Month: September 2026

Part 2 of “AI Is entering the physical world”

Considering everything covered in part 1 of this article, it’s time to explore the importance and relevance of the adversarial mindset.

The Adversarial Mindset Must Extend to Perceived Reality

Security teams cannot limit questions to something like:

Does the AI accurately understand the environment?

Instead, they should ask:

How could I make the AI misunderstand the environment while leaving it confident that its understanding remains accurate?

That shift produces very different security exercises.

For example, the following questions start to gain power:

• Can conflicting sensor states exist?
• Can temporal relationships between events be manipulated?
• Can a legitimate device report technically valid but physically impossible values?
• Can one AI agent be made to trust information supplied by another compromised agent?
• Can some AI technology be fooled into selecting a dangerous action that still appears rational?
• Can several individually low-risk inputs be influenced such that their combined effect changes some system’s interpretation of reality?

This goes far beyond vulnerability scanning.

It requires an understanding of the target environment and the making of educated (adversary informed) attacking assumptions.

Identity Becomes Even More Important in the Physical World

Interestingly, physical AI also amplifies the importance of identity. This is important given that many of the older OT protocols have no notion of a user or identity. Think about that, in many cases older ecosystems would allow network traffic carrying commands that could create physical impact. Yet, no authenticated user was part of the equation. We must do better now.

Every participant in a physical environment needs an identity or an attributable source of authority. That includes people, sensors, robots, cameras, controllers, applications, models, workloads, autonomous agents, and external systems.

The AI must know more than what information arrived.

It needs context about where that information came from, which identity produced it, and whether the organization should trust that source.

Likewise, when some AI technology decides to act, the receiving system needs to understand the authority behind that action.

Organizations should preserve a hierarchical chain such as:

• Human owner
• AI system
• Model decision
• Agent identity
• Delegated authority
• Physical command
• Machine action

When anything within that chain breaks, accountability breaks with it.

More importantly, security loses the ability to determine whether something with legitimate authority produced some physical action.

In IT, a compromised identity can expose information or disrupt systems.

In physical AI, a compromised identity may eventually move something.

Cybersecurity Must Now Protect State, Not Just Systems

As physical AI develops, cybersecurity architecture will need to focus increasingly on state. Some of the types of questions that need answers as they relate to state are:

• What is true right now?
• Which entities exist at the moment?
• What are these entities doing?
• Which relationships connect them?
• What actions have already occurred?
• Which future states remain plausible?
• What authority exists to change the current state?

And critically:

How confident are we that the data describing current state is trustworthy?

Traditional alerts often examine individual events.

Physical AI security will need to understand sequences, relationships, causality, and physical context.

Some examples are:

• A temperature reading of 190 degrees may be safe in one operating state and extremely dangerous in another.
• A valve opening may be normal after one event and malicious after another.
• A robot entering an area may present little risk until a person enters the same physical space.

In the physical domain, context determines risk.

Therefore, security platforms will need stronger temporal models, dynamic graphs, event streams, behavioral baselines, identity relationships, process awareness, and state prediction.

The goal cannot remain simply detecting what has already happened.

We need to understand what is happening, why it is happening, and what is likely to happen next.

This represents another important shift for cybersecurity.

Historically, security operations have been overwhelmingly reactive. An event occurs, a signal appears, an alert fires, and analysts investigate. The entire incident response industry exists because of this reactive model.

Physical AI will demand more predictive security.

If some AI technology controlling or influencing an environment can reason about what happens next, defenders must develop comparable capabilities to identify dangerous future states before systems can reach them.

The objective becomes more than detecting malicious activity.

It becomes preventing the environment from reaching an unsafe state.

Six Security Principles for Physical AI

This is not television, and it will be a bit before humanoid robots begin to appear throughout the enterprise. Cybersecurity leaders do not need to wait for that day before they start preparing. That preparation can begin now and here are six relevant suggestions:

1. Protect the Data That Defines Reality

Identify the data that physical AI systems use to understand their environment.

Establish provenance, integrity controls, behavioral baselines, cross-source validation, and clear ownership. This data needs to be protected as it will be the basis of important truths.

Furthermore, treat manipulation of physical-state data as a high-consequence security event.

We have spent decades protecting sensitive data from exposure. Physical AI requires equal attention to protecting data from malicious alteration.

2. Understand Semantics, Not Just Traffic

Do not stop at network visibility as that is simply not enough.

Understand what commands and values actually mean to consuming physical processes.

This was central to the data-centric approach I advocated in OT security years ago, and it becomes even more important when AI consumes that information to understand some environment.

Allowed communication and safe action are not synonymous.

3. Bind Identity to Physical Authority

Every human and non-human actor capable of influencing the physical environment needs an attributable identity, constrained authority, and accountable owner. We have to do better than the OT protocols of the past where no identity was bound to commands and changes flowing via network communications.

Organizations must know who or what caused every consequential action.

They also need to continuously evaluate whether that identity remains trustworthy.

4. Model the Blast Radius Before Granting Autonomy

Before giving an AI system authority to act, determine what happens if it makes the wrong decision. This requires proper testing, consideration of edge cases, and careful attention to the design and enforcement of boundaries.

Ask how far one incorrect action can propagate through interconnected machines, systems, and physical processes.

Then constrain autonomy accordingly.

The greater the physical consequence, the smaller the acceptable gap between authority and accountability.

5. Use Simulation as a Security Tool

Digital twins and simulated environments should do more than optimize operations or train models.

Security teams can use them to test adversarial scenarios, evaluate “what-if” conditions, attempt to predict attack paths, and observe potential physical consequences without endangering production environments.

However, teams must also secure the simulation itself.

If the digital twin becomes an input into training, planning, or decision-making, poisoned simulation data can eventually influence downstream real-world behavior.

6. Design for Safe Failure

Every physical AI system needs an independently enforceable path to a safe state.

Security teams should be able to dynamically revoke authority, isolate compromised components, reject untrusted data, switch to manual control, and stop physical action.

Most importantly, do not assume that the AI responsible for normal operation should also control its own emergency containment.

Leadership needs to Understand the Physical AI Transition

Boards and executive teams do not need to become experts in AI technologies or the designing of world-class architectures.

However, they do need to understand what happens when AI crosses the boundary between recommendation and action as that can have a direct impact on business operations.

Here are a few questions leadership should start asking:

• Where can AI already influence physical processes in our organization?
• Which AI systems can issue commands that trigger physical action?
• Which data sources clearly define their understanding of physical state?
• Can we establish the integrity and provenance of that data?
• Can data manipulation create unsafe environments?
• Which human and machine identities possess authority over systems that have physical capabilities?
• Have we tested how the systems respond to intentionally manipulated environments?
• What physical consequences could follow an incorrect decision?
• Can we quickly force the environment into a safe state when trust disappears?

These are not robotics questions.

They are enterprise-risk and governance questions.

We Have Seen Part of This Future Before

World models and physical AI introduce powerful new technology.

Yet one of their central security problems brings me directly back to the OT environments we worked to protect at Bayshore Networks.

In 2020, I argued that protecting industrial environments required us to understand more than who communicated with whom.

We had to understand the actual values moving through industrial protocols.

Then we had to understand what would happen in the physical world when a PLC, controller, drive, or other system acted upon those values.

That progression was:

Data → Context → Command → Physical Consequence

World models extend that to:

Data → Perceived Reality → Predicted Future → Decision → Physical Consequence

That additional intelligence does not eliminate the old security problem.

It magnifies it.

World models will increasingly use huge volumes of data to construct representations of reality, predict future states, and select actions.

Therefore, cybersecurity must protect much more than the model.

We must protect the integrity of the world the model believes it inhabits.

That requires trusted data, attributable identities, semantic understanding, adversarial testing, state awareness, predictive security, and tight control over physical authority.

The GenAI era taught organizations that machines can create.

The agentic AI era is teaching us that machines can act.

World models and physical AI will force us to confront the next question:

What happens when machines can understand enough of the physical world to predict it, and possess enough authority to change it?

Cybersecurity leaders should start considering that question now.

Because AI is entering the physical world.

And once cyber risk becomes physical risk, we no longer get to treat a corrupted view of reality as merely a bad AI output.

Part 1 of “AI Is entering the physical world”

For the last several years, most organizations have experienced Artificial Intelligence through a screen. Come to think of it, so have many of the recently self-appointed AI experts. I consider most of these people users, not experts. Things are changing on levels these folks are not prepared for. AI Is entering the physical world. Why cybersecurity must change now.

Typical “AI” usage at the moment equates to Generative AI (GenAI). This means someone types a prompt and an engine generates content. The engine can write code, analyze a document, create an image, summarize data, or recommend an action.

That model of AI is already changing.

The next major evolution will push AI beyond understanding language and digital information. AI systems will increasingly model environments, predict how those environments may change, reason about physical objects, and take actions in the real world.

World models, embodied AI, robotics, autonomous systems, digital twins, and increasingly capable agentic ecosystems are moving us in that direction.

Consequently, cybersecurity leaders need to understand that this transition changes the security problem dramatically.

Potential Physical Impact

When AI exists primarily inside a digital environment, a bad decision may generate incorrect information, expose data, execute malicious code, or compromise a business process.

When AI can perceive and act upon the physical world, a bad decision can move a machine.

It can alter a manufacturing process or the behavior of a robot. It can influence an autonomous vehicle or manipulate an industrial control process.

Ultimately, it can create physical consequences.

That is why cybersecurity must change. Now.

Traditional cybersecurity primarily protects systems, identities, networks, applications, and information. Physical AI adds something fundamentally different. In most cases, foreign. Cybersecurity must now protect an AI system’s perception of physical reality, the data used to construct that reality, the authority to act upon it, and the resulting physical state.

An attacker may no longer need to compromise the AI model itself.

Manipulating the world the model sees may be enough.

That shifts cybersecurity beyond protecting systems and information. We must increasingly protect state, perception, prediction, authority, and physical consequence.

Physical AI changes cybersecurity because we must protect not only the AI, but the integrity of the world the AI believes it inhabits.

World Models Change What AI Understands

Large Language Models (LLMs) became powerful by learning relationships across enormous amounts of data.

World models pursue a different capability.

At a high level, a world model develops a representation of an environment and uses that representation to reason about how the environment may change over time.

Instead of merely asking, “What should come next in this sequence?” as LLMs do, world model based systems begins answering questions such as:

• What exists in this environment?
• How are these objects related?
• What state are they currently in?
• What happens if something moves or changes?
• What will the environment probably look like next?
• How will my actions affect this environment?
• What action is necessary to reach a desired state?

This capability matters enormously for robotics and autonomous systems.

For example, a robot operating in a warehouse cannot simply identify a forklift. It needs to understand where the forklift is, is it currently being operated, how quickly it is moving, where it will probably go next, and what obstacles surround it.

Likewise, an industrial AI system cannot simply recognize that a valve exists. It may need to understand the valve’s current state, its relationship to pressure elsewhere in the process, what normally happens after the valve changes state, and which physical consequences could follow.

In other words, the AI must build and continuously update a representation of reality.

That representation becomes extraordinarily valuable.

It also becomes an extraordinarily attractive target.

Why Cybersecurity Must Change When AI Becomes Physical

Cybersecurity traditionally focuses on protecting identities, systems, applications, networks, APIs, and data.

Physical AI forces us to extend that thinking.

We now have to protect the system’s understanding of reality.

If an attacker manipulates the information an AI system uses to construct that reality, the attacker may never need to compromise the model itself. That is a dynamic the security industry has yet to contend with.

Consider an autonomous system that continuously processes sensor readings, environmental conditions, machine states, visual information, historical behavior, operator commands, and other telemetry.

The AI uses those inputs to determine what exists, what is happening, what will probably happen next, and what action it should take.

Now change one of those inputs.

Then change several.

Make the changes subtle enough that no individual result looks catastrophic.

An attacker can gradually create a false version of reality inside that target system. If the approach is slow and low the end result can be rather complex.

Along that journey, AI systems could make completely rational decisions based on completely corrupted context.

The model did not necessarily fail.

Its understanding of the world failed.

That distinction will become one of the defining problems in physical AI security.

I Wrote About This Problem Before World Models Entered the Conversation

This problem feels new to many because technology has changed and those people have likely not dealt with these types of environments.

But, to some of us the underlying security principle is not new at all.

In January 2020, while I was one of the original members and CTO at Bayshore Networks, I published an article in Network Security titled “Operational Technology Security – A Data Perspective.” (https://www.sciencedirect.com/science/article/abs/pii/S1353485820300088)

The central argument was straightforward: OT cybersecurity was concentrating too heavily on network-level visibility while overlooking something far more consequential – the actual values inside the data.

Knowing the following mattered:

• That one IP address communicated with another.
• Which network protocol was used.
• That a particular workstation communicated with a Programmable Logic Controller (PLC).

However, none of those facts necessarily told us what happened to the physical process.

For that, we had to understand the data itself. We needed to understand the command, the register, the setpoint value.

Most importantly, we needed to understand what changing certain values would mean in the physical domain.

That was the data-centric security problem in OT. To an extent that is still a problem today.

An attacker did not necessarily need to break the network connection. The connection could remain completely legitimate.

An authenticated engineering workstation could communicate with an approved controller over an expected industrial protocol.

Yet if the attacker changed the right value inside that legitimate communication, the physical result could become dangerous.

In OT, the packet can be legitimate while the value inside it is hostile.

That concept drove much of the thinking behind the technology we built at Bayshore Networks.

We pushed inspection beyond basic network metadata and deeper into industrial protocols, transactions, commands, and values. We wanted security controls to understand what the industrial communication meant, not simply observe that the communication occurred.

Why?

Because data was not simply information.

Data could become physical action.

World Models Extend the Data-Centric OT Problem

This is where my earlier OT work and today’s world-model discussion converge.

The problem I described in 2020 focused on protecting data values because industrial systems could act upon those values with potential physical impact.

World models take that concept significantly further.

A physical AI system does not simply receive a single value and execute a command. Increasingly, it will consume enormous amounts of data to construct an internal representation of its environment.

It will correlate inputs, infer relationships, estimate current state, and predict future state.

Then it may select an action based on that representation.

Therefore, take the old OT question: what does this data value mean to the physical process? This now becomes an even more consequential AI security question: what reality is this data causing the AI to believe?

That is the intellectual bridge between data-centric OT security and physical AI security.

In the OT environments we protected years ago, manipulating a register or setpoint could change a physical process.

In a world-model-driven environment, manipulating enough trusted data could change the AI’s model of the entire process.

At that point AI itself may determine which action should follow.

This gives the adversary an entirely new level of leverage.

Data Becomes Part of the Physical Control Surface

Security leaders need to stop thinking about data solely as something they must prevent attackers from stealing.

In physical AI environments, adversaries may gain more value by changing data than by stealing it.

Consider the information that could feed a physical AI system:

• Camera and video streams.
• Temperature and pressure measurements.
• Location and proximity data.
• Motor position and velocity.
• Machine state.
• Human presence and movement.
• Production telemetry.
• Historical operating patterns.
• Digital-twin state.
• Maintenance information.
• Identity and authorization context.
• Commands from machines or other AI agents.

If some AI technology uses those inputs to determine current state, predict future states, and choose actions, the integrity of those data points becomes part of the physical control surface.

As a result, security teams must ask something much more sophisticated than:

Can this system access the sensor?

They must ask:

Should the system trust what that sensor is telling it right now?

That requires context. As such, questions such as these become very relevant:

• Is this the expected device?
• Has the configuration been modified?
• Does value X make sense within the current operating state?
• Did an authorized identity make some change?
• Does the sequence of events match expected process behavior?
• Could the data be syntactically valid but operationally impossible?

This is precisely where the lessons from my OT past become invaluable.

Seeing the communication is not enough.

Understanding the data is not enough.

Security must understand the data in the context of the physical process, and now in the context of some AI’s evolving model of that process.

A Hostile World Does Not Require a Compromised Model

Much of the current AI security conversation concentrates on attacking models.

We discuss prompt injection, jailbreaks, model theft, adversarial inputs, training-data poisoning, and manipulated outputs.

Obviously, those threats remain important.

However, physical AI creates another powerful adversarial strategy:

Do not attack the intelligence. Attack the world that the intelligence sees.

An adversary could target:

• Perception – change what sensors, cameras, or other inputs report.
• State – alter the data describing the current condition of a machine or environment.
• History – corrupt the historical context the system uses to recognize normal behavior.
• Identity – impersonate a trusted operator, sensor, machine, or workload.
• Relationships – manipulate the system’s understanding of how physical entities depend upon one another.
• Prediction – distort enough contextual information to influence the system’s expected future state.
• Action – abuse the mechanism that translates AI decisions into physical commands.

This attack model should concern cybersecurity leaders because the attacker can work around the intelligence rather than directly against it.

Imagine an AI system correctly concluding:

Given everything I currently know about this environment, action X represents the safest response.

Now imagine that an adversary manipulated what the system knows.

The reasoning may remain sound, but the action can still become dangerous.

See part 2 of this write-up here.