When Agents Control Robots: A Zero Trust Policy Model for Agentic Cyber-Physical Systems

Tharindu Ranathunga; Kavishka Fernando; Susan Rea

cs.DCMay 25, 2026

When Agents Control Robots: A Zero Trust Policy Model for Agentic Cyber-Physical Systems

Authors: Tharindu Ranathunga, Kavishka Fernando, Susan Rea

Abstract

Multi-agent systems powered by large foundation models (LFMs) are increasingly deployed to control industrial robots through natural language, creating deployments in which security failures produce physical consequences. We analyse this threat landscape through Cobot-Claw, a deployed four-agent system for UR3e robotic arm control, and identify five attack classes specific to agentic cyber-physical systems. We propose ZTPM, a Zero Trust Policy Model comprising 25 typed primitives across five enforcement domains with Physical Impact Tiers as a runtime policy dimension. An empirical evaluation across 60 execution traces on two LFM backends provides initial evidence that actuation parameter selection is model-dependent and non-deterministic, motivating the need for policy-level enforcement at the physical actuation boundary.

Explore similar work

Agent Security is a Systems Problem
May 18, 2026Mihai Christodorescu, Earlence Fernandes, Ashish Hooda +11Security Agentic Systems
MATRA: Modeling the Attack Surface of Agentic AI Systems -- OpenClaw Case Study
May 11, 2026Tim Van hamme, Thomas Vissers, Javier Carnerero-Cano +4Threat Models Artificial Intelligence Safety
Managed Autonomy at Runtime: Gear-Based Safety and Governance for Single- and Multi-Agent Cyber-Physical Systems
Jul 1, 2026Srini Ramaswamy, Wang MiaoshengCyber-Physical System Autonomy

May 18, 2026 · cs.CRJ/K move · Enter open · S save

Agent Security is a Systems Problem

Mihai Christodorescu, Earlence Fernandes, Ashish Hooda, Somesh Jha+10

1Google · University of California San Diego · University of Wisconsin–Madison · 4EmbraceTheRed · 5Gray Swan AI

We take the position that agent security must be approached as a systems problem: the AI model powering the agent must be treated as an untrusted component, and security invariants must be enforced at the system level. Through this lens, efforts to increase model robustness (the dominant viewpoint in the community) are insufficient on their own. Instead, we must complement existing efforts with techniques from the systems security domain. Based on our experience as cybersecurity researchers in operating systems, networks, formal methods, and adversarial machine learning, we articulate a set of core principles, grounded in decades of systems security research, that provide a foundation for designing agentic systems with predictable guarantees. As evidence, we analyze eleven representative real-world attacks on agents and discuss how systems principles, if realized, could have prevented these attacks. We also identify the research challenges that stand in the way of implementing these principles in agents.

Security Agentic Systems Artificial Intelligence Safety Cybersecurity Artificial Intelligence Models

Open paper Ask about it PDF

Abstract

Explore similar work

Agent Security is a Systems Problem

MATRA: Modeling the Attack Surface of Agentic AI Systems -- OpenClaw Case Study

Managed Autonomy at Runtime: Gear-Based Safety and Governance for Single- and Multi-Agent Cyber-Physical Systems