilities in widely used AI agents, and OWASP again ranked prompt injection as the number one risk for language-model systems in 2026. In one case, an autonomous attack agent needed no human at the keyboard to compromise a build pipeline and push a backdoored version of a popular software package to a public registry. The pattern underneath all of it is the part worth understanding, because it does not look like the attacks your OT team is set up to catch.
Why this attack is different
Traditional security assumes a breach means malware, a stolen credential, or an exploited code flaw. An AI agent can be compromised through none of those. It can be turned by the content it is designed to read. A model treats its instructions, the user’s request, and any text it pulls in as one undifferentiated stream, with no built-in line marking which part to trust. So a carefully worded sentence buried in a supplier’s PDF or a scraped spec sheet can redirect what the agent does, with no malware and no login required.
That matters more in a plant than in a chatbot, because of what these agents are wired to do. The agents going into operations have three properties at once: they act without step-by-step approval, they reach across previously separate systems – MES, ERP, quality, order management – and they can trigger real actions, not just read them. Concentrate those three in one workflow and a single injected instruction stops being a leaked answer and becomes a placed order, an adjusted schedule, or a released batch.
The stakes are physical
This is where IT and OT part ways. A compromised office chatbot leaks data. A compromised agent with a hand on production can halt a line, corrupt a quality hold, or push a wrong instruction downstream. The single most common way into a manufacturing network is already an internet-facing application, with attackers then moving toward OT; an agent that bridges the shop floor and the outside world is a new and willing bridge. And half of OT environments still lack the monitoring to tell a contained event from a spreading one.
The defense is boring, and you already know it
This is not a reason to hold off on agentic AI. It is a reason to treat an agent as what it is: a privileged, semi-autonomous user that needs the same controls as any other. Give each agent the narrowest tool access its job requires, not blanket permissions. Put a human approval step in front of any action that touches the physical process or the outside world. Sandbox what the agent can reach, filter what it can send out, and log every action it takes so an auditor – or an incident responder – can reconstruct what happened and why. Assume the model can be tricked, and design so that being tricked is contained instead of catastrophic.
There is a compliance edge here too, and part of it is immediate. If an agent can be talked into exfiltrating personal data, that is a reportable breach under GDPR today – the injection technique is new, the notification duty is not. The EU AI Act adds to it: Article 15 requires high-risk systems to be demonstrably resilient to manipulation, an obligation phasing in on the high-risk timeline (Annex III from December 2027 under the recent simplification package). Either way, “we told the agent not to” is not a defense.
The race to put agents into production is real and worth running. But manufacturing is already the sector attackers hit hardest, and an agent with permissions is a richer prize than a chatbot. The plants that deploy well this year will be the ones that wired in the controls at the same time as the agent, not the ones that went looking for them after the first strange order went out.
“Content generated using AI”