Securing AI Agents in Cyber-Physical Systems: A Survey of Environmental Interactions, Deepfake Threats, and Defenses

AI systems controlling physical infrastructure face unique vulnerabilities: Unlike traditional cybersecurity threats, AI agents in cyber-physical systems (like smart grids) can be manipulated through deepfakes and semantic attacks that trick their perception of the real world, potentially causing physical harm rather than just data breaches.

Deepfakes and AI-generated content pose direct safety risks: Recent advances in generative AI enable attackers to create convincing fake images, videos, or sensor data that can deceive AI agents into making dangerous decisions in safety-critical environments, representing a threat category that traditional security defenses weren't designed to address.

New AI protocols expand the attack surface: Emerging technologies like the Model Context Protocol (MCP) that allow AI agents to dynamically use different tools and share information across systems create additional security vulnerabilities that need to be actively managed and monitored.

Detection alone is insufficient for safety-critical systems: The paper's real-world smart grid case study demonstrates that simply detecting attacks isn't enough—practical constraints like timing delays, sensor noise, and false-alarm costs mean that AI systems in critical infrastructure need multiple layers of defense and cannot rely solely on threat detection to prevent harm.

Trust mechanisms grounded in physics and data provenance are essential: Rather than trusting AI decisions blindly, responsible deployment requires systems that verify decisions against physical laws and track the origin and reliability of information, creating multiple checkpoints before AI agents take actions affecting the physical world.