What physical consequences can AI agents cause in industrial environments?

AI agents operating in OT environments can move valves, open breakers, and adjust set points at machine speed. When acting on legacy systems running 15 to 50 years, those actions carry cyber-physical consequences including safety incidents, environmental harm, and production downtime that cascade across 20 or more interconnected systems.

Why do AI hallucinations matter more in OT than IT?

AI outputs still contain hallucinations in 6 to 10 percent of cases. In IT, a hallucination causes data errors or service disruption. In OT, a hallucinated set point recommendation applied by an autonomous agent can move a valve, open a breaker, or cascade across 20 or more interconnected systems, producing physical safety consequences.

Can existing IT security frameworks protect OT from agentic AI risks?

IT security frameworks rely on patching schedules, credential rotation, and system reboots that do not apply to OT environments. Legacy PLCs running for 15 or more years cannot be patched without planned shutdowns. Industrial cybersecurity teams need OT-specific governance that treats AI agents as insider threats with unique credentials and monitored access.

How does the tribal knowledge shortage accelerate agentic AI adoption in manufacturing?

Manufacturing and oil and gas industries face a wave of retirements from experienced operators whose decades of plant-specific knowledge cannot be replaced through hiring alone. Agentic AI is the primary tool available to transfer that operational knowledge to a younger workforce, making adoption inevitable for organizations that cannot afford to lose critical process expertise.

Is Agentic AI an OT Insider Threat?

Agentic AI in operational technology acts with its own authority at machine speed, inside environments where a wrong decision moves a valve or opens a breaker. At the Industrial AI Summit 2026, Ian Bramson, VP of Global Industrial Cybersecurity at Black & Veatch, Scott Christensen, Cyber Practice Director at GrayMatter, and Gary Tillery, CEO of Skkynet, described why industrial cybersecurity teams should treat every AI agent in OT as an insider threat, regardless of whether the threat is malicious or accidental.

How Does Agentic AI Differ from Traditional AI in OT?

Generative AI suggests, agentic AI acts, and in OT environments that distinction carries physical consequences. An AI agent that adjusts a set point or triggers a model shift operates inside systems where outcomes affect site safety, environmental safety, public safety, and production uptime. Legacy control systems, some running for 50 years, were never designed to be connected to AI, never built to be patched without a planned shutdown, and never intended to have an autonomous agent making changes at speed. A change to one of the 20 or more interconnected systems can cascade across the others. When AI executes rather than recommends, the consequences in OT are cyber-physical, a category that IT environments do not share.

Why Should OT Teams Treat AI Agents as Insider Threats?

An AI agent in OT holds credentials, accesses systems, and takes actions. By that definition, it is an insider. Whether someone manipulated its training data, created a rogue agent, or model drift caused an unintended outcome, the consequences remain the same: safety and uptime at risk, and those consequences can scale rapidly.

“When you can have real world effects and then you put agentic AI in there, meaning you’re taking the human out of the decision loop, that’s probably the scariest place in this whole world of ours,” said Ian Bramson, VP of Global Industrial Cybersecurity at Black & Veatch.

The paperclip theory applies directly to OT: an agent optimized for one objective produces unintended consequences across connected systems. AI agents doing exactly what they were designed to do can still cause harm when operating at scale in environments tied to physical safety. Between 6% and 10% of AI outputs still contain hallucinations, making containment controls necessary for every agent with access to production systems.

Who Should Own Agentic AI Risk in Industrial Operations?

If agentic AI functions as an insider threat, then the team responsible for insider threats in OT should own the risk. That team is the industrial cybersecurity group, not the IT security department. Industrial cybersecurity teams traditionally defended against external attackers and managed AI-versus-AI scenarios. Owning governance over every agent running inside the OT environment requires a different technical capability and a broader scope of responsibility. The alternative, passing the responsibility between groups without a clear owner, creates the same accountability vacuum that already exists around downtime costs, where IT points to OT, OT points to corporate security, and corporate security points to a vendor SLA that nobody has read closely.

Why Is Agentic AI in OT Inevitable?

All three panelists agreed: agentic AI in OT is already here, operating in manufacturing and other industrial sectors. The market pressure to deploy AI agents is large enough to overwhelm any effort to avoid adoption entirely.

“Everybody’s got that one guy at the plant that’s threatening every year, this will be the year I retire. And when he leaves, all that knowledge goes with him,” said Scott Christensen, Cyber Practice Director at GrayMatter.

The tribal knowledge retiring out of manufacturing and oil and gas over the next decade creates a resource shortfall that no hiring strategy can fill. Agentic AI is the tool most likely to close that knowledge shortage for a younger workforce that lacks the decades of operational experience being lost. Industrial organizations face a choice: adopt agentic AI on their own timetable with governance in place, or find it already running without controls. OT network security and operational performance require integration of people, process, data, technology, and governance, with security built in from the start.

Dimension	IT Environment	OT Environment
Consequence of failure	Data loss, service disruption	Safety incidents, environmental harm, production downtime
System age	3-5 year refresh cycles	Legacy systems running 15-50 years
Patching approach	Regular scheduled updates	Cannot patch without planned shutdown
AI agent risk	Financial, reputational	Cyber-physical, human safety
Integration complexity	Standardized platforms	20+ vendor systems with cascading dependencies

Sources

This article is based on a panel discussion at the Industrial AI Summit 2026 featuring Gary Tillery, CEO of Skkynet, Scott Christensen, Cyber Practice Director at GrayMatter, and Ian Bramson, VP of Global Industrial Cybersecurity at Black & Veatch, moderated by Matt Morris of EverLine. AI tools were used to help summarize and organize the content. Reviewed and edited by the IIoT World editorial team.