Part 1 of “AI Is entering the physical world”
For the last several years, most organizations have experienced Artificial Intelligence through a screen. Come to think of it, so have many of the recently self-appointed AI experts. I consider most of these people users, not experts. Things are changing on levels these folks are not prepared for. AI Is entering the physical world. Why cybersecurity must change now.
Typical “AI” usage at the moment equates to Generative AI (GenAI). This means someone types a prompt and an engine generates content. The engine can write code, analyze a document, create an image, summarize data, or recommend an action.
That model of AI is already changing.
The next major evolution will push AI beyond understanding language and digital information. AI systems will increasingly model environments, predict how those environments may change, reason about physical objects, and take actions in the real world.
World models, embodied AI, robotics, autonomous systems, digital twins, and increasingly capable agentic ecosystems are moving us in that direction.
Consequently, cybersecurity leaders need to understand that this transition changes the security problem dramatically.
Potential Physical Impact
When AI exists primarily inside a digital environment, a bad decision may generate incorrect information, expose data, execute malicious code, or compromise a business process.
When AI can perceive and act upon the physical world, a bad decision can move a machine.
It can alter a manufacturing process or the behavior of a robot. It can influence an autonomous vehicle or manipulate an industrial control process.
Ultimately, it can create physical consequences.
That is why cybersecurity must change. Now.
Traditional cybersecurity primarily protects systems, identities, networks, applications, and information. Physical AI adds something fundamentally different. In most cases, foreign. Cybersecurity must now protect an AI system’s perception of physical reality, the data used to construct that reality, the authority to act upon it, and the resulting physical state.
An attacker may no longer need to compromise the AI model itself.
Manipulating the world the model sees may be enough.
That shifts cybersecurity beyond protecting systems and information. We must increasingly protect state, perception, prediction, authority, and physical consequence.
Physical AI changes cybersecurity because we must protect not only the AI, but the integrity of the world the AI believes it inhabits.
World Models Change What AI Understands
Large Language Models (LLMs) became powerful by learning relationships across enormous amounts of data.
World models pursue a different capability.
At a high level, a world model develops a representation of an environment and uses that representation to reason about how the environment may change over time.
Instead of merely asking, “What should come next in this sequence?” as LLMs do, world model based systems begins answering questions such as:
- What exists in this environment?
- How are these objects related?
- What state are they currently in?
- What happens if something moves or changes?
- What will the environment probably look like next?
- How will my actions affect this environment?
- What action is necessary to reach a desired state?
This capability matters enormously for robotics and autonomous systems.
For example, a robot operating in a warehouse cannot simply identify a forklift. It needs to understand where the forklift is, is it currently being operated, how quickly it is moving, where it will probably go next, and what obstacles surround it.
Likewise, an industrial AI system cannot simply recognize that a valve exists. It may need to understand the valve’s current state, its relationship to pressure elsewhere in the process, what normally happens after the valve changes state, and which physical consequences could follow.
In other words, the AI must build and continuously update a representation of reality.
That representation becomes extraordinarily valuable.
It also becomes an extraordinarily attractive target.
Why Cybersecurity Must Change When AI Becomes Physical
Cybersecurity traditionally focuses on protecting identities, systems, applications, networks, APIs, and data.
Physical AI forces us to extend that thinking.
We now have to protect the system’s understanding of reality.
If an attacker manipulates the information an AI system uses to construct that reality, the attacker may never need to compromise the model itself. That is a dynamic the security industry has yet to contend with.
Consider an autonomous system that continuously processes sensor readings, environmental conditions, machine states, visual information, historical behavior, operator commands, and other telemetry.
The AI uses those inputs to determine what exists, what is happening, what will probably happen next, and what action it should take.
Now change one of those inputs.
Then change several.
Make the changes subtle enough that no individual result looks catastrophic.
An attacker can gradually create a false version of reality inside that target system. If the approach is slow and low the end result can be rather complex.
Along that journey, AI systems could make completely rational decisions based on completely corrupted context.
The model did not necessarily fail.
Its understanding of the world failed.
That distinction will become one of the defining problems in physical AI security.
I Wrote About This Problem Before World Models Entered the Conversation
This problem feels new to many because technology has changed and those people have likely not dealt with these types of environments.
But, to some of us the underlying security principle is not new at all.
In January 2020, while I was one of the original members and CTO at Bayshore Networks, I published an article in Network Security titled “Operational Technology Security – A Data Perspective.” (https://www.sciencedirect.com/science/article/abs/pii/S1353485820300088)
The central argument was straightforward: OT cybersecurity was concentrating too heavily on network-level visibility while overlooking something far more consequential – the actual values inside the data.
Knowing the following mattered:
- That one IP address communicated with another.
- Which network protocol was used.
- That a particular workstation communicated with a Programmable Logic Controller (PLC).
However, none of those facts necessarily told us what happened to the physical process.
For that, we had to understand the data itself. We needed to understand the command, the register, the setpoint value.
Most importantly, we needed to understand what changing certain values would mean in the physical domain.
That was the data-centric security problem in OT. To an extent that is still a problem today.
An attacker did not necessarily need to break the network connection. The connection could remain completely legitimate.
An authenticated engineering workstation could communicate with an approved controller over an expected industrial protocol.
Yet if the attacker changed the right value inside that legitimate communication, the physical result could become dangerous.
In OT, the packet can be legitimate while the value inside it is hostile.
That concept drove much of the thinking behind the technology we built at Bayshore Networks.
We pushed inspection beyond basic network metadata and deeper into industrial protocols, transactions, commands, and values. We wanted security controls to understand what the industrial communication meant, not simply observe that the communication occurred.
Why?
Because data was not simply information.
Data could become physical action.
World Models Extend the Data-Centric OT Problem
This is where my earlier OT work and today’s world-model discussion converge.
The problem I described in 2020 focused on protecting data values because industrial systems could act upon those values with potential physical impact.
World models take that concept significantly further.
A physical AI system does not simply receive a single value and execute a command. Increasingly, it will consume enormous amounts of data to construct an internal representation of its environment.
It will correlate inputs, infer relationships, estimate current state, and predict future state.
Then it may select an action based on that representation.
Therefore, take the old OT question: what does this data value mean to the physical process? This now becomes an even more consequential AI security question: what reality is this data causing the AI to believe?
That is the intellectual bridge between data-centric OT security and physical AI security.
In the OT environments we protected years ago, manipulating a register or setpoint could change a physical process.
In a world-model-driven environment, manipulating enough trusted data could change the AI’s model of the entire process.
At that point AI itself may determine which action should follow.
This gives the adversary an entirely new level of leverage.
Data Becomes Part of the Physical Control Surface
Security leaders need to stop thinking about data solely as something they must prevent attackers from stealing.
In physical AI environments, adversaries may gain more value by changing data than by stealing it.
Consider the information that could feed a physical AI system:
- Camera and video streams.
- Temperature and pressure measurements.
- Location and proximity data.
- Motor position and velocity.
- Machine state.
- Human presence and movement.
- Production telemetry.
- Historical operating patterns.
- Digital-twin state.
- Maintenance information.
- Identity and authorization context.
- Commands from machines or other AI agents.
If some AI technology uses those inputs to determine current state, predict future states, and choose actions, the integrity of those data points becomes part of the physical control surface.
As a result, security teams must ask something much more sophisticated than:
Can this system access the sensor?
They must ask:
Should the system trust what that sensor is telling it right now?
That requires context. As such, questions such as these become very relevant:
- Is this the expected device?
- Has the configuration been modified?
- Does value X make sense within the current operating state?
- Did an authorized identity make some change?
- Does the sequence of events match expected process behavior?
- Could the data be syntactically valid but operationally impossible?
This is precisely where the lessons from my OT past become invaluable.
Seeing the communication is not enough.
Understanding the data is not enough.
Security must understand the data in the context of the physical process, and now in the context of some AI’s evolving model of that process.
A Hostile World Does Not Require a Compromised Model
Much of the current AI security conversation concentrates on attacking models.
We discuss prompt injection, jailbreaks, model theft, adversarial inputs, training-data poisoning, and manipulated outputs.
Obviously, those threats remain important.
However, physical AI creates another powerful adversarial strategy:
Do not attack the intelligence. Attack the world that the intelligence sees.
An adversary could target:
- Perception – change what sensors, cameras, or other inputs report.
- State – alter the data describing the current condition of a machine or environment.
- History – corrupt the historical context the system uses to recognize normal behavior.
- Identity – impersonate a trusted operator, sensor, machine, or workload.
- Relationships – manipulate the system’s understanding of how physical entities depend upon one another.
- Prediction – distort enough contextual information to influence the system’s expected future state.
- Action – abuse the mechanism that translates AI decisions into physical commands.
This attack model should concern cybersecurity leaders because the attacker can work around the intelligence rather than directly against it.
Imagine an AI system correctly concluding:
Given everything I currently know about this environment, action X represents the safest response.
Now imagine that an adversary manipulated what the system knows.
The reasoning may remain sound, but the action can still become dangerous.
See part 2 of this write-up here.