Part 2 of “AI Is entering the physical world”
Considering everything covered in part 1 of this article, it’s time to explore the importance and relevance of the adversarial mindset.
The Adversarial Mindset Must Extend to Perceived Reality
Security teams cannot limit questions to something like:
Does the AI accurately understand the environment?
Instead, they should ask:
How could I make the AI misunderstand the environment while leaving it confident that its understanding remains accurate?
That shift produces very different security exercises.
For example, the following questions start to gain power:
- Can conflicting sensor states exist?
- Can temporal relationships between events be manipulated?
- Can a legitimate device report technically valid but physically impossible values?
- Can one AI agent be made to trust information supplied by another compromised agent?
- Can some AI technology be fooled into selecting a dangerous action that still appears rational?
- Can several individually low-risk inputs be influenced such that their combined effect changes some system’s interpretation of reality?
This goes far beyond vulnerability scanning.
It requires an understanding of the target environment and the making of educated (adversary informed) attacking assumptions.
Identity Becomes Even More Important in the Physical World
Interestingly, physical AI also amplifies the importance of identity. This is important given that many of the older OT protocols have no notion of a user or identity. Think about that, in many cases older ecosystems would allow network traffic carrying commands that could create physical impact. Yet, no authenticated user was part of the equation. We must do better now.
Every participant in a physical environment needs an identity or an attributable source of authority. That includes people, sensors, robots, cameras, controllers, applications, models, workloads, autonomous agents, and external systems.
The AI must know more than what information arrived.
It needs context about where that information came from, which identity produced it, and whether the organization should trust that source.
Likewise, when some AI technology decides to act, the receiving system needs to understand the authority behind that action.
Organizations should preserve a hierarchical chain such as:
- Human owner
- AI system
- Model decision
- Agent identity
- Delegated authority
- Physical command
- Machine action
When anything within that chain breaks, accountability breaks with it.
More importantly, security loses the ability to determine whether something with legitimate authority produced some physical action.
In IT, a compromised identity can expose information or disrupt systems.
In physical AI, a compromised identity may eventually move something.
Cybersecurity Must Now Protect State, Not Just Systems
As physical AI develops, cybersecurity architecture will need to focus increasingly on state. Some of the types of questions that need answers as they relate to state are:
- What is true right now?
- Which entities exist at the moment?
- What are these entities doing?
- Which relationships connect them?
- What actions have already occurred?
- Which future states remain plausible?
- What authority exists to change the current state?
And critically:
How confident are we that the data describing current state is trustworthy?
Traditional alerts often examine individual events.
Physical AI security will need to understand sequences, relationships, causality, and physical context.
Some examples are:
- A temperature reading of 190 degrees may be safe in one operating state and extremely dangerous in another.
- A valve opening may be normal after one event and malicious after another.
- A robot entering an area may present little risk until a person enters the same physical space.
In the physical domain, context determines risk.
Therefore, security platforms will need stronger temporal models, dynamic graphs, event streams, behavioral baselines, identity relationships, process awareness, and state prediction.
The goal cannot remain simply detecting what has already happened.
We need to understand what is happening, why it is happening, and what is likely to happen next.
This represents another important shift for cybersecurity.
Historically, security operations have been overwhelmingly reactive. An event occurs, a signal appears, an alert fires, and analysts investigate. The entire incident response industry exists because of this reactive model.
Physical AI will demand more predictive security.
If some AI technology controlling or influencing an environment can reason about what happens next, defenders must develop comparable capabilities to identify dangerous future states before systems can reach them.
The objective becomes more than detecting malicious activity.
It becomes preventing the environment from reaching an unsafe state.
Six Security Principles for Physical AI
This is not television, and it will be a bit before humanoid robots begin to appear throughout the enterprise. Cybersecurity leaders do not need to wait for that day before they start preparing. That preparation can begin now and here are six relevant suggestions:
1. Protect the Data That Defines Reality
Identify the data that physical AI systems use to understand their environment.
Establish provenance, integrity controls, behavioral baselines, cross-source validation, and clear ownership. This data needs to be protected as it will be the basis of important truths.
Furthermore, treat manipulation of physical-state data as a high-consequence security event.
We have spent decades protecting sensitive data from exposure. Physical AI requires equal attention to protecting data from malicious alteration.
2. Understand Semantics, Not Just Traffic
Do not stop at network visibility as that is simply not enough.
Understand what commands and values actually mean to consuming physical processes.
This was central to the data-centric approach I advocated in OT security years ago, and it becomes even more important when AI consumes that information to understand some environment.
Allowed communication and safe action are not synonymous.
3. Bind Identity to Physical Authority
Every human and non-human actor capable of influencing the physical environment needs an attributable identity, constrained authority, and accountable owner. We have to do better than the OT protocols of the past where no identity was bound to commands and changes flowing via network communications.
Organizations must know who or what caused every consequential action.
They also need to continuously evaluate whether that identity remains trustworthy.
4. Model the Blast Radius Before Granting Autonomy
Before giving an AI system authority to act, determine what happens if it makes the wrong decision. This requires proper testing, consideration of edge cases, and careful attention to the design and enforcement of boundaries.
Ask how far one incorrect action can propagate through interconnected machines, systems, and physical processes.
Then constrain autonomy accordingly.
The greater the physical consequence, the smaller the acceptable gap between authority and accountability.
5. Use Simulation as a Security Tool
Digital twins and simulated environments should do more than optimize operations or train models.
Security teams can use them to test adversarial scenarios, evaluate “what-if” conditions, attempt to predict attack paths, and observe potential physical consequences without endangering production environments.
However, teams must also secure the simulation itself.
If the digital twin becomes an input into training, planning, or decision-making, poisoned simulation data can eventually influence downstream real-world behavior.
6. Design for Safe Failure
Every physical AI system needs an independently enforceable path to a safe state.
Security teams should be able to dynamically revoke authority, isolate compromised components, reject untrusted data, switch to manual control, and stop physical action.
Most importantly, do not assume that the AI responsible for normal operation should also control its own emergency containment.
Leadership needs to Understand the Physical AI Transition
Boards and executive teams do not need to become experts in AI technologies or the designing of world-class architectures.
However, they do need to understand what happens when AI crosses the boundary between recommendation and action as that can have a direct impact on business operations.
Here are a few questions leadership should start asking:
- Where can AI already influence physical processes in our organization?
- Which AI systems can issue commands that trigger physical action?
- Which data sources clearly define their understanding of physical state?
- Can we establish the integrity and provenance of that data?
- Can data manipulation create unsafe environments?
- Which human and machine identities possess authority over systems that have physical capabilities?
- Have we tested how the systems respond to intentionally manipulated environments?
- What physical consequences could follow an incorrect decision?
- Can we quickly force the environment into a safe state when trust disappears?
These are not robotics questions.
They are enterprise-risk and governance questions.
We Have Seen Part of This Future Before
World models and physical AI introduce powerful new technology.
Yet one of their central security problems brings me directly back to the OT environments we worked to protect at Bayshore Networks.
In 2020, I argued that protecting industrial environments required us to understand more than who communicated with whom.
We had to understand the actual values moving through industrial protocols.
Then we had to understand what would happen in the physical world when a PLC, controller, drive, or other system acted upon those values.
That progression was:
Data → Context → Command → Physical Consequence
World models extend that to:
Data → Perceived Reality → Predicted Future → Decision → Physical Consequence
That additional intelligence does not eliminate the old security problem.
It magnifies it.
World models will increasingly use huge volumes of data to construct representations of reality, predict future states, and select actions.
Therefore, cybersecurity must protect much more than the model.
We must protect the integrity of the world the model believes it inhabits.
That requires trusted data, attributable identities, semantic understanding, adversarial testing, state awareness, predictive security, and tight control over physical authority.
The GenAI era taught organizations that machines can create.
The agentic AI era is teaching us that machines can act.
World models and physical AI will force us to confront the next question:
What happens when machines can understand enough of the physical world to predict it, and possess enough authority to change it?
Cybersecurity leaders should start considering that question now.
Because AI is entering the physical world.
And once cyber risk becomes physical risk, we no longer get to treat a corrupted view of reality as merely a bad AI output.